Executable Files Research Articles

A molecular evolution algorithm for ligand design in DOCK.

As a complement to virtual screening, de novo design of small molecules is an alternative approach for identifying potential drug candidates. Here, we present a new 3D genetic algorithm to evolve molecules through breeding, mutation, fitness pressure, and selection. The method, termed DOCK_GA, builds upon and leverages powerful sampling, scoring, and searching routines previously implemented into DOCK6. Three primary experiments were used during development: Single-molecule evolution evaluated three selection methods (elitism, tournament, and roulette), in four clinically relevant systems, in terms of mutation type and crossover success, chemical properties, ensemble diversity, and fitness convergence, among others. Large scale benchmarking assessed performance across 651 different protein-ligand systems. Ensemble-based evolution demonstrated using multiple inhibitors simultaneously to seed growth in a SARS-CoV-2 target. Key takeaways include: (1) The algorithm is robust as demonstrated by the successful evolution of molecules across a large diverse dataset. (2) Users have flexibility with regards to parent input, selection method, fitness function, and molecular descriptors. (3) The program is straightforward to run and only requires a single executable and input file at run-time. (4) The elitism selection method yields more tightly clustered molecules in terms of 2D/3D similarity, with more favorable fitness, followed by tournament and roulette.

FPocketWeb: protein pocket hunting in a web browser

Detecting macromolecular (e.g., protein) cavities where small molecules bind is an early step in computer-aided drug discovery. Multiple pocket-detection algorithms have been developed over the past several decades. Among them, fpocket, created by Schmidtke and Le Guilloux, is particularly popular. Like many programs used in computational-biology research, fpocket requires users to download and install an executable file. That file must also be run via a command-line interface, further complicating use. An existing fpocket server application effectively addresses these challenges, but it requires users to upload their possibly proprietary structures to a third-party server. The FPocketWeb web app builds on this prior work. It runs the fpocket3 executable entirely in a web browser without requiring installation. The pocket-finding calculations occur on the user’s computer rather than on a remote server. A working version of the open-source FPocketWeb app can be accessed free of charge from http://durrantlab.com/fpocketweb.

Deceiving AI-based malware detection through polymorphic attacks

Malware detection is one of the most important tasks in cybersecurity. Recently, increasing interest in Convolutional Neural Networks (CNN) and Machine Learning algorithms, which are widely used in image analysis and predictive modelling, led to their use in static malware classification and to the application of these powerful tools in computer industry and industrial internet of things. Many studies claim that the static malware detection approach, under well-defined conditions, can deliver fast and accurate malware classification results with relatively little human effort once the framework is implemented, relying solely on the binary content of the file. This becomes evident if we compare static malware detection to other techniques of dynamic nature. The focus of our research is to highlight strengths and weaknesses of CNNs used for static malware detection, starting from images obtained from byte-wise conversion of binary executable files to pixel images to critically analyze the assumptions underlying the performance of this type of technique.

ImputAccur: fast and user-friendly calculation of genotype-imputation accuracy-measures

BackgroundImputAccur is a software tool to measure genotype-imputation accuracy. Imputation of untyped markers is a standard approach in genome-wide association studies to close the gap between directly genotyped and other known DNA variants. However, high accuracy for imputed genotypes is fundamental. Several accuracy measures have been proposed, but unfortunately, they are implemented on different platforms, which is impractical.ResultsWith ImputAccur, the accuracy measures info, Iam-hiQ and r2-based indices can be derived from standard output files of imputation software. Sample/probe and marker filtering is possible. This allows e.g. accurate marker filtering ahead of data analysis.ConclusionsThe source code (Python version 3.9.4), a standalone executive file, and example data for ImputAccur are freely available at https://gitlab.gwdg.de/kolja.thormann1/imputationquality.git.

PE Parser: A Python package for Portable Executable files processing

<h2>Abstract</h2> <i>PE Parser</i> is a Python package to parse and work with the hexadecimal representation of executables' binary content and its assembly language source code. <i>PE Parser</i> has been designed to provide a class-based and user-friendly interface for the extraction of well-known features commonly used for the task of malware detection and classification such as byte and opcode N-Grams, API function calls, the frequency of use of the registers, characteristics of the Portable Executable file sections, among others. In addition, <i>PE Parser</i> has various command line tools to visualize the executables as grayscale images or as a stream of entropy values.

