Malicious Behavior Detection Research Articles

An Improved Design for a Cloud Intrusion Detection System Using Hybrid Features Selection Approach with ML Classifier

The rapid adoption of cloud computing has introduced new security concerns, particularly regarding data privacy and protection from sophisticated cyberattacks. Intrusion Detection Systems (IDSs) based on Machine Learning (ML) offer improved detection of malicious behaviour in network traffic. However, existing IDS solutions struggle with large-dimensional data and imbalanced datasets, resulting in higher false positive rates (FPR) and reduced detection rates (DR). In this paper, we propose an improved Cloud IDS leveraging a hybrid features selection approach using Information Gain (IG), Chi-square (CS), and Particle Swarm Optimization (PSO). To address the challenge of imbalanced datasets, the Synthetic Minority Over-sampling Technique (SMOTE) is employed. The Random Forest (RF) classifier is used to detect and classify attacks. The system is evaluated on the UNSW-NB15 and Kyoto datasets, achieving accuracies of over 98% and 99%, respectively, outperforming other methods in terms of detection accuracy.

Early Detection and Prevention of Malicious User Behavior on Twitter Using Deep Learning Techniques

Early Detection and Prevention of Malicious User Behavior on Twitter Using Deep Learning Techniques

Suspicious behaviour detection in multilayer social networks using PF-KMA and SS-GAE techniques

Multilayer Social networks are an important part of human life to interact on different networks at the same time. Due to the openness of such networks, they become a platform for spammers to spread malicious behaviors. Hence, there is an urgent need for effective detection of malicious behaviors; thereby, enabling the networks to take mitigation actions to decrease the possibility to reward such activities. Detection of suspicious behaviors in previous works is challenging due to the problems of community detection, the large amount of feature corruption, and memory requirements. Thus, to deal with such problems, in this paper, an efficient clustering-based detection of malicious users in multilayer social networks is proposed. Initially, the input dataset is pre-processed and used for Exponential Distribution based Erdős–Rényi based graph construction. From the graph structure, two types of data, such as user representations and graph features are extracted for graph encoding using the Soft Sign activated Graph Auto Encoder model. Then, the decoding is done to predict the information diffusion level, thereby, ranking the users using the Laplace Regularization technique. Then, the ranked users are clustered into different groups using the Pareto Front based K-Means Clustering Algorithm technique. Finally, the experimental results were analyzed to demonstrate the efficacy of the proposed model to detect malicious users in multilayer social networks.

DETECTION OF WIRELESS NETWORK ATTACKS USING SUPERVISED MACHINE LEARNING TECHNIQUE

The security and integrity of computer networks are seriously threatened by network assaults. Keeping a safe network environment requires the capacity to anticipate and stop these threats. Supervised machine learning methods have become powerful instruments for attacking network traffic and spotting patterns that point to malicious behaviour. We provide an in-depth examination of supervised machine learning methods for network attack prediction. We gather the data, preprocess it, extract pertinent features, and structure it so that machine learning algorithms may use it.We assess these algorithms' performance. To understand the fundamental patterns and traits of network assaults, we look at how interpretability the trained models are. This enables network managers to comprehend the types of threats and create suitable. Keywords - Network Attacks, Supervised Machine Learning, Network security,Network traffic analysis, Malicious behavior detection, Feature extraction,Machine learning algorithm,Model interpretability,Network attack patterns,Network defense strategies,Naive Bayes Algorithm, Ridge Classfier ,Random Forest Classfier

Realtime polymorphic malicious behavior detection in blockchain-based smart contracts

Abstract This paper proposes an innovative approach to achieving real-time polymorphic behavior detection, and its direct application to blockchain-focused smart-contracts. We devise a method based on a non-deterministic finite state machine to perform approximate pattern-matching, using a look-ahead mechanism implemented through a concept similar to that of a sliding window, and using threshold-based similarity checking at every state in the automaton. We introduce and formalize our approach, discuss the challenges we faced and then test it in a real-world environment. The experimental results obtained showed a significant speed-up of our approach, as compared to the classic similarity measures used commonly in such scenarios.

