Malicious Content Research Articles

Web of shadows: Investigating malware abuse of internet services

Internet Web and cloud services are routinely abused by malware, but the breadth of this abuse has not been thoroughly investigated. In this work, we quantitatively investigate this abuse by leveraging data from the Cyber Threat Alliance (CTA), where 36 security vendors share threat intelligence. We analyze CTA data collected over 4 years from January 2020 until December 2023 comprising over one billion cyber-security observations from where we extract 7.7M URLs and 1.8M domains related to malware. We complement this dataset with an active measurement where we periodically attempt to download the content pointed out by 33,876 recently reported malicious URLs. We investigate the following questions. How generalized is malware abuse of Internet services? How do domains of abused Internet services differ? For what purpose are Internet services abused? and How long do malicious resources remain active? Among others, we uncover a broad abuse affecting 22K domains of Internet services, that Internet services are largely abused for enabling malware distribution, and that malicious content in Internet services remains active longer than on malicious domains.

Mitigating adversarial manipulation in LLMs: a prompt-based approach to counter Jailbreak attacks (Prompt-G)

Large language models (LLMs) have become transformative tools in areas like text generation, natural language processing, and conversational AI. However, their widespread use introduces security risks, such as jailbreak attacks, which exploit LLM’s vulnerabilities to manipulate outputs or extract sensitive information. Malicious actors can use LLMs to spread misinformation, manipulate public opinion, and promote harmful ideologies, raising ethical concerns. Balancing safety and accuracy require carefully weighing potential risks against benefits. Prompt Guarding (Prompt-G) addresses these challenges by using vector databases and embedding techniques to assess the credibility of generated text, enabling real-time detection and filtering of malicious content. We collected and analyzed a dataset of Self Reminder attacks to identify and mitigate jailbreak attacks, ensuring that the LLM generates safe and accurate responses. In various attack scenarios, Prompt-G significantly reduced jailbreak success rates and effectively identified prompts that caused confusion or distraction in the LLM. Integrating our model with Llama 2 13B chat reduced the attack success rate (ASR) to 2.08%. The source code is available at: https://doi.org/10.5281/zenodo.13501821.

Improve the effectiveness of machine learning models in detecting website phishing using morphological features in URL analysis

With the proliferation of the Internet, the emergence of various threats has become increasingly prevalent, particularly the danger posed by phishing websites. These websites are designed with malicious content aimed at exploiting users who inadvertently access them. This method of attack represents a significant potential risk for users in cyberspace. The problem of detecting and eliminating phishing websites has garnered significant interest and research within the community. In this study, we propose a set of morphological features in URL path analysis, combined with machine learning methods, to detect phishing website URLs. Experimental evaluation with the UCI Repository dataset results have demonstrated the effectiveness of the proposed feature set in terms of all metrics (Accuracy, Precision, Recall, and F1 Score) compared to previous methods.

A critical realist approach to agent-based modeling: Unlocking prediction in non-positivist paradigms

Information systems (IS) scholarship and practice aim to predict phenomena and outcomes of IS use. These phenomena of IS use are typically set in multi-leveled, dynamic, and complex contexts that lend explanation to the non-positivist tradition in IS research. However, limited methodological options exist to make predictions. In this research, we propose stratified agent-based modeling, a step-by-step approach that enables prediction in non-positivist paradigms. Drawing upon the critical realist philosophy of science, which suggests ontological stratification and assumes open systems, we adopt a retroduction-based explanation formation and agent-based modeling to simulate different potential states of a complex system. The critical step in combining critical realism with agent-based modeling involves identifying and codifying the underlying generative mechanisms (i.e., causal powers) into various components of the agent-based model. We propose four steps toward prediction under the critical realist paradigm: (1) capturing the phenomenon, (2) identifying the generative mechanism, (3) building the agent-based model, and (4) simulating states of the system. We present an exemplar of our proposed approach that investigates the effectiveness of strategies to combat malicious content propagation in social networks.