Disassemble Byte Sequence Using Graph Attention Network

Disassembly is the basis of static analysis of binary code and is used in malicious code detection, vulnerability mining, software optimization, etc. Disassembly of arbitrary suspicious code blocks (e.g., for suspicious traffic packets intercepted by the network) is a difficult task. Traditional disassembly methods require manual specification of the starting address and cannot automate the disassembly of arbitrary code blocks. In this paper, we propose a disassembly method based on code extension selection network by combining traditional linear sweep and recursive traversal methods. First, each byte of a code block is used as the disassembly start address, and all disassembly results (control flow graphs) are combined into a single flow graph. Then a graph attention network is trained to pick the correct subgraph (control flow graph) as the final result. In the experiment, the compiler-generated executable file, as well as the executable file generated by hand-written assembly code, the data file and the byte sequence intercepted by the code segment were tested, and the disassembly accuracy was 93%, which can effectively distinguish the code from the data.

A novel intelligent cognitive computing-based APT malware detection for Endpoint systems

Detecting and warning Advanced Persistent Threat (APT) malware in Endpoint is essential because the current trend of APT attacker groups is to find ways to spread malware to users and then escalate privileges in the system. In this study, to improve the ability to detect APT malware on Endpoint machines, we propose a novel intelligent cognitive calculation method based on a model combining graph embeddings and Attention using processes generated by executable files. The proposed intelligent cognitive computation method performs 3 main tasks: i) extracting behaviors of processes; ii) aggregating the malware behaviors based on the processes; iii) detecting APT malware based on behavior analysis. To carry out the task (i), we propose to use several data mining techniques: extracting processes from Event IDs in the operating system kernel; extracting abnormal behaviors of processes. For task (ii), a graph embedding (GE) model based on the Graph Convolutional Networks (GCN) network is proposed to be used. For task (iii), based on the results of task (ii), the paper proposes to use a combination of the Convolutional Neural Network (CNN) network and Attention network (called CNN-Attention). The novelty and originality of this study is an intelligent cognitive computation method based on the use, combination, and synchronization of many different data mining techniques to compute, extract, and represent relationships and correlations among APT malware behaviors from processes. Based on this new intelligent cognitive computation method, many meaningful anomalous features and behaviors of APT malware have been synthesized and extracted. The proposals related to data mining methods to extract malware’s features and the list of malware’s behaviors provided in this paper are new information that has not been published in previous studies. In the experimental section, to demonstrate the effectiveness of the proposed method in detecting APT malware, the study has compared and evaluated it with other approaches. Experimental results in the paper have shown the outstanding efficiency of the proposed method when ensuring all metrics from 96.6% or more (that are 2% to 6% higher than other approaches). Experimental results in the paper have proven that our proposed method not only has scientifically significant but also has practical meaning because the method has helped to improve the efficiency of analyzing and detecting APT malware on Endpoint devices. In addition, this research result also has opened up a new approach for the task of detecting other anomalies on the Endpoint such as malware, unauthorized intrusion, insider, etc.

Explainable Artificial Intelligence-Based IoT Device Malware Detection Mechanism Using Image Visualization and Fine-Tuned CNN-Based Transfer Learning Model.

Automated malware detection is a prominent issue in the world of network security because of the rising number and complexity of malware threats. It is time-consuming and resource intensive to manually analyze all malware files in an application using traditional malware detection methods. Polymorphism and code obfuscation were created by malware authors to bypass the standard signature-based detection methods used by antivirus vendors. Malware detection using deep learning (DL) approaches has recently been implemented in an effort to address this problem. This study compares the detection of IoT device malware using three current state-of-the-art CNN models that have been pretrained. Large-scale learning performance using GNB, SVM, DT, LR, K-NN, and ensemble classifiers with CNN models is also included in the results. In light of the findings, a pretrained Inception-v3 CNN-based transfer learned model with fine-tuned strategy is proposed to identify IoT device malware by utilizing color image malware display of android Dalvik Executable File (DEX). Inception-v3 retrieves the malware's most important features. After that, a global max-pooling layer is applied, and a SoftMax classifier is used to classify the features. Finally, gradient-weighted class activation mapping (Grad-CAM) along the t-distributed stochastic neighbor embedding (t-SNE) is used to understand the overall performance of the proposed method. The proposed method achieved an accuracy of 98.5% and 91%, respectively, in the binary and multiclass prediction of malware images from IoT devices, exceeding the comparison methods in different evaluation parameters.

