Malware Research Articles

Research and Application of Active Security Protection Methods for Automotive Cloud

With the gradual maturity of the Internet of vehicles and cloud computing industry and the continuous evolution of network attack forms, the demand for cloud security in the automotive industry will increase year by year. In the automobile cloud platform environment, because the traditional security scheme is still effective for the north-south traffic, the security problem of the automobile cloud platform mainly lies in the security protection of the east-west traffic of the platform and the division of the security boundary. The purpose of this project is to solve the security risk of east-west cross-subnet traffic of the automobile cloud platform, especially the traffic security problem between hosts, in order to provide the next generation firewall, intrusion prevention and other professional security protection functions for the virtual network environment without affecting the service virtual machine. In order to achieve the above purpose, it is necessary to solve the problem of virtual switch diversion and virtual machine drift on the cloud platform, study the service security requirements of the automotive cloud platform, the relationship between data transfer and processing on the cloud platform, and finally provide a prototype system of active security protection for the cloud platform risks. The system implements VM microisolation, network attack defense, malicious code defense, ip address-based secure access policies, application-type secure access policies, and VM migration security functions in cloud application scenarios.

Convnext-Eesnn: An effective deep learning based malware detection in edge based IIOT

A rising number of edge devices, like controllers, sensors, and robots, are crucial for Industrial Internet of Things (IIoT) networks for collecting data for communication, storage, and processing. The security of the IIoT could be compromised by any malicious or unusual behavior on the part of any of these devices. They may also make it possible for malicious software placed on end nodes to enter the network and perform unauthorized activities. Existing anomaly detection techniques are less effective due to the increasing diversity of the network and the complexity of cyberattacks. In addition, most strategies are ineffective for devices with limited resources. Therefore, this work presents an effective deep learning based Malware Detection framework to make the edge based IIoT network more secure. This multi-stage system begins with the Deep Convolutional Generative Adversarial Networks (DCGAN) based data augmentation method to overcome the issue of data imbalance. Next, a ConvNeXt-based method extracts the features from the input data. Finally, an optimized Enhanced Elman Spike Neural Network (EESNN) based deep learning is utilized for malware recognition and classification. Using two distinct datasets— MaleVis and Malimg— the generalizability of the suggested model is clearly demonstrated. With an accuracy of 99.24% for MaleVis and 99.31% for the Malimg dataset, the suggested strategy demonstrated excellent results and surpassed all other existing methods. It illustrates how the suggested strategy outperforms alternative models and offers numerous benefits.

Black-box adversarial transferability: An empirical study in cybersecurity perspective

The rapid advancement of artificial intelligence within the realm of cybersecurity raises significant security concerns. The vulnerability of deep learning models in adversarial attacks is one of the major issues. In adversarial machine learning, malicious users try to fool the deep learning model by inserting adversarial perturbation inputs into the model during its training or testing phase. Subsequently, it reduces the model confidence score and results in incorrect classifications. The novel key contribution of the research is to empirically test the black-box adversarial transferability phenomena in cyber attack detection systems. It indicates that the adversarial perturbation input generated through the surrogate model has a similar impact on the target model in producing the incorrect classification. To empirically validate this phenomenon, surrogate and target models are used. The adversarial perturbation inputs are generated based on the surrogate-model for which the hacker has complete information. Based on these adversarial perturbation inputs, both surrogate and target models are evaluated during the inference phase. We have done extensive experimentation over the CICDDoS-2019 dataset, and the results are classified in terms of various performance metrics like accuracy, precision, recall and f1-score. The findings indicate that any deep learning model is highly susceptible to adversarial attacks, even if the attacker does not have access to the internal details of the target model. The results also indicate that white-box adversarial attacks have a severe impact compared to black-box adversarial attacks. There is a need to investigate and explore adversarial defence techniques to increase the robustness of the deep learning models against adversarial attacks.

