Malware Research Articles

Comparative Analysis of Machine Learning Models for Android Malware Detection

The rapid growth of Android devices has led to increased security concerns, especially from malicious software. This study extensively compares machine-learning algorithms for effective Android malware detection. Traditional models, such as random forest (RF) and support vector machines (SVM), alongside advanced approaches, such as convolutional neural networks (CNN) and XGBoost, were evaluated. Leveraging the NATICUSdroid dataset containing 29,332 records and 86 traces, the results highlight the superiority of RF with 97.1% and XGBoost with 97.2% accuracy. However, evolving malware and real-world unpredictability require a cautious interpretation. Promising as they are, our findings stress the need for continuous innovation in malware detection to ensure robust Android user security and data integrity.

Improvement of a Conditional Privacy-Preserving and Desynchronization-Resistant Authentication Protocol for IoV

In Internet of Vehicles (IoV), the secure data transmission between vehicles and transportation infrastructure effectively ensures the safety and fast driving of vehicles, while authentication and key agreement protocols between vehicles and transportation infrastructure (V2I) play an important role in ensuring data security and user privacy. However, how to design a provably secure and lightweight V2I authentication protocol for IoV is a challenge. Recently, Kumar et al. proposed a conditional privacy-preserving and desynchronization-resistant authentication protocol for IoV, but we find that Kumar et al.’s scheme is vulnerable to identity guessing attacks, impersonation attacks, and a lack of session key secrecy once the attacker obtains data stored in smart card through side-channel attacks. We also point out that Kumar et al.’s protocol is vulnerable to Roadside Unit (RSU) captured attacks and lacks perfect forward secrecy. Therefore, we propose an improved V2I authentication protocol for IoV, which uses the Physical Unclonable Function (PUF) to resist RSU captured attacks, and designed a three-factor secrecy strategy to resist side-channel attacks; a conditional privacy-preserving strategy was also adopted to achieve anonymity and malicious user tracking. Furthermore, the proposed protocol is provably secure under the random oracle model and has low computation and communication costs.

SNDMI: Spyware network traffic detection method based on inducement operations

Spyware is a type of malware widely used by attackers to steal confidential information from users without their knowledge. It has the characteristics of high latency, high stealth, and high threat. Spyware typically uses trigger-based tactics to implement its malicious behavior, making it a challenge for traditional host-based detection methods and traditional network traffic-based detection methods to implement highly accurate and efficient spyware detection. To address this problem, this article focuses on the network behavior of spyware, analyzes the inducibility of spyware network traffic, and further proposes a spyware network traffic detection method based on inducement operations (SNDMI). SNDMI can cause spyware to generate more network traffic for detection by using inducement operations in the constructed inducement operation set. SNDMI extracts three types of network traffic features: distributional features, statistical features, and trend features, and uses a genetic algorithm to select features. The experimental results show that SNDMI with LightGBM achieves an accuracy of 98.98% and a false positive rate of 0.45% on the traffic of hundreds of benign and spyware samples.

Enhancing Network Security Through Router-Based Firewalls: An Investigation into Design, Effectiveness, and Human Factors

A firewall serves as a crucial computer program designed to block malicious software, thereby safeguarding the user's system. It helps prevent the unauthorized dissemination of personal information and the incursion of harmful viruses. Taking inspiration from China's "Great Firewall"—a sophisticated system utilizing advanced software and hardware to automatically filter, censor, and monitor internet content—this research aims to devise a router-based firewall system capable of autonomously shielding users' computers from viruses and unauthorized websites. A comprehensive questionnaire was deployed to unearth the predominant sources of information leakage among computer users and ascertain the role of firewalls within computer systems. The analytical findings underscore that the majority of information leakage security risks stem from a significant lack of personal privacy awareness and a deficient understanding of firewall security systems. The proposed firewall system harnesses router-based control to address the limitations inherent in PC software-based firmware systems. This innovation enhances the control of viral threats and the prevention of user privacy leaks. Serving as a tangible barrier, the router-based firewall obstructs the route of viruses or malevolent programs before reaching the user's computer. This strategic design substantially reduces user intervention, ensuring the continuous operation of the firewall to steadfastly protect the user's computing environment.