Deepfake detection using convolutional vision transformers and convolutional neural networks

Deepfake technology has rapidly advanced in recent years, creating highly realistic fake videos that can be difficult to distinguish from real ones. The rise of social media platforms and online forums has exacerbated the challenges of detecting misinformation and malicious content. This study leverages many papers on artificial intelligence techniques to address deepfake detection. This research proposes a deep learning (DL)-based method for detecting deepfakes. The system comprises three components: preprocessing, detection, and prediction. Preprocessing includes frame extraction, face detection, alignment, and feature cropping. Convolutional neural networks (CNNs) are employed in the eye and nose feature detection phase. A CNN combined with a vision transformer is also used for face detection. The prediction component employs a majority voting approach, merging results from the three models applied to different features, leading to three individual predictions. The model is trained on various face images using FaceForensics++ and DFDC datasets. Multiple performance metrics, including accuracy, precision, F1, and recall, are used to assess the proposed model’s performance. The experimental results indicate the potential and strengths of the proposed CNN that achieved enhanced performance with an accuracy of 97%, while the CViT-based model achieved 85% using the FaceForences++ dataset and demonstrated significant improvements in deepfake detection compared to recent studies, affirming the potential of the suggested framework for detecting deepfakes on social media. This study contributes to a broader understanding of CNN-based DL methods for deepfake detection.

Enhancing Security and Privacy in Large Language Model-based Approaches: A Comprehensive Investigation

During the last five years, there have been significant developments in the field of Natural Language Processing including the deployment of advanced large language models such as ChatGPT, Bard and Llama. These large language models are helpful in generating text and designing content and they have several applications in various industries. However, they can memorize and reveal malicious content and personal information from their training dataset which also includes an enormous amount of data from the internet. As a result, it can lead to compromised privacy and security challenges for users who have their personal information available on the internet directly or through third parties. To address this issue, the proposed research work conducts a thorough investigation of these challenges and puts forward a prompt designing-based solution. In this method, we build a customized training dataset to fine-tune a pre-trained model (Llama-2) to produce a harmless response ‘I can’t provide you with this information’ to prompts seeking to extract personal information and malicious content from LLMs. Experimental results reveal that the proposed work achieves an accuracy of 63% with a precision score of 0.706 and a recall score of 0.571. The work ensures almost no leakage of private information and strengthens the LLM model against extraction attacks.

Misuse of large language models: Exploiting weaknesses for target-specific outputs

Prompt engineering in large language models (LLMs) in combination with external context can be misused for jailbreaks in order to generate malicious outputs. In the process, jailbreak prompts are apparently amplified in such a way that LLMs can generate malicious outputs on a large scale despite their initial training. As social bots, these can contribute to the dissemination of misinformation, hate speech, and discriminatory content. Using GPT4-x-Vicuna-13b-4bit from NousResearch, we demonstrate in this article the effectiveness of jailbreak prompts and external contexts via Jupyter Notebook based on the Python programming language. In addition, we highlight the methodological foundations of prompt engineering and its potential to create malicious content in order to sensitize researchers, practitioners, and policymakers to the importance of responsible development and deployment of LLMs.

DETECTION OF UNHEALTHY WEBSITES USING MACHINE LEARNING

In recent years, advancements in Internet and cloud technologies have led to a signicant increase in electronic trading in which consumers make online purchases and transactions. Accompanying this achievement are vices like unauthorized access to users' sensitive information and damages to enterprise resources. Phishing is one of the familiar attacks that trick users to access malicious content and gain their information. This study aims to develop an efcient machine-learning program to detect phishing websites with high accuracy. Most phishing webpages look identical to the actual web pages and various strategies for detecting phishing websites, such as blacklisting, and heuristics, among others have been suggested. Existing research works showed that the performance of the phishing detection system is limited and there is a demand for intelligent techniques to protect users from cyber-attacks. A Uniform resource locator (URL) detection technique based on a supervised machine learning approach – Naïve Bayes is employed and implemented in Python programming language. The efcacy of this approach was determined on a phishing dataset made up of 7900 malicious and 5800 legitimate sites, respectively. The results show that using the proposed methodology an accuracy of 96% can be achieved by using stacking, ltering along the Naïve Bayes and logistic regression. This study thoroughly investigates the use of machine laearning with features extracted from the URLs and was able to showcase common words for the identication of either phishing (unhealthy) or good websites and proffered a guide to end users against the recent approaches in malicious URLs detection.