A Framework for Detection of Malicious Code by Exploiting Machine Learning Techniques on Portable Executables

Executable files coming from the internet bring along with them many potential hazards and vul- nerabilities in the form of malware to computer systems. The executables can be of form raw binaries, mnemonics, libraries, and function calls/APIs. They can misguide many of the conventional malware detection techniques. This paper explores the potential of Machine Learning- based methods for malware detection problems. The scope of the work here is currently limited to Static Anal- ysis of Executable files. Various feature selection tech- niques are implemented to reduce the size of the training data. Machine learning algorithms like K-Nearest Neigh- bors and Random Forest Classifier were trained on the curated feature sets. The outperforming experiment re- sult was shown by the Random Forest Classifier having an accuracy of 99.5%. We have developed a framework as a two-step module; in the first step, a list of features are extracted from a given executable file, and then for the next step, trained algorithm is integrated into the framework which will classify whether the given executa- ble file is malicious or not. This framework is demon- strated in the form of a Webapp developed in Python. Furthermore, this framework is evaluated based on its performance on a small dataset containing 35 portable executables (.exe) files and it is observed to be retaining the accuracy of the trained algorithm.

A Comparative Analysis of Malware Detection Methods Traditional vs. Machine Learning

Mobile devices have been the target of malicious software since their beginnings. Two known types
 of malware threats can intrude into mobile, independently injected applications and fraudulent
 applications that are developed to breach the security of mobile devices. Mostly these fraudulent
 applications access data using API calls and permission requests. API calls and permission requests
 are important for smooth conversation between mobile devices and database servers. This research
 proposes an efficient classification model that concatenates API calls and permission requests to
 detect malicious applications. We have used a dataset that contained more than 15 thousand Android
 devices’ malware. We have divided data into three groups to differentiate between the malicious
 permission requests and malicious API calls with normal permission requests and normal API calls.
 To increase the probability of recognizing Android malware applications, we develop three distinct
 grouping strategies for selecting the most valuable API calls that are obscure, critical, and obstreperous and are chosen because Android apps extensively use several application programming interfaces (APIs). According to the results, malware applications require authorizations to access confidential information very frequently than normal Android applications do. Also, malicious Android
 applications raise a diverse set of API calls to access sensitive data, evidenced by malware applications making a distinct set of API calls. Our proposed method attains an F-score of 94.04%, which suggests that it is efficient at discovering mobile malware applications. Our model can be of significant assistance in conducting mobile application analysis and forensic investigations into malware.

Towards Building a Faster and Incentive Enabled Privacy-Preserving Proof of Location Scheme from GTOTP

In recent years, there has been significant growth in location-based services (LBSs) and applications. These services empower users to transmit their location data to location service providers, thereby facilitating the provisioning of pertinent resources and services. However, in order to prevent malicious users from sending fake location data, users must attest to their location for service providers, namely, through a proof of location (PoL). Such a proof should additionally prevent attackers from being able to obtain users’ identity and location information through it. In this paper, we propose an efficient privacy-preserving proof of location (PPPoL) scheme. The scheme is based on the standard cryptographic primitives, including Group Time-based One-Time Password (GTOTP) and public key encryption, which achieves entity privacy, location privacy, and traceability. Unlike the previous GTOTP-based PPPoL scheme, our scheme enables instant location verification with additional hash operations. To encourage the active participation of witnesses in location proofs, we propose an incentive mechanism based on smart contracts. Additionally, we implement a proof of concept of our PPPoL scheme on an Android device. Our experimental results show that proof generation and verification time are on the order of milliseconds. Meanwhile, the total overhead for the incentive mechanism amounts to 0.0011 ETH. This result is practical for mobile device-based LBSs.