Artificial Intelligence in Intellectual Property Protection: Application of Deep Learning Model

To create and train a deep learning model costs a lot in comparison to ascertain a trained model. So, a trained model is considered as the intellectual property (IP) of the person who creates such model. However, there is every chance of illegal copying, redistributing and abusing of any of these high-performance models by the malicious users. To protect against such menaces, a few numbers of deep neural networks (DNN) IP security techniques have been developed recently. The present study aims at examining the existing DNN IP security activities. In the first instance, there is a proposal of taxonomy in favor of DNN IP protection techniques from the perspective of six aspects such as scenario, method, size, category, function, and target models. Afterwards, this paper focuses on the challenges faced by these methods and their capability of resisting the malicious attacks at different levels by providing proactive protection. An analysis is also made regarding the potential threats to DNN IP security techniques from various perspectives like modification of models, evasion and active attacks.
 Apart from that this paper look into the methodical assessment. The study explores the future research possibilities on DNN IP security by considering different challenges it would confront in the process of its operations.
 Result Statement: A high-performance deep neural Networks (DNN) model is costlier than the trained DNN model. It is considered as an intellectual property (IP) of the person who is responsible for creating DNN model. The infringement of the Intellectual Property of DNN model is a grave concern in recent years. This article summarizes current DNN IP security works by focusing on the limitations/ challenges they confront. It also considers the model in question's capacity for protection and resistance against various stages of attacks.

Phishing Site Detection Using ML Algorithms

This study delves into the growing threat of online phishing frauds by evaluating the efficacy of diverse machine learning (ML) algorithms in pinpointing malicious websites. Given the substantial risks phishing attacks pose to user privacy and security, it emerges as a promising solution due to its adaptability and the ability to glean insights from extensive datasets. Past research underscores the potential of Support Vector Machines (SVM) and Random Forests in phishing detection. Nevertheless, challenges persist in optimal algorithm selection and feature prioritization. The proposed system integrates Gradient Boosting and Cat Boost alongside Random Forest, leveraging features from the UC Irvine Machine Learning Repository. The study's relevance lies in its performance analysis, which steers the selection of the most effective algorithm for detecting phishing websites, making it pertinent for automated systems addressing the evolving landscape of online threats.

Improved reputation evaluation for reliable federated learning on blockchain

AbstractWorker selection is critical to the success of federated learning, but issues such as inadequate incentives and poor‐quality data can negatively impact the process. The existing studies have used the multi‐weight subjective logic model, but it is vulnerable to malicious evaluation and unfair to newly added nodes. In this paper, the authors propose an improved reputation evaluation algorithm that allows evaluations from different sources to influence each other and reduce the impact of malicious comments. The authors’ approach effectively distinguishes between malicious and honest users and improves worker selection and collaboration in federated learning.

Traceable Attribute-Based Encryption Scheme Using BIM Collaborative Design

BIM collaborative design involves numerous participants from various specialties who create and share vast amounts of design data at different design stages to ensure the efficient transmission of design data between these specialties. It is imperative for the BIM collaborative design platform to guarantee the security of design data and effectively trace any instances of malicious leakage or tampering. Therefore, this paper proposes a traceable ciphertext-policy attribute-based encryption scheme (TCP-ABE) that formulates a dynamic data access control mechanism based on different participants and effectively tracks malicious users in the event of risks such as tampering, theft, and unauthorized access to BIM data. In this scheme, the user’s identity information is embedded into their private key as a key component, ensuring that only users who satisfy the access policy can decrypt it. The compromised private key allows for tracing of the user’s identity. Additionally, Linear Secret Sharing Scheme (LSSS) is employed as the access structure with the user’s attribute set divided into an attribute name set and an attribute value set to protect privacy by concealing the latter within the access policy. Furthermore, the scheme integrates blockchain with cloud storage as a trusted third-party storage mechanism to ensure data integrity. Finally, the TCP-ABE scheme is comprehensively evaluated by comparing its strengths and weaknesses with other algorithms. This evaluation includes a theoretical analysis of functional and computational time overhead aspects, as well as an experimental analysis of initialization time, data encryption time, and data decryption time. The scheme exhibits excellent performance across all stages and encompasses the most comprehensive functionalities, as demonstrated by the comparative analysis and experimental results.

Toward a Blockchain-Based, Reputation-Aware Secure Transactive Energy Market

The rapid expansion of transactive energy has transformed traditional electricity consumers into producers, engaging in local energy trading. In the context of distributed energy transactions, blockchain technology has been increasingly applied to facilitate transaction transparency and reliability. However, due to the challenges in collecting accurate energy transmission data from power lines, most existing studies on the blockchain-based transactive energy market are still vulnerable to security attacks, such as malicious users misreporting energy prices, refusing to pay or refusing to transmit energy. Therefore, based on the co-simulation platform PEMT-CoSim and a blockchain, we establish a blockchain-based, reputation-aware secure transactive energy market (STEM) by introducing a reputation scheme to evaluate the trustworthiness of all prosumers and designing reputation-aware, multi-round double auction and energy transmission algorithms to detect and penalize malicious attacks. Furthermore, we run comprehensive experiments for different use cases. The results show that even with malicious participants, the proposed system can guarantee the interests of the honest participants and improve the robustness and effectiveness of the energy market.