Graph based encrypted malicious traffic detection with hybrid analysis of multi-view features

At present, the TLS cryptographic protocol is widely deployed. While protecting the security and integrity of transmitted information, it also makes the detection of malicious behavior more difficult. In recent years, researchers have proposed many encrypted malicious traffic detection methods. However, the existing approaches have some shortcomings. Firstly, although researchers have extracted multi-view features from different aspects, which can be divided into vectorized features based on feature engineering and image features based on original data, existing methods cannot fully integrate the features of different forms of expression. Secondly, most of the existing methods do not fully analyze the correlation between different encrypted traffic. Thirdly, the existing methods based on correlation analysis have low processing efficiency and cannot be applied to real networks. In the paper, we present MalDiscovery, a novel technique to discover encrypted malicious traffic to address all the above issues. For encrypted malicious traffic, MalDiscovery constructs an attribute KNN graph, in which encrypted sessions are used as nodes to construct a KNN graph according to the similarity of image features, and vectorized features are used as attributes of corresponding nodes. After that, the GraphSAGE model is used to collect relevant node information through correlation analysis to enrich the embeddings of each node. Finally, we achieve the accurate binary classification of nodes in the graph based on richer embeddings. We use extensive experiments to evaluate the proposed method, and the experiment results show that MalDiscovery can achieve an accuracy of about 99.9%, significantly outperforming all compared methods.

A Study on Detection of Malicious Behavior Based on Host Process Data Using Machine Learning

With the rapid increase in the number of cyber-attacks, detecting and preventing malicious behavior has become more important than ever before. In this study, we propose a method for detecting and classifying malicious behavior in host process data using machine learning algorithms. One of the challenges in this study is dealing with high-dimensional and imbalanced data. To address this, we first preprocessed the data using Principal Component Analysis (PCA) and Uniform Manifold Approximation and Projection (UMAP) to reduce the dimensions of the data and visualize the distribution. We then used the Adaptive Synthetic (ADASYN) and Synthetic Minority Over-sampling Technique (SMOTE) to handle the imbalanced data. We trained and evaluated the performance of the models using various machine learning algorithms, such as K-Nearest Neighbor, Naive Bayes, Random Forest, Autoencoder, and Memory-Augmented Deep Autoencoder (MemAE). Our results show that the preprocessed datasets using both ADASYN and SMOTE significantly improved the performance of all models, achieving higher precision, recall, and F1-Score values. Notably, the best performance was obtained when using the preprocessed dataset (SMOTE) with the MemAE model, yielding an F1-Score of 1.00. The evaluation was also conducted by measuring the Area Under the Receiver Operating Characteristic Curve (AUROC), which showed that all models performed well with an AUROC of over 90%. Our proposed method provides a promising approach for detecting and classifying malicious behavior in host process data using machine learning algorithms, which can be used in various fields such as anomaly detection and medical diagnosis.

TokenAware: Accurate and Efficient Bookkeeping Recognition for Token Smart Contracts

Tokens have become an essential part of blockchain ecosystem, so recognizing token transfer behaviors is crucial for applications depending on blockchain. Unfortunately, existing solutions cannot recognize token transfer behaviors accurately and efficiently because of their incomplete patterns and inefficient designs. This work proposes TokenAware , a novel online system for recognizing token transfer behaviors. To improve accuracy, TokenAware infers token transfer behaviors from modifications of internal bookkeeping of a token smart contract for recording the information of token holders (e.g., their addresses and shares). However, recognizing bookkeeping is challenging, because smart contract bytecode does not contain type information. TokenAware overcomes the challenge by first learning the instruction sequences for locating basic types and then deriving the instruction sequences for locating sophisticated types that are composed of basic types. To improve efficiency, TokenAware introduces four optimizations. We conduct extensive experiments to evaluate TokenAware with real blockchain data. Results show that TokenAware can automatically identify new types of bookkeeping and recognize 107,202 tokens with 98.7% precision. TokenAware with optimizations merely incurs 4% overhead, which is 1/345 of the overhead led by the counterpart with no optimization. Moreover, we develop an application based on TokenAware to demonstrate how it facilitates malicious behavior detection.