B-CAT: a model for detecting botnet attacks using deep attack behavior analysis on network traffic flows

AbstractThreats on computer networks have been increasing rapidly, and irresponsible parties are always trying to exploit vulnerabilities in the network to do various dangerous things. One way to exploit vulnerabilities in a computer network is by employing malware. Botnets are a type of malware that infects and attacks targets in groups. Botnets develop quickly; the characteristics of initially sporadic attacks have grown into periodic and simultaneous. This rapid development has proved that the botnet is advanced and requires more attention and proper handling. Many studies have introduced detection models for botnet attack activity on computer networks. Apart from detecting the presence of botnet attacks, those studies have attempted to explore the characteristics of botnets, such as attack intensity, relationships between activities, and time segment analysis. However, there has been no research that explicitly detects those characteristics. On the other hand, each botnet characteristic requires different handling, while recognizing the characteristics of the botnet can help network administrators make appropriate decisions. Based on these reasons, this research builds a detection model that can recognize botnet characteristics using sequential traffic mining and similarity analysis. The proposed method consists of two main processes. The first is training to build a knowledge base, and the second is testing to detect botnet activity and attack characteristics. It involves dynamic thresholds to improve the model sensitivity in recognizing attack characteristics through similarity analysis. The novelty includes developing and combining analytical techniques of sequential traffic mining, similarity analysis, and dynamic threshold to detect and recognize the characteristics of botnet attacks explicitly on actual behavior in network traffic. Extensive experiments have been conducted for the evaluation using three different datasets whose results show better performance than others.

GlareShell: Graph learning-based PHP webshell detection for web server of industrial internet

With the explosive growth of the Industrial Internet scale, cyberattacks targeting industrial control systems also increased. The management and operation of Industrial Internet are usually performed via web servers which retain a large attack surface. In the Industrial Internet, attackers usually exploit vulnerabilities to inject malicious codes for remotely executing commands, stealing confidential data, and invading web servers. Existing approaches capture statistical and contextual dependence information from Webshell using machine learning (ML) or deep learning (DL) algorithms. However, the semantic feature mining of program code within Webshell is not sufficient when entering new types of Webshell. In this paper, we propose a graph learning-based PHP Webshell detection framework, GlareShell, using the word embedding technique, a risk weight allocation mechanism, and the graph neural network (GNN). First, GlareShell leverages static analysis to extract interprocedural control flow graphs (ICFGs) from PHP script files and then prunes these ICFGs to remove noisy statements. Then, word embedding techniques are employed to generate semantic representations from PHP statements. Next, we design a risk weight allocation mechanism to derive the risk levels of statements and concatenate them with word embeddings as attributions. The identified risk levels could guide the passing of potential attack patterns inside GNN models. Finally, GlareShell builds a GNN classifier directly from the ICFG with corresponding node attributions to identify the malicious PHP scripts. Experiment results on collected datasets prove the promise of our graph learning framework in the Webshell detection domain.

Ensuring Compliance Integrity in AI ML Cloud Environments: The Role of Data Guardianship

Artificial intelligence (AI) has become ubiquitous across various industries, including security, healthcare, finance, and national defense. However, alongside its transformative potential, there has been a concerning rise in malicious exploitation of AI capabilities. Simultaneously, the rapid advancement of cloud computing technology has led to the emergence of cloud-based AI systems. Unfortunately, vulnerabilities inherent in cloud infrastructure also pose security risks to AI services. We recognize the critical role of maintaining the integrity of training data, as any compromise therein directly impacts the effectiveness of AI systems. In response to this challenge, we emphasize the paramount importance of preserving data integrity within AI systems. To address this need, we propose a data integrity architecture guided by the National Institute of Standards and Technology (NIST) cybersecurity framework. Leveraging blockchain technology and smart contracts presents a suitable solution for addressing integrity challenges, given their features of shared and decentralized ledgers. Smart contracts enable automated policy enforcement, facilitate continuous monitoring of data integrity, and help mitigate the risk of data tampering.

