Evasion Techniques Research Articles

Yara-Based Emotet Malware Scanner – A Factual Analysis

Malware is malicious software which has the ability to compromise sensitive data and disrupt systems. At present malicious software is the most efficient tool used in compromising the security of computers or any other electronic devices connected to the internet. This has become a menace owing to the rapid progress in technologies such as encryption and data hiding techniques. A highly adaptable and persistent type of malware, Emotet is well-known for its capacity to propagate via phishing emails and send out further malicious payloads, by impairing network and data security. Emotet poses a special risk since it serves as a gateway for other viruses, such as ransomware and data thieves, which can cause serious data breaches, monetary losses, and interruptions to business operations. It poses a serious danger to both individual users and big enterprises due to its advanced evasion techniques and quick network spread. In this project, distinct file signatures and byte patterns that are distinctive of the malware are identified by YARA rules in order to detect Emotet. These patterns include specific sequences used in Emotet’s payload and obfuscation techniques, allowing for precise detection within scanned files.

Genetic programming for enhanced detection of Advanced Persistent Threats through feature construction

Advanced Persistent Threats (APTs) pose considerable challenges in the realm of cybersecurity, characterized by their evolving tactics and complex evasion techniques. These characteristics often outsmart traditional security measures and necessitate the development of more sophisticated detection methods. This study introduces Feature Evolution using Genetic Programming (FEGP), a novel method that leverages multi-tree Genetic Programming (GP) to construct and enhance features for APT detection. While GP has been widely utilized for tackling various problems in different domains, our study focuses on the adaptation of GP to the multifaceted landscape of APT detection. The proposed method automatically constructs discriminative features by combining the original features using mathematical operators. By leveraging GP, the system adapts to the evolving tactics employed by APTs, enhancing the identification of APT activities with greater accuracy and reliability. To assess the efficacy of the proposed method, comprehensive experiments were conducted on widely used and publicly accessible APT datasets. Using the combination of constructed and original features on the DAPT-2020 dataset, FEGP achieved a balanced accuracy of 79.28%, surpassing the best comparative methods by an average of 2.12% in detecting APT stages. Additionally, utilizing only constructed features on the Unraveled dataset, FEGP achieved a balanced accuracy of 83.14%, demonstrating a 3.73% improvement over the best comparative method. The findings presented in this paper underscore the importance of GP-based feature construction for APT detection, providing a pathway toward improved accuracy and efficiency in identifying APT activities. The comparative analysis of the proposed method against existing feature construction methods demonstrates FEGP’s effectiveness as a state-of-the-art method for multi-class APT classification. In addition to the performance evaluation, further analysis was conducted, encompassing feature importance analysis, and a detailed time analysis.

Framework for the detection and classification of malware using machine learning

Malware constitute a major threat to Network Infrastructure which are vulnerable to several devastating Malware attacks such as Virus and Ransomware. Traditional Antimalware software provides limited efficiency against Malware removal due to evolving evasion techniques capabilities of Malware such as polymorphism. Antimalware only removes Malware they have signatures for and are ineffective and helpless against zero day attack, several research works have made use of supervised and unsupervised learning algorithms to detect and classify Malware but False Positives prevails. This research made use of Machine Learning to detect and classify Malware by employing Machine Learning techniques including Feature Selection techniques as well as Grid Search hyperparameter optimization. Principal Component Analysis was combined with Chi Square to cure the curse of dimensionality. Support Vector Machine, K Nearest Neighbor and Decision Tree were used to train the model separately with two datasets. The research model was evaluated with Confusion Matrix, Precision, Recall and F1 Score. Accuracy of 99%,98.64% and 100% was achieved with K Nearest Neighbor, Decision Tree and Support Vector Machine respectively using CICMalmem dataset which has equal number of Malware and Benign files, K Nearest Neighbor achieved no False Positive. Accuracy of 97.7%,70% and 96% was achieved with K Nearest Neighbor, Decision Tree and Support Vector Machine respectively with Dataset_Malware.csv dataset, K Nearest Neighbor achieved False Positives of 38.The Model was trained separately with default hyperparameters of the chosen algorithms as well as the optimal hyperparameters obtained from Grid Search and it was discovered that optimizing hyperparameters and combining features obtained with Principal Component Analysis and Chi Square to train the Model using the dataset with equal number of Benign and Malicious files(CICMalmem dataset) yielded optimal performance with Support Vector Machine. Future works includes employing deep learning and ensemble learning as classifiers as well as implementing other hyperparameter optimization techniques.