Effective Selfish Mining Defense Strategies to Improve Bitcoin Dependability

Selfish mining is a typical malicious attack targeting the blockchain-based bitcoin system, an emerging crypto asset. Because of the non-incentive compatibility of the bitcoin mining protocol, the attackers are able to collect unfair mining rewards by intentionally withholding blocks. The existing works on selfish mining mostly focused on cryptography design, and malicious behavior detection based on different approaches, such as machine learning or timestamp. Most defense strategies show their effectiveness in the perspective of reward reduced. No work has been performed to design a defense strategy that aims to improve bitcoin dependability and provide a framework for quantitively evaluating the improvement. In this paper, we contribute by proposing two network-wide defensive strategies: the dynamic difficulty adjustment algorithm (DDAA) and the acceptance limitation policy (ALP). The DDAA increases the mining difficulty dynamically once a selfish mining behavior is detected, while the ALP incorporates a limitation to the acceptance rate when multiple blocks are broadcast at the same time. Both strategies are designed to disincentivize dishonest selfish miners and increase the system’s resilience to the selfish mining attack. A continuous-time Markov chain model is used to quantify the improvement in bitcoin dependability made by the proposed defense strategies. Statistical analysis is applied to evaluate the feasibility of the proposed strategies. The proposed DDAA and ALP methods are also compared to an existing timestamp-based defense strategy, revealing that the DDAA is the most effective in improving bitcoin’s dependability.

Securing Software-Defined WSNs Communication via Trust Management

Software-defined wireless sensor networks (SDWSNs) can be functionally affected by malicious sensor nodes that perform arbitrary actions, e.g., message dropping or flooding. The malicious nodes can degrade the availability of the network due to in-band communications and the inherent lack of secure channels in SDWSNs. In this article, we design a hierarchical trust management scheme for SDWSNs (namely, TSW) to detect potential threats inside SDWSNs while promoting node cooperation and supporting decision making in the forwarding process. TSW evaluates the trustworthiness of involved nodes and enables the detection of malicious behavior at various levels of the SDWSN architecture. We develop sensitive trust computational models to detect several malicious attacks. Furthermore, we propose separate trust scores and parameters for control and data traffic, respectively, to enhance the detection performance against attacks directed at the crucial traffic of the control plane. Furthermore, we develop an acknowledgment-based trust recording mechanism by exploiting some built-in SDN control messages. To ensure the resilience and honesty of the trust scores, a weighted averaging approach is adopted, and a reliability trust metric is defined. Through extensive analyses and numerical simulations, we demonstrate that TSW is efficient in detecting malicious nodes that launch several communications and trust management threats, such as black-hole, selective forwarding, denial of service, bad mouthing, and ON–OFF attacks.

DL-FHMC: Deep Learning-Based Fine-Grained Hierarchical Learning Approach for Robust Malware Classification

The acceptance of the Internet of Things (IoT) for both household and industrial applications is accompanied by the rapid growth of IoT malware. With the increase of their attack surface, analyzing, understanding, and detecting IoT malicious behavior are crucial. Traditionally, machine and deep learning-based approaches are used for malware detection and behavioral understanding. However, recent research has shown the susceptibility of those approaches to adversarial attacks by introducing noise to the feature space. In this work, we introduce DL-FHMC, a fine-grained hierarchical learning approach for robust IoT malware detection. DL-FHMC utilizes Control Flow Graph (CFG)-based behavioral patterns for adversarial IoT malicious software detection. In particular, we extract a comprehensive list of behavioral patterns from a large dataset of malicious IoT binaries, represented by the shared execution flows, and use them as a modality for malicious behavior detection. Leveraging machine learning and subgraph isomorphism matching algorithms, DL-FHMC provides state-of-the-art performance in detecting malware samples and adversarial examples (AEs). We first highlight the caveats of CFG-based IoT malware detection systems, showing the adversarial capabilities in generating practical functionality-preserving AEs with reduced overhead using Graph Embedding and Augmentation (GEA) techniques. We then introduce Suspicious Behavior Detector, a component that extracts comprehensive behavioral patterns from three popular IoT malicious families, Gafgyt, Mirai, and Tsunami, for AEs detection with high accuracy. The proposed detector operates as a model-independent standalone module, with no prior assumptions of the adversarial attacks nor their configurations.