Ensuring Compliance Integrity in AI ML Cloud Environments: The Role of Data Guardianship

Artificial intelligence (AI) has become ubiquitous across various industries, including security, healthcare, finance, and national defense. However, alongside its transformative potential, there has been a concerning rise in malicious exploitation of AI capabilities. Simultaneously, the rapid advancement of cloud computing technology has led to the emergence of cloud-based AI systems. Unfortunately, vulnerabilities inherent in cloud infrastructure also pose security risks to AI services. We recognize the critical role of maintaining the integrity of training data, as any compromise therein directly impacts the effectiveness of AI systems. In response to this challenge, we emphasize the paramount importance of preserving data integrity within AI systems. To address this need, we propose a data integrity architecture guided by the National Institute of Standards and Technology (NIST) cybersecurity framework. Leveraging blockchain technology and smart contracts presents a suitable solution for addressing integrity challenges, given their features of shared and decentralized ledgers. Smart contracts enable automated policy enforcement, facilitate continuous monitoring of data integrity, and help mitigate the risk of data tampering.

A Secure VM Placement Strategy to Defend against Co-residence Attack in Cloud Datacentres

With the increasing number of co-residence attacks, the security of the multi-tenant public IaaS cloud environment has become a growing concern. The co-residence attacker creates a side channel to retrieve the secured data. These attacks help the adversary to leak out the sensitive information of the user with whom it is co-located. This paper discusses a secured VM placement technique, Previous Server and Co-resident users First (PSCF), which focuses on facilitating security against the co-residence attack by minimizing the probability of co-locating the malicious user with the authentic user. Co-location resistance and core utilization metrics are utilized to evaluate the algorithm’s performance. The proposed method is simulated, and the result is analysed and compared with existing approaches like Best Fit, Worst Fit, PSSF, and SC-PSSF. It is observed that the proposed approach furnished maximum co-location resistance of 74.32% and a core utilization of 82.63%. Further, the algorithm has shown significant performance in balancing the load and energy consumption. The result has reduced the probability that malicious users co-located with the authentic one, thus reducing the security breach of confidential information.

A Blockchain-Based Secure Sharing Scheme for Electrical Impedance Tomography Data

Real-time electrical impedance tomography (EIT) data sharing is becoming increasingly necessary, due to the extensive use of EIT technology in various sectors, including material analysis, biomedicine, and industrial process monitoring. The prevalence of portable EIT equipment and remote imaging technology has led to a predominance of centralized storage, Internet protocol transmission, and certificates from certificate authorities (CA) in telemedicine data. This has resulted in compromised data security, network communication delays, high CA maintenance costs, increased risks of medical data privacy breaches, and low security. Therefore, this paper offers a consortia blockchain-based method for exchanging EIT data that addresses security and integrity concerns during data storage and exchange, while maintaining transparency and traceability. Proprietary re-encryption techniques are employed to guarantee traceability when exchanging anonymous data, enabling precise control over data access. This scheme serves to protect both data and identity privacy, as well as to trace the actual identity of potential malicious users, while also thwarting any coordinated efforts between partially trusted parties and data requesters seeking unauthorized access to confidential information. Additionally, a combination of blockchain and InterPlanetary File System (IPFS) distributed storage technology is utilized to ease the burden of EIT data storage. The feasibility and effectiveness of the proposed solution were validated through a series of experiments, demonstrating its ability to effectively prevent data tampering and misuse, reduce data management costs, and enhance the efficiency and quality of data sharing.

Facial soft-biometrics obfuscation through adversarial attacks

Sharing facial pictures through online services, especially on social networks, has become a common habit for thousands of users. This practice hides a possible threat to privacy: the owners of such services, as well as malicious users, could automatically extract information from faces using modern and effective neural networks. In this paper, we propose the harmless use of adversarial attacks, i.e. variations of images that are almost imperceptible to the human eye and that are typically generated with the malicious purpose to mislead Convolutional Neural Networks (CNNs). Such attacks have been instead adopted to (i) obfuscate soft biometrics (gender, age, ethnicity) but (ii) without degrading the quality of the face images posted online. We achieve the above mentioned two conflicting goals by modifying the implementations of four of the most popular adversarial attacks, namely FGSM, PGD, DeepFool and C&W, in order to constrain the average amount of noise they generate on the image and the maximum perturbation they add on the single pixel. We demonstrate, in an experimental framework including three popular CNNs, namely VGG16, SENet and MobileNetV3, that the considered obfuscation method, which requires at most four seconds for each image, is effective not only when we have a complete knowledge of the neural network that extracts the soft biometrics (white box attacks), but also when the adversarial attacks are generated in a more realistic black box scenario. Finally, we prove that an opponent can implement defense techniques to partially reduce the effect of the obfuscation, but substantially paying in terms of accuracy over clean images; this result, confirmed by the experiments carried out with three popular defense methods, namely adversarial training, denoising autoencoder and Kullback-Leibler autoencoder, shows that it is not convenient for the opponent to defend himself and that the proposed approach is robust to defenses.