Browser‐in‐the‐middle attacks: A comprehensive analysis and countermeasures

AbstractA browser‐in‐the‐middle (BITM) attack occurs when an attacker intercepts and manipulates communication between a user's web browser and the website they are attempting to visit. This approach is risky, as it allows the attacker to eavesdrop on crucial information, such as login passwords or financial details, leading to unauthorized access and potential data breaches. Moreover, the attacker can inject malicious content into the conversation, compromising the integrity of the data shared between the user's browser and the website. The article delves into the BITM attack as a strategy employed in phishing assaults. The article emphasizes precautionary measures to safeguard against BITM attacks. Additionally, it offers insights into how users can defend themselves and respond to an attack. The significance of user awareness in avoiding phishing attempts is a key highlight of the article.

The diffusion of malicious content on Twitter and its impact on security

While Twitter remains one of the most popular social media networks within the information security community, threat actors continue to abuse the platform to create, share, and spread malicious contents. In this study, we focus on whether Twitter- and vulnerability-related features can help predict vulnerabilities known to be actively exploited. Using a sample of 6004 tweets, results show that Twitter features (tweets and quote tweets) that combine the benefits of both content creation and sharing can predict active exploitation of vulnerabilities. Furthermore, findings show that certain technical and vulnerability-related features are also capable of predicting active exploitations.

Enhancing Spam Filtering: A Machine Learning Approach to SMS and Email Fraud Classification

Abstract: Spam is an unsolicited text message or SMS that may contain malicious content and is sent on mobile devices. Fraudsters send fictitious texts in an attempt to get victims to reply to their messages, and they may also steal account numbers, passwords, and other private information. It was suggested to use a model built around algorithms for machine learning to prevent falling for scammers' tricks. The Naïve Bayes method and term frequencies-inverse document frequency vectorizer are used to implement the suggested model. acquired the dataset from the Kaggle database and used it to train the model. The PyCharm IDE can be used to access the local host webpage that makes up this model. The obtained findings indicate a 95% accuracy and 100% precision for the model.

Malware Analysis Using Transfer Learning

Abstract: The evolution of malware threats demands continuous innovation in detection techniques to safeguard systems. This research project introduces a comprehensive solution aimed at unveiling malware detection capabilities through the integration of cutting-edge methodologies and APIs. At its core, our tool utilises transfer learning techniques to analyse files for potential malicious content, providing a first line of defence against emerging threats. Building upon this foundation, the integration of the Virustotal API enhances enumeration capabilities, utilising the collective intelligence of numerous antivirus engines to validate and quantify detected threats. Then it calculates a malware score based on this enumeration, So everyone can easily understand how malicious that file is.

Freedom of speech or freedom of reach? Strategies for mitigating malicious content in social networks

Malicious content threatens the integrity and quality of content in social networks. Research and practice have experimented with network intervention strategies to curb malicious content propagation. These strategies lack efficiency, target malicious content propagators, and abridge freedom of speech. We draw upon the preferential attachment literature and cognitive load theory to employ the mechanisms of network formation, information sharing, and limited human cognitive capacities to propose an alternative feed management strategy—Preferentiality Dampened Feed Management. We compare and contrast this strategy against other established strategies using an agent-based model that utilizes empirical data from Twitter and findings from the prior literature. The results from our two experiments suggest that our proposed strategy is more effective in curbing malicious content propagation than other established strategies. Our work has important implications for the network interventions literature and practical implications for platform providers, social media users, and society.