Android Malware Detection Method Based on Permission Complement and API Calls

The dynamic code loading mechanism of the Android system allows an application to load executable files externally at runtime. This mechanism makes the development of applications more convenient, but it also brings security issues. Applications that hide malicious behavior in the external file by dynamic code loading are becoming a new challenge for Android malware detection. To overcome this challenge, based on dynamic code loading mechanisms, three types of threat models, i.e. Model I, Model II, and Model III are defined. For the Model I type malware, its malicious behavior occurs in DexCode, so the application programming interface (API) classes were used to characterize the behavior of the DexCode file. For the Model II type and Model III type malwares whose malicious behaviors occur in an external file, the permission complement is defined to characterize the behaviors of the external file. Based on permission complement and API calls, an Android malicious application detection method is proposed, of which feature sets are constructed by improving a feature selection method. Five datasets containing 15,581 samples are used to evaluate the performance of the proposed method. The experimental results show that our detection method achieves accuracy of 99.885% on general dataset, and performes the best on all evaluation metrics on all datasets in all comparison methods.

LabMIMO: An Open-source Virtual Laboratory for Process Control

Abstract: The “LabMIMO” is an open-source, interactive, and user-friendly virtual learning workbench. This workbench is designed for nonlinear process control edification. This virtual laboratory offers the platform to comprehend and validate the essentials of a control system for the nonlinear coupled MIMO process. This paper presents the development details and impact of virtual labs on an engineering study. The process considered in the tool is unique and innovative Quadruple Conical Tank System (QCTS). The said system is developed and the mathematical model used in the tool is validated with actual physical laboratory setup. The LabMIMO consists the eight different experiments on open-loop and closed-loop system analysis for single-input single-output system and multi-input multi-output configurations of QCTS. It also covers the study on interaction and coupling effects for the nonlinear process. Diverse experimentations were intended to improve the knowledge on design and performance analyses of different classical and model-based control algorithms like MPC (Model Predictive Controller), Fuzzy Logic Controller (FLC), PID Controller. To ease E-learning, LabVIEW based a very accessible Graphical User Interface (GUI) developed. To address the very important requirement of virtual laboratory setup, the tool is made freelydownloadable in a license-free executable file version. Keywords : Virtual laboratory, MIMO Process Control, Nonlinear control, PID controller

LockBit 2.0 Ransomware: Analysis of infection, persistence, prevention mechanism

This research was carried out due to the prevalence of ransomware attacks, especially in Indonesia against data located at Endpoints, in early 2022 ransomware was enough to horrify the news in cyberspace and one of the ransomware that is quite worrying in Indonesia is LockBit 2.0 ransomware, so research is needed against the ransomware. The method used to research the ransomware is static analysis and dynamic analysis which will show the infection and persistence of the LockBit 2.0 ransomware, the static analysis method is used by reverse engineering the portable executable (PE) file and the dynamic analysis method is carried out by running the ransomware. then look at the operating activities, the resources used, and including the network activities carried out by the ransomware and its impact on the affected operating system, so that a scenario for prevention methods can be made, where in this study we can see the real impact of the attacks carried out by the LockBit 2.0 ransomware which is also part of ransomware-as-a-services (Raas), as well as 5 steps that can be taken to avoid it and can make anyone aware with ransomware attacks that’s why create artificial intelligence that accommodates such vigilance is important.Keywords—Ransomware, LockBit 2.0, Infection, Persistence, Prevention

Detecting Malware in Portable Executable Files using Machine Learning Approach

There have been many solutions proposed to increase the ability to detection of malware in executable files in general and in Portable Executable files in particular. In this paper, we rely on the PE header structure of Portable Executablefiles to propose another approach in using Machine learning to classify these files, as malware files or benign files. Experimental results show that the proposed approach still uses the Random Forest algorithm for the classification problem but the accuracy and execution time are improved compared to some recent publications (accuracy reaches 99.71%).