PhishingRTDS: A real-time detection system for phishing attacks using a Deep Learning model

In recent years, phishing attacks have become more intelligent and more challenging to detect using typical phishing methods. Moreover, attackers have leveraged some web development techniques to increase the website's legitimacy in victims' eyes, such as using JFrame to design a window that looks like a browser inside the webpage. In this paper, we design a system that detects three types of phishing attacks: Tiny Uniform Resource Locators (TinyURLs), Browsers in the Browser (BiTB), and regular phishing attacks. In this system, we aim to protect victims from mistakenly downloading malicious software into their systems. We split our system into three parts: Deep Learning model (DL), browser extension, and docker container. First, we design a DL model using bidirectional long short-term memory (BiLSTM) and an attention mechanism to classify the URL as phishing or benign. Our model shows 99% in its precision, recall, and F1 score. Second, we design a browser extension to extract the original URL from the suspect webpage and then send it to the docker container. Then, the docker container opens the webpage and extracts all URLs from its HyperText Markup Language (HTML) and JavaScript. Then, each URL passes to a DL model for classification, resulting in a list of labels for each webpage. Therefore, we use three decision strategies: Single Phishing Strategy (SPhS), Mean Sum Strategy (MSS), and Weighted Average Strategy (WeAS) to decide whether the webpage is phishing or benign. Our findings indicate that the best results among the three strategies were WeAS.

Deep learning hybridization for improved malware detection in smart Internet of Things

The rapid expansion of AI-enabled Internet of Things (IoT) devices presents significant security challenges, impacting both privacy and organizational resources. The dynamic increase in big data generated by IoT devices poses a persistent problem, particularly in making decisions based on the continuously growing data. To address this challenge in a dynamic environment, this study introduces a specialized BERT-based Feed Forward Neural Network Framework (BEFNet) designed for IoT scenarios. In this evaluation, a novel framework with distinct modules is employed for a thorough analysis of 8 datasets, each representing a different type of malware. BEFSONet is optimized using the Spotted Hyena Optimizer (SO), highlighting its adaptability to diverse shapes of malware data. Thorough exploratory analyses and comparative evaluations underscore BEFSONet’s exceptional performance metrics, achieving 97.99% accuracy, 97.96 Matthews Correlation Coefficient, 97% F1-Score, 98.37% Area under the ROC Curve(AUC-ROC), and 95.89 Cohen’s Kappa. This research positions BEFSONet as a robust defense mechanism in the era of IoT security, offering an effective solution to evolving challenges in dynamic decision-making environments.

Edge model: An efficient method to identify and reduce the effectiveness of malicious clients in federated learning

In the rapidly changing world of data-driven decision making, machine learning techniques have become increasingly popular. However, traditional machine learning models often rely on centralized data repositories, which can pose challenges to privacy and security. To address these limitations, federated learning has emerged as a groundbreaking approach that uses distributed data while preserving privacy. Federated learning, also known as collaborative machine learning, is a decentralized learning paradigm that allows multiple devices or entities to work together to build a shared model without sharing their raw data. Instead of sending sensitive data to a central server, federated learning enables devices to train models locally and share only aggregated updates to the model. This distributed approach empowers organizations to leverage the collective intelligence of their devices while ensuring the privacy of their data. in this paper, we have tried to present a method that is a new way to deal with malicious users and also reduce their effectiveness on the global model. The idea of this paper is a combination of using several global models instead of one global model and identifying clients in these models and removing them from the learning process. In this approach, certain global models are trained using learning algorithms and input from local users. Consequently, instead of having a single global model, we will have a collection of global models. When it comes to predicting the label of a test sample, the selected model will be determined based on the highest accuracy percentage achieved in label prediction among the available global models after eliminating any potentially harmful clients. We will show that the method presented in this paper will significantly reduce the impact of malicious users. We have evaluated this method on the popular MNIST, Cifar10 and Fashion MNIST datasets. The evaluation results show that the proposed method significantly reduces the effect of malicious users.