Proactive Analysis and Detection of Cyber-attacks using Deep Learning Techniques

Objectives: This study objective is to create a proactive forensic framework with a classification model to identify the malicious content to avoid cyber-attacks. Methods: In this proposed work, a novel framework is introduced to analyze and detect network attacks before it happens. It monitors the network packet flow, captures the packets, analyzes the packet flow proactively, and detects cyber-attacks using different machine learning algorithms and Deep Convolution Neural network (CNN) technique. The KDD dataset is used in this experiment with 30% for testing and 80% for training. Findings: The simulation results show that the detection percentage of the proposed framework reaches a maximum of 95.92% in different scenarios. It is approximately 10% higher than the existing proactive frameworks for example Gawand’s model, Ahmetoglu’s model and many more. Novelty and applications: The proposed framework is a proactive model which detects the cyber-attack in prior to avoid cyber-attacks. The deep CNN model highly efficient for detecting cyber-attack. Keywords: Proactive Forensic Framework, Deep CNN, Classification Algorithms, Cyber attack detection, Intrusion Detection System

Detecting Malicious Twitter Bots using Machine Learning

Abstract: Twitter play a significant role in our daily lives, offering a wide range of opportunities to their users. However, Twitter and online social networks (OSNs) in general are increasingly being utilized by automated accounts, commonly known as bots, as they continue to gain immense popularity across various user demographics. Malicious twitter Bots detection is required to detect real users from fraudulent users because it leads to spreading of spam messages and engage in fraudulent activities. To overcome this, we are going to differentiate bots from legitimate users using feature extraction techniques and find malicious bots and tweets using machine learning algorithm and deep learning architecture known as VGG19 which is combined with the convolutional neural network (CNN) in order to identify whether the tweets are posted by bots or real users and also identifying malicious twitter bots along with malicious URLs. By following these techniques, we can identify the account as bots or real user and prevent spreading of malicious content in the society. The deep learning architecture combined with convolutional neural network to evaluate over a series of experiments using two large real Twitter datasets and compare the experimental results with other machine learning algorithms and provide advantages over other existing techniques like logistic regression targeting the identification of malicious users in social media.

The Role of Technology In Combating Fake and Malicious Contents

Technology presents a double-edged sword in the fight against fake content online This paper investigates the multifaceted roles of technology in the dissemination of fake content online. It explores how advancements like automation, social media algorithms, and deep fakes facilitate the spread of misinformation. Conversely, it examines how technologies like AI, fact-checking tools, and content moderation can be harnessed to mitigate this challenge Conversely, the paper examines how technologies like artificial intelligence (AI), fact-checking tools, and content moderation can be harnessed to mitigate this challenge. Finally, the discussion goes into policy considerations and potential future technological solutions for fostering a more trustworthy online environment (Shu et al., 2017; Tandoc et al., 2018). Keywords: Fake Content, Misinformation, Disinformation, Technology, AI, Fact-Checking, Content Moderation, Online Trust. Journal Reference Format: Omoyeni, O.E. Enyinnaya, C.V., Bardi, P., Ogbaini, C.A. & Ajayi, J.O. (2024): The Role of Technology In Combating Fake and Malicious Contents Social Informatics, Business, Politics, Law, Environmental Sciences & Technology Journal. Vol. 10, No. 1. Pp 17-24 www.isteams/socialinformaticsjournal. dx.doi.org/10.22624/AIMS/SIJ/V10N1P4

Decoding Digital Discourse: Artificial Intelligence – powered Cyberbullying Detection

Social media platforms have fundamentally transformed how people share information and communicate. While they offer significant benefits, they also pose challenges, such as the increasing prevalence of cyberbullying. While many studies have emphasized the accuracy of text classification techniques for detecting cyberbullying, this research explores the potential of automating not just the detection but also the reporting of harmful posts. We developed a Support Vector Machine model using WEKA, designed to identify cyberbullying statements in the English language. This model yielded an accuracy of 57% with a kappa score of 0.2094. After developing the model, we extracted public posts from Twitter and applied text preprocessing methods, including cleaning and tokenization. These preprocessed data were then transformed into a Bag-of- Words (BoW) representation. When a post is identified as cyberbullying by our model, a comprehensive report is generated detailing the author's name, post content, and the timestamp. This innovative method holds promise for the timely detection of malicious content, offering social media platform administrators an efficient tool for prompt intervention.