Deep learning based cross architecture internet of things malware detection and classification

The number of publicly exposed Internet of Things (IoT) devices has been increasing, as more number of these devices connected to the internet with default settings. The devices accessed with default credentials are getting compromised with brute force attempts or the vulnerable devices are compromised with exploits to install the malware and perform malicious activity like initiating denial of service (DoS) attacks. The malware detection and classification in IoT paradigm is still considered a problem, as the adversary consistently create new variants of IoT malware and actively look for compromising the victim devices. In this paper, we proposed a Deep Learning (DL) based Bidirectional-Gated Recurrent Unit-Convolutional Neural Network (Bi-GRU-CNN) model to detect the IoT malware and classify the IoT malware families using Executable and Linkable Format (ELF, formerly named Extensible Linking Format) binary file byte sequences as an input feature. In addition, Recurrent Neural Network (RNN) based DL model combinations are considered to evaluate the performances of the IoT malware detection and family classification and also those models performance is compared with the proposed method. Our performance evaluation shows that our proposed approach obtained 100% accuracy for IoT malware detection case and 98% for IoT malware family classification. Further evaluation of our proposed model with only byte sequence as an input feature exhibit similar performance as the byte sequence and CPU types as an input features and showed that our model is robust and platform independent to detect and classify the IoT malware.

Python app for drawing Bode diagram asymptotes of transfer function for minimum and non‐minimal phase systems

AbstractThe purpose of this article is to introduce an app to draw the asymptotes of Bode diagram module and phase from each constituent elementary factors of any transfer function for minimum and non‐minimal phase systems without transport delay. The Bode diagram is the most used tool in the frequency response method. Python and several Python modules were used to program the app to perform the operations as well as the Qt5 design was used to create a simple graphical user interface for the app and all this in the Linux operating system and the app's source code can also be run in Windows operating system with no adjustments or modifications. The app purpose is to assist students in learning the frequency response concepts and drawing of Bode diagram using asymptotes of magnitude and phase. For students the non‐minimum phase system Bode diagram is more difficult to draw than a minimum phase system due to the presence of zeros and/or poles on right half side of ‐plane. This application should be used by students as a help and not simply to solve problems and for teachers the application can be used to improve their classes by showing the step by step of drawing the Bode diagram with the figures obtained by the application. The app's executable file is available on release link inhttps://github.com/Magno‐Meza‐UFABC/Magno‐Meza‐UFABC/releases/tag/v.1.0

Multiple elastic scattering of electrons in condensed matter (new version announcement)

Multiple elastic scattering of electrons in condensed matter (new version announcement)

Researchers’ Cyber First-Aid

The role of research in national development cannot be over-emphasized. Research is the act of proffering solution(s) for present and future problems through knowledge contribution, seeking, and organization. The ability for one to find old or new knowledge or generate new ones, as well as follow a set of knowledge organization rules towards answering the research question(s) makes him/her, a researcher. The process and set of activities followed by the researcher have in recent times, involve knowledge exchange, collaboration, and blending, mostly through digital media, with the cloud as the main storage and linked via several, wired, wireless, hardware, and software interfaces. The described system is prone to cyber-attack and must be protected, as most research is funded by interested bodies and their outcomes are highly evident in national development. This work christened “Cyber First-Aid” is geared toward creating situational awareness of the need for researchers to protect their finished or ongoing intellectual property from hackers. The methods proposed are not best practices in the cyber security domain but easily applicable checks and solutions with Graphical User Interface applications that any researcher with minimal computer knowledge can implement in order to increase cyber hygiene and minimize intellectual property loss. Applying cyber hygiene best practices, monitoring, analysis, and scanning of data packets with protocol analyzers, packet capturers, hash key generator, and Virus Total malware search engine, scanning e-mail, downloaded files, URLs, and executable files before opening or installing, clearing browsing cache, and blocking URLs discovered to have malicious content, are tools (procedures) that make up cyber first-aid. The result of implementing these tools proved effective in the detection, prevention, and removal of attack vectors and protection of researchers’ intellectual property.