Utilizing AspectJ for Defense Against Evasive Malware Attacks in Android System

Introduction: Mobile devices have become an integral part of our digital lives, facilitating various tasks and storing a treasure trove of sensitive information. However, as more people utilize mobile devices, sophisticated cyber threats are emerging to elude traditional security measures. Method: The use of evasion techniques by malicious actors presents a significant challenge to mobile security, necessitating creative solutions. In this work, we investigate the potential critical role that the aspect-oriented programming paradigm AspectJ can play in strengthening mobile security against evasion attempts. Evasion techniques cover a wide range of tactics, including runtime manipulation, code obfuscation, and unauthorized data access. Results: These tactics usually aim to bypass detection and avoid security measures. In order to address the aforementioned issues, this paper uses AspectJ to give developers a flexible and dynamic way to add aspects to their coding structures so they can monitor, intercept, and respond to evasive actions. It illustrates how AspectJ can improve mobile security and counteract the long-lasting risks that evasion techniques present in a dynamic threat landscape. Conclusion: Consequently, this work proposes a novel defense mechanism incorporating AspectJ into a significant paradigm of security against evasion with 91.33% accuracy and demonstrates the successful detection of evasive attacks.

MPSD: A Robust Defense Mechanism against Malicious PowerShell Scripts in Windows Systems

This manuscript introduces MPSD (Malicious PowerShell Script Detector), an advanced tool to protect Windows systems from malicious PowerShell commands and scripts commonly used in fileless malware attacks. These scripts are often hidden in Office document macros or downloaded remotely via PowerShell, posing significant threats to corporate networks. A 2018 report revealed that 77% of successful cyberattacks involved fileless malware, with PowerShell being the primary attack method, as highlighted in Red Canary’s 2022 report. To counter these threats, MPSD leverages the Antimalware Scan Interface (AMSI) to intercept and analyze real-time PowerShell scripts, preventing their execution. It further utilizes VirusTotal to filter out malicious scripts. Unlike traditional methods that rely on direct access to scripts, MPSD detects them before execution, addressing the challenge of hidden or obfuscated scripts. Experimental results show that MPSD outperforms well-known antivirus engines, with a low false-negative rate of 1.83%. MPSD is highly effective against evasion techniques like concatenation, encoding, and reordering, making it a robust tool in the cybersecurity landscape.

Deep Learning Applied to Imbalanced Malware Datasets Classification

In the current day, the evolution and exponential proliferation of malware involve modifications and camouflage of their structure through techniques like obfuscation, polymorphism, metamorphism, and encryption. With the advancements in deep learning, methods such as convolutional neural networks (CNN) have emerged as potent tools for deciphering intricate patterns within this malicious software. The present research uses the capacity of CNN to learn the global structure of the code converted to an RGB or grayscale image and decipher the patterns present in the malware datasets generated from these images. The study explores fine-tuning techniques, including bicubic interpolation, ReduceLROnPlateau, and class weight estimation, in order to generalize the model and reduce the risk of overfitting for malware that uses evasion techniques against classification. Taking advantage of transfer learning and the MobileNet architecture, we created a MobileNet fine-tuning (FT) model. The application of this new model in four datasets, including Microsoft Big 2015, Malimg, MaleVis, and a new Fusion dataset, achieved 98.71%, 99.08%, 96.04%, and 98.04% accuracy, respectively, which underscores the robustness of the proposed model. The Fusion dataset is a combination of the first three datasets, consisting of a set of 32,601 known malware image files representing a mix of 59 different families. Despite the success, the study reveals performance deterioration with an increase in the number of malware families, highlighting the need for further exploration into the limits of CNNs in malware classification.

Blockchain Security:"Botnets and Bitcoin Mining” - A Study on the Impacts and Countermeasures

Introduction: Botnets have become a significant threat to cybersecurity, as they can be used for a wide range of malicious activities, including Distributed Denial-of-Service (DDoS) attacks, spamming, and cryptocurrency mining. Bitcoin Mining, in particular, has become a lucrative target for cybercriminals, as it requires massive computing power and can generate significant profits. Method: In this paper, the author presents a study on a botnet that uses an HTA file to gain initial access and execute code on a victim's device, followed by the installation of mining software to infect the device and bitcoins. Result: The author analyzes the botnet's behaviour, including its evasion techniques and Bitcoin Mining activities, and discusses the implications of current findings for cybersecurity and Bitcoin Mining. Conclusion: Future research should also investigate the use of different command and control servers and other advanced attack frameworks in botnet operations and examine the potential connections between botnets and other cybercrime activities, such as ransomware and espionage.