Performance Verification of Bayesian Network–Based Security Risk Management and Control System for Power Trading Institutions

Risk in power trading is unavoidable for various reasons. The impact of this risk would vary based on the trading characteristics that mainly depend on the market design and power purchase agreements. So, a security risk management and control system for power trading institutions based on a Bayesian network is designed to reduce the risk of power trading projects. As a part of the network, we first provided the overall architecture of the risk management and control system, which includes a malicious network behaviour detection module, controller selection module, data transmission module, and management and control result visualisation module. Second, the hardware test design was implemented by analysing each module’s working principle and function. Based on the hardware design of the system, the regression analysis method is used to evaluate the risk of power transactions, followed by market fluctuation prediction to obtain the prediction result induced risks. The relationship between security risks and risk-influencing factors is analysed using the Bayesian network. The initial list of risks is established, the uncertain risk factors are reasoned, and the security risk management and control model of power trading institutions is tested to achieve the goal of risk management and control. The experimental results show that this method’s risk management and control efficiency are high. At the same time, this method effectively realised comprehensive risk identification by reducing the loss to power enterprises and has near-practical application value.

An effective optimization enabled deep learning based Malicious behaviour detection in cloud computing

An effective optimization enabled deep learning based Malicious behaviour detection in cloud computing

Juggler-ResNet: A Flexible and High-Speed ResNet Optimization Method for Intrusion Detection System in Software-Defined Industrial Networks

<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ResNets</i> are widely used in the intrusion detection system (IDS) of software-defined industrial network to construct accurate intelligence detection of network attacks. However, the IDS based on ResNets has a long detecting interval because of the fine-grained operator and intermediate outcomes of the multi-branch architecture of ResNets. To address this problem, in this article, we propose Juggler-ResNet with a fusible residual structure that preserves the feature extraction ability of the residual structure and enables equivalent transformation to linear topology to support low latency inference service in the industrial application (e.g., malicious network behavior detection, fault diagnosis, etc.). First, we propose a fusible multibranch residual structure to avoid gradient vanishing problems in the training phase. Second, we convert it to linear-topology by using a set of equivalent fusion operators. Finally, the linear-topology model is deployed to accelerate inference speed. Our experimental results on CIFAR-10 and CIFAR-100 show that fusible residual structure can achieve 2.08-4.3x acceleration with state-of-the-art level accuracy performance.

A game model design using test bed for Malware analysis training

PurposeThis article aims to provide an interactive model for hands on training of malware analysis. Cyberwar games are the highly stylized representation of cyber conflicts in a simulation model. Game models are helpful in understanding the phenomenon of cyber attacks as well as to evolve new techniques of detection. Cyber security trainings are generally very challenging. Cyber test beds make such trainings easy both for trainees and trainers. However, it is not feasible for each organization to build a network for the sole purpose of hands-on training for employees. Therefore, it is desirable to build an interactive environment that is interesting and free of cost as well.Design/methodology/approachAfter exploring existing cyberwar games and their techniques, limitation and strengths, this paper presents a design to merge the cyber attacks into a unique model of war game for detection and analysis of malware. This research designs a malware analysis testbed using online free resources. The authors have used the platform of Cyber Defense Technology Experimental Research (DETER). This study proposed model of a testbed that supports malware reverse engineering scenarios, exercise logs and analysis to develop reverse engineering tactics.FindingsThe proposed cyber testbed is an automated system that can be used as a platform to train cyber warriors. A few features of the proposed testbed are as follows: testbed provides real or seemingly real malware communication with the real world. It includes automated decisions for the detection of malicious behavior without human intervention. The author gives a design to develop free of cost mechanism for remote learning of highly technical cyber security areas, and this simulation is for malware analysis.Originality/valueCyberwar games are built for strengthening offensive and defensive capabilities in cyberspace. For this purpose, many simulations, as well as emulation platforms, can be found. Some are free and open-source, whereas others are commercial and quite expensive. Existing testbeds have limitations in respect of cyberwar games for creating innovative scenarios. Existing literature does not offer any attack and response scenario developed for malware detection through some existing open-source and online simulation or emulation environments. This research includes an analysis of the existing platforms as well as the design of a new model for malware analysis and training.