EvadeRL: Evading PDF Malware Classifiers with Deep Reinforcement Learning

With the growing popularity of information digitization and the advancement of executable file detection technology, PDF has emerged as an important carrier of malicious documents. Despite the improved efficacy of machine learning-based classifiers in detecting PDF malware, adversaries have proposed a variety of countermeasures to evade detection, such as generating adversarial examples. In contrast to other peer works attempting to expose the vulnerability of learning-based detection models, this work addresses the deficiencies of existing research by pointing out that the stochastic manipulations they applied may be highly computationally demanding. This work proposed EvadeRL, a general framework for automatically generating adversarial examples based on double deep Q-Network. The details of EvadeRL are briefly described as follows. First, the EvadeRL agent chooses a series of actions to modify the given PDF files and uses the classification results, as well as observations returning from the environment, to calculate the approximate value of each action. Second, through the interaction of the agent and the environment, the experiences gained are stored to train the decision network. Finally, the agent can generate adversarial examples against the target detector by taking the optimal behaviors after training. This study also contributes to the sustainability of evasion attacks by online fine-tuning; to the best of our current knowledge, this is the first study in the field that focuses on evolving malware. The experiments reveal that EvadeRL obtains a high evasion rate against PDF malware detectors and outperforms other approaches in terms of execution cost, robustness against hardened detectors, and sustainability against evolving malware and detectors.

SimPlot++: a Python application for representing sequence similarity and detecting recombination.

Accurate detection of sequence similarity and homologous recombination are essential parts of many evolutionary analyses. We have developed SimPlot++, an open-source multiplatform application implemented in Python, which can be used to produce publication quality sequence similarity plots using 63 nucleotide and 20 amino acid distance models, to detect intergenic and intragenic recombination events using Φ, Max-χ2, NSS or proportion tests, and to generate and analyze interactive sequence similarity networks. SimPlot++ supports multicore data processing and provides useful distance calculability diagnostics. SimPlot++ is freely available on GitHub at: https://github.com/Stephane-S/Simplot_PlusPlus, as both an executable file (for Windows) and Python scripts (for Windows/Linux/MacOS).

MalSPM: Metamorphic malware behavior analysis and classification using sequential pattern mining

Malware pose a serious threat to the computers of individuals, enterprises and other organizations. In the Windows operating system (OS), Application Programming Interface (API) calls are an attractive and distinguishable feature for malware analysis and detection as they can properly reflect the actions of portable executable (PE) files. In this paper, we propose MalSPM, an intelligent malware detection system based on sequential pattern mining (SPM) for the analysis and classification of malware behavior during executions. A dataset that contains sequences of API calls made by different malware on Windows OS is abstracted into a suitable format. SPM algorithms are first used on the corpus to find frequent API calls and their patterns. Moreover, sequential rules between API calls patterns as well as maximal and closed frequent API calls patterns are discovered. Obtained frequent patterns are then used for the classification of different malware. Seven classifiers are used and their performance is compared by using various metrics. Moreover, the performance of MalSPM is compared with existing state-of-the-art malware detection approaches and obtained results show that MalSPM outperforms these approaches.

Analyse Cyberattack at Organizations using Logistic Regression Algorithm

Abstract: Ransomware cyberattacks have grown in severity, effectiveness to cause damage, and ease of execution during the last decade. Advanced ransomware detection technologies must be included with traditional anti-malware procedures. The results of a study and analysis of ransomware attack risk are presented in this work, with the goal of identifying the characteristics that separate ransomware from other malware and benign executable files with the help of detected logs. The ransomware's normal behaviour and structure are determined by statically and dynamically analysing the executable binaries. Ransomware-specific features are extracted from executable files using dynamic and static analysis techniques. This study shows that graph representation of attacks with a collection of datasets for malware detection improves when using machine learning techniques. Keywords: Ransomware, Malware Detection, Static Analysis, Dynamic Analysis, Anti-malware, Machine learning etc.