PSC-BERT: A spam identification and classification algorithm via prompt learning and spell check

The rapid growth of the Internet has led to an increase in spam activities, posing significant security threats. Spammers use various tactics, such as intentional misspellings, to evade detection systems. Current spam detection mostly relies on semantic analysis, which is inadequate given these sophisticated evasion techniques. This paper addresses the problem by constructing a Chinese Camouflage Spam dataset (CCS) and proposing a novel detection and recognition model: Prompt and Spelling Checking-based BERT (PSC-BERT). BERT, a state-of-the-art language model, has been successful in many NLP tasks but faces limitations in handling misspelled text. PSC-BERT extends BERT by integrating semantic, phonetic, and glyph information from spam texts and employs a novel hard template prompt learning method that unifies text classification and spell-check tasks. In experiments, PSC-BERT outperformed baseline models, showing a 0.81% improvement over Semorph and a 2.01% improvement over LR in binary classification. For multi-class classification, it achieved a 0.95% increase in Macro-F1 and 0.49% in Weighed-F1 over the best baseline. Two sub-datasets from Chinese Camouflage Spam dataset were created for detection and recognition, and extensive analysis confirmed the model’s efficacy, especially in few-shot learning scenarios. Additionally, a case study illustrates the attention mechanism in BERT, providing deeper insights into token in the sequences. In summary, PSC-BERT demonstrates a significant advancement in spam detection capabilities against intentional misspellings problem.

Intrusion Detection System to Secure a Network using ACNN Model and Machine Learning

As cyber threats continue to evolve in sophistication and diversity, the need for robust Intrusion Detection Systems (IDS) becomes paramount to safeguarding network integrity. This research explores the application of an innovative approach by integrating an Attention-based Convolutional Neural Network (ACNN) model with machine learning techniques to enhance the accuracy and efficiency of intrusion detection. The proposed system leverages the ACNN's ability to capture contextual dependencies in network traffic data, enabling the extraction of intricate patterns indicative of potential intrusions. The ACNN's attention mechanism focuses on relevant features within the data, improving the model's discriminative power and adaptability to dynamic cyber threats. To achieve optimal performance, the ACNN is complemented with a machine learning framework that includes feature engineering, dimensionality reduction, and classification algorithms. This integrated approach allows the system to adapt and learn from evolving attack vectors, providing a proactive defense mechanism against both known and unknown threats. The research evaluates the proposed ACNN-based IDS using benchmark datasets and real-world network traffic scenarios. Comparative analysis against traditional IDS models showcases the superiority of the ACNN in terms of detection accuracy, false positive rates, and computational efficiency. Furthermore, the system's adaptability to emerging threats is demonstrated through continuous learning and retraining mechanisms. Results indicate that the ACNN-based IDS not only exhibits superior performance but also demonstrates resilience against evasion techniques employed by malicious actors. The research findings contribute to the advancement of network security by presenting a cuttingedge solution that combines deep learning and machine learning for effective and adaptive intrusion detection.

EVASION TECHNIQUES IN MALWARE DETECTION: CHALLENGES AND COUNTERMEASURES

In the ever-evolving digital landscape, the escalating sophistication of malware poses a substantial threat, necessitating continual advancements in detection methods. This paper addresses the pervasive challenge of evasion techniques employed by malware to circumvent standard security measures. Focused on understanding the intricate methods employed by malware developers, our study explores the dynamic nature of this cyber threat. As malicious actors continually refine their approaches, a nuanced understanding of evasion tactics becomes paramount for developing effective countermeasures. The research emphasizes the need for robust defense mechanisms capable of adapting to the constantly changing cyber threat landscape. By unraveling the complexities of evasion techniques, this paper contributes valuable insights to the development of proactive and resilient cybersecurity measures. Through an exploration of specific evasion tactics, we aim to inform and empower cybersecurity professionals, facilitating the creation of strategies capable of effectively mitigating the risks posed by these dynamic digital threats.