Can We Trust Trust Management Systems?

The Internet of Things is enriching our life with an ecosystem of interconnected devices. Object cooperation allows us to develop complex applications in which each node contributes one or more services. Therefore, the information moves from a provider to a requester node in a peer-to-peer network. In that scenario, trust management systems (TMSs) have been developed to prevent the manipulation of data by unauthorized entities and guarantee the detection of malicious behaviour. The community concentrates effort on designing complex trust techniques to increase their effectiveness; however, two strong assumptions have been overlooked. First, nodes could provide the wrong services due to malicious behaviours or malfunctions and insufficient accuracy. Second, the requester nodes usually cannot evaluate the received service perfectly. For this reason, a trust system should distinguish attackers from objects with poor performance and consider service evaluation errors. Simulation results prove that advanced trust algorithms are unnecessary for such scenarios with these deficiencies.

Malicious behavior detection in cloud using self‐optimized dynamic kernel convolutional neural network

AbstractCloud computing is one example of a technological revolution that has drastically altered the way traditional commercial operations are conducted. Because cloud platforms are fundamentally revolutionizing the area of computing, they must provide safe transmission and storage of user data by assuring the confidentiality, integrity, and availability of the data. As a result, establishing a secure cloud computing framework is crucial, and security cannot only rely on the user's credentials being verified. To overcome this problem, this article presents a multi‐population genetic algorithm optimized dynamic kernel convolutional neural network to analyze the user's behavior to identify their malicious intent. This article describes a two‐stage malicious detection and prediction scheme. The proposed system's efficiency is measured by its ability to discriminate between nine different types of attacks in the UNSW‐NB15 dataset (abnormal behavior exhibited by users). The average true positive rate, false positive rate, precision, and F‐measure for the nine attack classes were 99.22%, 99.11%, 99.11%, and 99.22%, respectively, when evaluated using the UNSW‐NB15 dataset. The experimental results demonstrate that this technique is effective in detecting malicious behaviors in the cloud environment with higher accuracy.

An IPSO-KELM based malicious behaviour detection and SHA256-RSA based secure data transmission in the cloud paradigm

An IPSO-KELM based malicious behaviour detection and SHA256-RSA based secure data transmission in the cloud paradigm

Malicious Mining Behavior Detection System of Encrypted Digital Currency Based on Machine Learning

With the gradual increase of malicious mining, a large amount of computing resources are wasted, and precious power resources are consumed maliciously. Many detection methods to detect malicious mining behavior have been proposed by scholars, but most of which have pure defects and need to collect sensitive data (such as memory and register data) from the detected host. In order to solve these problems, a malicious mining detection system based on network timing signals is proposed. When capturing network traffic, the system does not need to know the contents of data packets but only collects network flow timing signals, which greatly protects the privacy of users. Besides, we use the campus network to carry out experiments, collect a large amount of network traffic data generated by mining behavior, and carry out feature extraction and data cleaning. We also collect traffic data of normal network behavior and combine them after labeling. Then, we use four machine learning algorithms for classification. The final results show that our detection system can effectively distinguish the normal network traffic and the network traffic generated by mining behavior.

Malicious Network Behavior Detection Using Fusion of Packet Captures Files and Business Feature Data.

Information and communication technologies have essential impacts on people’s life. The real time convenience of the internet greatly facilitates the information transmission and knowledge exchange of users. However, network intruders utilize some communication holes to complete malicious attacks. Some traditional machine learning (ML) methods based on business features and deep learning (DL) methods extracting features automatically are used to identify these malicious behaviors. However, these approaches tend to use only one type of data source, which can result in the loss of some features that can not be mined in the data. In order to address this problem and to improve the precision of malicious behavior detection, this paper proposed a one-dimensional (1D) convolution-based fusion model of packet capture files and business feature data for malicious network behavior detection. Fusion models improve the malicious behavior detection results compared with single ones in some available network traffic and Internet of things (IOT) datasets. The experiments also indicate that early data fusion, feature fusion and decision fusion are all effective in the model. Moreover, this paper also discusses the adaptability of one-dimensional convolution and two-dimensional (2D) convolution to network traffic data.