“It is Luring You to Click on the Link With False Advertising” - Mental Models of Clickbait and Its Impact on User’s Perceptions and Behavior Towards Clickbait Warnings

Clickbait, a social engineering attack performed through social media, tricks users through sensationalized or misleading posts into clicking on links that direct them to malicious websites. With the recent boom in social media, clickbait has become a substantial security concern, necessitating efforts from platforms and academia to control it. Despite these attempts, clickbait is effective due to the lack of users’ knowledge. Therefore, we explore user mental models (thought processes about how something works) about clickbait to analyze their deficiencies and their influences on users’ behavior towards clickbait warnings. To this end, we conducted an online study with 770 participants over MTurk to generate user mental models about clickbait and to evaluate the clickbait warnings conveying harm. Our findings suggest that a large portion of users have a simple mental model that fails to comprehend the dangers of clickbait, indicating the importance of warnings in supporting and educating users. Overall, our studies provide valuable insights into understanding the impact of clickbait mental models on users’ online security behavior in social media and offer guidelines for future research in these directions.

A traceable and revocable broadcast encryption scheme for preventing malicious encryptors in Medical IoT

Medical data sharing is essential for the advancement of medical research, but the existence of malicious encryptors and malicious users poses a major challenge to the seamless sharing of information among healthcare providers. We proposed a traceable and revocable broadcast encryption scheme for preventing malicious encryptors in the Medical Internet of Things (MIoT). In 2023, Wang et al. first proposed the concept of malicious encryptor for broadcast encryption and trator tracing, and they constructed a scheme for preventing this attack. The malicious encryptor is reasonable in real broadcast encryption systems because the encryptor is not always the same as the digital content provider. When digital content providers for medical institutions want to share sensitive medical data, the employees may implement encryption. Then the employees may plant some trapdoors and sell to the black market, which can be used to construct pirated boxes. To resist malicious encryptor attacks, we rely on the uniform distribution of the output of the secure cryptographic hash function to generate the randomness needed for encryption. To prevent malicious users from selling their private keys to attackers, we set up public tracing and revocation mechanisms. Meanwhile, we enable digital content providers to share common encrypted data to different groups of authorized users protected by privacy, while also sharing individual data to designated consumers of those groups. Under the decision q-parallel BDHE assumption without random oracles, our construction is demonstrated to be adaptive IND-CPA secure. Since we have a compact communication bandwidth, a constant user secret key size, and only three bilinear operations are needed for decryption to recover the encrypted broadcast message, our scheme does not add much overhead and is therefore practical.

Detection of malicious URLs using machine learning

AbstractThe detection of fraudulent URLs that lead to malicious websites using addresses similar to those of legitimate websites is a key form of defense against phishing attacks. Currently, in the case of Internet of Things devices is especially relevant, because they usually have access to the Internet, although in many cases they are vulnerable to these phishing attacks. This paper offers an overview of the most relevant techniques for the accurate detection of fraudulent URLs, from the most widely used machine learning and deep learning algorithms, to the application, as a proof of concept, of classification models based on quantum machine learning. Starting from an essential data preparation phase, special attention is paid to the initial comparison of several traditional machine learning models, evaluating them with different datasets and obtaining interesting results that achieve true positive rates greater than 90%. After that first approach, the study moves on to the application of quantum machine learning, analysing the specificities of this recent field and assessing the possibilities it offers for the detection of malicious URLs. Given the limited available literature specifically on the detection of malicious URLs and other cybersecurity issues through quantum machine learning, the research presented here represents a relevant novelty on the combination of both concepts in the form of quantum machine learning algorithms for cybersecurity. Indeed, after the analysis of several algorithms, encouraging results have been obtained that open the door to further research on the application of quantum computing in the field of cybersecurity.