A practical approach for finding anti-debugging routines in the Arm-Linux using hardware tracing

As IoT devices are being widely used, malicious code is increasingly appearing in Linux environments. Sophisticated Linux malware employs various evasive techniques to deter analysis. The embedded trace microcell (ETM) supported by modern Arm CPUs is a suitable hardware tracer for analyzing evasive malware because it is almost artifact-free and has negligible overhead. In this paper, we present an efficient method to automatically find debugger-detection routines using the ETM hardware tracer. The proposed scheme reconstructs the execution flow of the compiled binary code from ETM trace data. In addition, it automatically identifies and patches the debugger-detection routine by comparing two traces (with and without the debugger). The proposed method was implemented using the Ghidra plug-in program, which is one of the most widely used disassemblers. To verify its effectiveness, 15 debugger-detection techniques were investigated in the Arm-Linux environment to determine whether they could be detected. We also confirmed that our implementation works successfully for the popular malicious Mirai malware in Linux. Experiments were further conducted on 423 malware samples collected from the Internet, demonstrating that our implementation works well for real malware samples.

Advanced Techniques of Malware Evasion and Bypass in the Age of Antivirus

The use of antivirus software as the main line of protection against growing cyber threats highlights the necessity of comprehending and resolving its limits. This study provides light on the ease of use and accessibility of tools used by hackers by carefully examining the complex terrain of malware evasion and bypass tactics. The persistent evolution of malware evasion and bypass techniques presents a significant cybersecurity challenge. The main objective is to educate users about the ever-changing hazards and provide them with the knowledge they need to properly strengthen their digital defenses. The literature analysis highlights the necessity for continued attention by establishing a strong correlation between the effectiveness of evasion strategies and their age and popularity. While modern antivirus software shows strong resistance against a range of tried-and-true techniques when updated on a regular basis, the study reveals a crucial component in its testing. This entails applying simple yet effective tweaks to well-known evasion techniques, demonstrating their capacity to fool even the most recent antivirus software. A thorough examination of malware evasion tactics, including both on-desk and in-memory approaches, is given in the methods section. Packing, obfuscators, protectors, reflective DLL injection, remote process memory injection, process hollowing, and inline hooking are all covered in detail in this paper. Subsequently, the study delves deeper into distinct evasion strategies, such defensive evasion through direct system calls and sophisticated evasion tactics, showcasing malware developers' versatility in evading antivirus and endpoint detection and response (EDR) systems.

An interpretable model for large-scale smart contract vulnerability detection

Smart contracts hold billions of dollars in digital currency, and their security vulnerabilities have drawn a lot of attention in recent years. Traditional methods for detecting smart contract vulnerabilities rely primarily on symbol execution, which makes them time-consuming with high false positive rates. Recently, deep learning approaches have alleviated these issues but still face several major limitations, such as lack of interpretability and susceptibility to evasion techniques. In this paper, we propose a feature selection method for uplifting modeling. The fundamental concept of this method is a feature selection algorithm, utilizing interpretation outcomes to select critical features, thereby reducing the scales of features. The learning process could be accelerated significantly because of the reduction of the feature size. The experiment shows that our proposed model performs well in six types of vulnerability detection. The accuracy of each type is higher than 93% and the average detection time of each smart contract is less than 1 ms. Notably, through our proposed feature selection algorithm, the training time of each type of vulnerability is reduced by nearly 80% compared with that of its original.

Anti-Phishing: A Web Identifier for Spoofed Sites Using Neural Network

Phishing attacks persist as a significant threat to cybersecurity, exploiting deceptive websites to illicitly acquire sensitive user information. Conventional anti-phishing techniques often struggle to keep pace with the evolving sophistication of these attacks. An approach for detecting phishing websites using Long Short-Term Memory (LSTM) networks, a type of recurrent neural network (RNN) known for its ability to capture sequential dependencies in data.Method leverages the temporal dynamics inherent in website content and user interactions to discern between legitimate and phishing websites and constructed a comprehensive data-set comprising diverse samples of legitimate and phishing websites, ensuring the model's ability to generalize across various attack vectors.LSTM-based model exhibits resilience to adversarial evasion techniques commonly employed by attackers, demonstrating robustness in real-world scenarios and conducted extensive analysis to interpret the learned representations captured by the LSTM network, providing insights into the distinguishing features of phishing websites. Key Words:Phishing, Deep Learning,