Application of Deep Reinforcement Learning (DRL) for Malware Detection

Malware poses a significant threat to computer systems and networks, necessitating advanced detection methods to safeguard against potential cyber-attacks. This paper investigates the application of Deep Reinforcement Learning (DRL) for malware detection, leveraging its ability to learn complex patterns and behaviours from raw data. The study employs a DRL framework to train an agent to identify malicious software based on dynamic features extracted from executable files. A comprehensive evaluation is conducted using a diverse dataset, encompassing various types of malware samples. The experimental results demonstrate the effectiveness of the proposed DRL based approach in accurately detecting malware, achieving competitive performance compared to traditional methods and state-of-the-art techniques. Additionally, the paper discusses the interpretability and scalability of the model, along with potential challenges and future research directions in applying DRL to cybersecurity.

Malicious Code Propagation Model Based on Sleep Monitoring Mechanism in Wireless Sensor Networks

<p>Wireless sensor networks (WSNs) are characterized by high node density and finite energy storage. Each node exchanges information with all its neighboring nodes frequently, which makes it easy for nodes to run out of energy, leading to paralysis of the WSNs when facing network malicious code attacks. To address this problem, a malicious code propagation model based on sleep-monitoring technology for WSNs is proposed. As a Multi-compartment propagation, sleep nodes and monitoring nodes are introduced to the conventional SIR model. Sleep nodes can turn the infected node into a dormant state and stop the dissemination of information to save energy. Monitoring nodes can contain malicious codes spread in wireless sensor networks by sharing prevention information in real time. Additionally, by calculating the equilibrium point and propagation threshold of the new feedback model, the corresponding Lyapunov function is constructed to prove the local stability and global stability of the equilibrium point. Finally, the results of numerical simulation experiments show that when the sleep rate is 0.3 and feedback rate is 0.0000005, the number of infected nodes in the wireless sensor network decreases by 43.45%. Therefore, adding sleep-monitoring technology can effectively control the spread of malicious code in the networks.</p> <p> </p>

Enhancing Malware Detection Efficiency through CNN-Based Image Classification in a User-Friendly Web Portal

The proposed CNN-based malware detection web portal classifies images on a unique, self-made dataset to identify malware files as input. There are many different types of malware out there, but no method can detect them all. An anti-virus programme could be created that enforces malware image classification for the aforementioned scenarios as opposed to the traditional signature-based methods used by the majority of anti-virus programmes currently available in the market, which are time-consuming and ineffective because they rely just on signatures of previous malware attacks and need to be updated regularly. The fact that some malware is encrypted and requires a significant amount of computing power to decrypt makes this strategy ineffective for identifying all malware that accesses the network. As a result, fresh malware cannot be detected because this method simulates the behavior of malware samples and matches it to new programs. An online portal with a candid user interface will be used to deploy the proposed Deep-learning based malware detection algorithm. The file to be tested or classified will be uploaded onto the website

REVIEW OF MODELLING APPROACHES FOR WEBSITE-RELATED PREDICTIONS

This paper researches various modelling approaches for website-related predictions, offering an overview of the field. With the ever-expanding landscape of the World Wide Web, there is an increasing need for automated methods to categorize websites. This study examines an array of prediction tasks, including website categorization, web navigation prediction, malicious website detection, fake news website detection, phishing website detection, and evaluation of website aesthetics.