Graph neural networks based framework to analyze social media platforms for malicious user detection

Online social media (OSM) has emerged as the most pertinent and readily available platform for individuals to effectively express their perspectives. Users connect seamlessly in an unstructured network, allowing information to flow within seconds. This interconnectedness, while enabling rapid information dissemination, also opens the door to significant challenges such as misinformation, disinformation, cyberbullying, privacy concerns, polarized opinions, and digital footprints. Users on social media are active with different intentions, which could include information sharing, social connections, shaping public opinion, or launching campaigns either for or against certain organizations with specific objectives. Depending on the users’ intentions, the content can be either malicious or non-malicious. Malicious content can induce fear, uncertainty, or financial damage, leading to societal polarization or reduced revenue for commercial organizations. Therefore, the detection of users with malicious intentions is crucial to curb the spread of harmful content in society. This paper proposes a deep learning-based framework that explores social media in three different domains: users’ profiles, the content being shared, and the analysis of users’ unstructured ego-networks. The framework is established on an inductive learning-based graph neural network for a 3D analysis of social media platforms. The proposed model can serve as a benchmark and provide a baseline for researchers. The performance of the proposed model is compared with available approaches, such as SVM and LSTM. A series of experiments demonstrates the out-performance of the proposed framework on real-world PHEME dataset. Additionally, the proposed framework may also be used as an OSINT (Open-Source Intelligence) tool, depending on the availability of customized data.

GenAI against humanity: nefarious applications of generative artificial intelligence and large language models

Generative Artificial Intelligence (GenAI) and Large Language Models (LLMs) are marvels of technology; celebrated for their prowess in natural language processing and multimodal content generation, they promise a transformative future. But as with all powerful tools, they come with their shadows. Picture living in a world where deepfakes are indistinguishable from reality, where synthetic identities orchestrate malicious campaigns, and where targeted misinformation or scams are crafted with unparalleled precision. Welcome to the darker side of GenAI applications. This article is not just a journey through the meanders of potential misuse of GenAI and LLMs, but also a call to recognize the urgency of the challenges ahead. As we navigate the seas of misinformation campaigns, malicious content generation, and the eerie creation of sophisticated malware, we’ll uncover the societal implications that ripple through the GenAI revolution we are witnessing. From AI-powered botnets on social media platforms to the unnerving potential of AI to generate fabricated identities, or alibis made of synthetic realities, the stakes have never been higher. The lines between the virtual and the real worlds are blurring, and the consequences of potential GenAI’s nefarious applications impact us all. This article serves both as a synthesis of rigorous research presented on the risks of GenAI and misuse of LLMs and as a thought-provoking vision of the different types of harmful GenAI applications we might encounter in the near future, and some ways we can prepare for them.

RPf-GCNs: reciprocal perspective driven fused GCNs for rumor detection on social media

The earliest detection of rumors across social media is the need to the hour in present global village. User’s are seamlessly connected in an unstructured network leading to rapid flow of information. User’s on the social media with malign intents may share defamatory content to contribute towards the fifth generation media warfare. The ingress of such defamatory content into society can result in panic, uncertainty and demoralization the peoples. Due to the huge amount of content over social platforms, the detection of malicious contents is hard. Earlier research while focuses on content profiling and flow of information, however, the reciprocal perspective of the source and following contents is missing. In this research, a novel Reciprocal Perspective fused Graph Convolutional Neural Network (RPf-GCN) is proposed. The proposed framework incorporates twin GCNs to encode both the bottom-up and top-down perspectives, enhancing the understanding of rumor propagation. Moreover convolutional operation is employed to fuse reciprocal perspective, providing a holistic view of the conversations. To validate the efficacy of the proposed framework, we conducted a series of experiments using real-world datasets, including PHEME and SemEval. Experimentation performed illustrates that the proposed framework outperformed over various baselines in two different evaluation metrics namely Macro F1 (for PHEME 0.736, for SemEval 0.461) and Accuracy (for PHEME 0.748, for SemEval 0.658).