Cyber security Vulnerabilities and Remediation Through Cloud Security Tools

The proliferation of internet usage has surged dramatically, prompting individuals and businesses to conduct myriad transactions online rather than in physical spaces. The onset of the COVID-19 pandemic has further propelled this trend. Consequently, traditional forms of crime have migrated to the digital realm alongside the widespread adoption of digital technologies such as cloud computing, the Internet of Things (IoT), social media, wireless communication, and crypto currencies, amplifying security concerns in cyberspace. Notably, cybercriminals have begun offering cyber attacks as a service, automating attacks to magnify their impact. These attackers exploit vulnerabilities across hardware, software, and communication layers, perpetrating various forms of cyber attacks including distributed denial of service (DDoS), phishing, man-in-the-middle, password, remote, privilege escalation, and malware attacks. The sophistication of these attacks renders conventional protection systems, such as firewalls, intrusion detection systems, antivirus software, and access control lists, ineffective in detection. Consequently, there is an urgent imperative to devise innovative and pragmatic solutions to thwart cyber attacks. This paper elucidates the primary drivers behind cyber attacks, surveys recent attack instances, patterns, and detection methodologies, and explores contemporary technical and non-technical strategies for preemptively identifying and mitigating attacks. Leveraging cutting-edge technologies like machine learning, deep learning, cloud platforms, big data analytics, and blockchain holds promise in combating present and future cyber threats. These technological interventions can aid in malware detection, intrusion detection, spam filtering, DNS attack classification, fraud detection, identification of covert channels, and discernment of advanced persistent threats. Nonetheless, it's crucial to acknowledge that some promising solutions, notably machine learning and deep learning, are susceptible to evasion techniques, necessitating careful consideration when formulating defenses against sophisticated cyber attacks.

Cyber security Vulnerabilities and Remediation Through Cloud Security Tools

The proliferation of internet usage has surged dramatically, prompting individuals and businesses to conduct myriad transactions online rather than in physical spaces. The onset of the COVID-19 pandemic has further propelled this trend. Consequently, traditional forms of crime have migrated to the digital realm alongside the widespread adoption of digital technologies such as cloud computing, the Internet of Things (IoT), social media, wireless communication, and crypto currencies, amplifying security concerns in cyberspace. Notably, cybercriminals have begun offering cyber attacks as a service, automating attacks to magnify their impact. These attackers exploit vulnerabilities across hardware, software, and communication layers, perpetrating various forms of cyber attacks including distributed denial of service (DDoS), phishing, man-in-the-middle, password, remote, privilege escalation, and malware attacks. The sophistication of these attacks renders conventional protection systems, such as firewalls, intrusion detection systems, antivirus software, and access control lists, ineffective in detection. Consequently, there is an urgent imperative to devise innovative and pragmatic solutions to thwart cyber attacks. This paper elucidates the primary drivers behind cyber attacks, surveys recent attack instances, patterns, and detection methodologies, and explores contemporary technical and non-technical strategies for preemptively identifying and mitigating attacks. Leveraging cutting-edge technologies like machine learning, deep learning, cloud platforms, big data analytics, and blockchain holds promise in combating present and future cyber threats. These technological interventions can aid in malware detection, intrusion detection, spam filtering, DNS attack classification, fraud detection, identification of covert channels, and discernment of advanced persistent threats. Nonetheless, it's crucial to acknowledge that some promising solutions, notably machine learning and deep learning, are susceptible to evasion techniques, necessitating careful consideration when formulating defenses against sophisticated cyber attacks.

Cyber security Vulnerabilities and Remediation Through Cloud Security Tools

The proliferation of internet usage has surged dramatically, prompting individuals and businesses to conduct myriad transactions online rather than in physical spaces. The onset of the COVID-19 pandemic has further propelled this trend. Consequently, traditional forms of crime have migrated to the digital realm alongside the widespread adoption of digital technologies such as cloud computing, the Internet of Things (IoT), social media, wireless communication, and crypto currencies, amplifying security concerns in cyberspace. Notably, cybercriminals have begun offering cyber attacks as a service, automating attacks to magnify their impact. These attackers exploit vulnerabilities across hardware, software, and communication layers, perpetrating various forms of cyber attacks including distributed denial of service (DDoS), phishing, man-in-the-middle, password, remote, privilege escalation, and malware attacks. The sophistication of these attacks renders conventional protection systems, such as firewalls, intrusion detection systems, antivirus software, and access control lists, ineffective in detection. Consequently, there is an urgent imperative to devise innovative and pragmatic solutions to thwart cyber attacks. This paper elucidates the primary drivers behind cyber attacks, surveys recent attack instances, patterns, and detection methodologies, and explores contemporary technical and non-technical strategies for preemptively identifying and mitigating attacks. Leveraging cutting-edge technologies like machine learning, deep learning, cloud platforms, big data analytics, and blockchain holds promise in combating present and future cyber threats. These technological interventions can aid in malware detection, intrusion detection, spam filtering, DNS attack classification, fraud detection, identification of covert channels, and discernment of advanced persistent threats. Nonetheless, it's crucial to acknowledge that some promising solutions, notably machine learning and deep learning, are susceptible to evasion techniques, necessitating careful consideration when formulating defenses against sophisticated cyber attacks.

Ransomware Detection Using Portable Executable Imports

In recent years, there has been a substantial surge in ransomware attacks, wreaking havoc on both organizations and individuals. These attacks, driven by the lure of profits, particularly with the widespread use of cryptocurrencies, have prompted attackers to continuously develop innovative evasion techniques and obfuscation tactics to avoid detection. Ransomware, employing seemingly benign functions such as encryption and file-locking, poses a formidable challenge for detection as it evolves beyond traditional signature-based methods. Consequently, there is a growing need to identify previously unexplored and unstudied ransomware strains, necessitating the deployment of artificial intelligence (AI) to discern the unique characteristics and objectives of ransomware. The adoption of AI hinges on the prior selection of distinguishing features. Given that ransomware's intent fundamentally differs from that of benign files, there are variations in the structure of Portable Executables (PE) files. This study posits that the imports used by PE files can serve as a discriminating factor between ransomware and benign files. This research explored using machine learning models to detect ransomware by analysing and deriving insights from the PE Imports structure. To achieve this, the study trains seven machine learning classifiers, namely Random Forest, Logistic Regression, Naïve Bayes, Support Vector Machine, K-Nearest Neighbors, Gradient Boost, and Decision Tree. These models are trained on a dataset of carefully selected features derived from PE imports. The classifiers are benchmarked and ranked based on several evaluation metrics, including latency, accuracy, and confidence levels. For a model to be effective in ransomware detection, it should offer near real-time and highly confident accuracy. In other words, it should exhibit low latency, high accuracy, and strong AUC rates. Among the models, Logistic Regression emerges as the top performer, identifying ransomware programs with an impressive 98.5% accuracy and a confidence level of 98.6% within a mere 0.998-millisecond latency. This study conclusively affirms the efficacy of employing PE imports for ransomware detection.

MAlign: Explainable static raw-byte based malware family classification using sequence alignment

For a long time, malware classification and analysis have been an arms-race between antivirus systems and malware authors. Though static analysis is vulnerable to evasion techniques, it is still popular as the first line of defense in antivirus systems. But most of the static analyzers failed to gain the trust of practitioners due to their black-box nature. We propose MAlign, a novel static malware family classification approach inspired by genome sequence alignment that can not only classify malware families but can also provide explanations for its decision. MAlign encodes raw bytes using nucleotides and adopts genome sequence alignment approaches to create a signature of a malware family based on the conserved code segments in that family, without any human labor or expertise. We evaluate MAlign on two malware datasets, and it outperforms other state-of-the-art machine learning-based malware classifiers (by 4.49%∼0.07%), especially on small datasets (by 19.48%∼1.2%). Furthermore, we explain the generated signatures by MAlign on different malware families illustrating the kinds of insights it can provide to analysts, and show its efficacy as an analysis tool. Additionally, we evaluate its theoretical and empirical robustness against some common attacks. In this paper, we approach static malware analysis from a unique perspective, aiming to strike a delicate balance among performance, interpretability, and robustness.

A watchdog model for physics-based anomaly detection in digital substations

The security of cyber–physical systems (CPS) presents new challenges stemming from computations that work primarily with live physics data. Although there is a body of previous research on detection of malware on CPS, more effective designs are needed to address limitations such mimicry attacks and other forms of evasive techniques. Relay algorithms in particular, such as differential and harmonic protection algorithms, are essential to protecting physical equipment such as power transformers from faults. Relay algorithms, though, are often disabled, altered, or otherwise suppressed by malware.In this paper, we first provide background on the main types of failures that may occur in an electrical power substation after relay algorithms are disabled by malware. We also provide some initial insights into malware methods that involve physics-informed data manipulations, which in turn may lead to power outages and physical damage to power transformers. We then describe the design of a watchdog algorithm that is continuously on the look out for anomalies in the execution time of relay algorithms along with their associated performance counters. We implemented the watchdog approach in Python, and evaluated it empirically on emulations of differential and harmonic protection algorithms on a computing machine.