Cybersecurity risks in libraries: Why universities libraries in African need to promote cyberethical practices

Cybersecurity in university libraries, particularly in Africa, is an increasingly critical issue. The technological expansion and adoption in university libraries have heightened the risk of cybercrimes, necessitating a focus on cyberethical practices. The paper has indicated that academic libraries may face threats such as line tapping, improper system processing, and the use of malicious software. These threats bear significant consequences, such as the potential loss of sensitive data, damage to reputation, and financial losses. It is imperative for academic libraries in Nigeria to adopt proactive measures in implementing cyberethics strategies. Such strategies are essential for safeguarding against intellectual property theft, cybercrime, and other ethical concerns associated with the use of technology. The paper therefore examines cybersecurity risks in African university libraries and the need to promote cyberethical practices. The paper employed a qualitative research method based on the explanatory research method. In so doing, the use of a systematic literature review was adopted to examine cybersecurity risks in African university libraries and the imperative to promote cyberethical practices. Using a purposive sampling technique, the authors collected articles published between 2015 and 2023 on databases of Emerald and ResearchGate for the review. The findings of the research illuminate the multifaceted nature of cybersecurity risks, encompassing issues such as malware attacks, phishing, ransomware, and identity theft. These risks, if unaddressed, can lead to severe consequences, including intellectual property theft, reputational damage, and financial losses. Importantly, the study concludes that the increased use of the internet and digital resources has heightened the urgency for African university libraries to actively promote cyberethical practices. The study recommends that African university libraries should prioritize cybersecurity education for both staff and users, libraries must develop and regularly update comprehensive cyberethics policies that address the unique challenges faced in the African context and libraries should explore avenues for improving their technological infrastructure. Investments in advanced security systems, regular software updates, and the adoption of emerging technologies will strengthen their resilience against cyber threats.

A Comprehensive Defense Framework Against Model Extraction Attacks

As a promising service, Machine Learning as a Service (MLaaS) provides personalized inference functions for clients through paid APIs. Nevertheless, it is vulnerable to model extraction attacks, in which an attacker can extract a functionally-equivalent model by repeatedly querying the APIs with crafted samples. While numerous works have been proposed to defend against model extraction attacks, existing efforts are accompanied by limitations and low comprehensiveness. In this paper, we propose AMAO, a comprehensive defense framework against model extraction attacks. Specifically, AMAO consists of four interlinked successive phases: adversarial training is first exploited to weaken the effectiveness of model extraction attacks. Then, malicious query detection is used to detect malicious queries and mark malicious users. After that, we develop a label-flipping poisoning attack to instruct the adaptive query responses to malicious users. Besides, the image pHash algorithm is employed to ensure the indistinguishability of the query responses. Finally, the perturbed results are served as a backdoor to verify the ownership of any suspicious model. Extensive experiments demonstrate that AMAO outperforms existing defenses in defending against model extraction attacks and is also robust against the adaptive adversary who is aware of the defense.

Mitigating ransomware attacks through cyber threat intelligence and machine learning

<div>In the face of escalating cyber threats, particularly the rampant and sophisticated nature of ransomware attacks, organizations are compelled to adopt a proactive and multi-faceted strategy for mitigation. The fusion of machine learning (ML) algorithms enables the system to dynamically adapt and evolve in response to evolving attack vectors and tactics employed by cybercriminals. This paper presents a comprehensive approach that synergistically integrates ML and cyber threat intelligence (CTI) to fortify defenses against ransomware assaults. The proposed methodology incorporates three distinct machine learning techniques, namely random forest (RF), extreme gradient boosting (XGBoost), and adaptive boosting (AdaBoost). Empirical evidence derived from the study affirms the efficacy of this approach in effectively discriminating between malicious and ransom software, achieving a notable identification rate of 98.55%. The incorporation of CTI enhances the strategic posture by providing actionable insights into the threat landscape. The proposed focuses on identifying and neutralizing ransomware, aligning with contemporary cybersecurity imperatives, offering a proactive defense against ransomware attacks, ultimately safeguarding critical assets, and preserving the integrity of digital ecosystems.</div>

Collusive spam detection from Chinese community question answering sites: A collective classification framework

With Community Question Answering (CQA) sites evolving into quite popular knowledge-sharing platforms on the Internet, they have also become ideal places for various spammers to spread fake or promotional information. Recently, with the rapid development of crowdsourcing systems, numerous malicious users have launched organized spam campaigns, conducting many spam accounts to carry out collusive spamming activities on CQA sites. In these campaigns, the spammers do not act independently but post deceptive questions and answers (Q&As) collaboratively, which makes the Q&As closely related to each other, but the spam clues of them are even less visible. Therefore, most existing spam detection works may fail to detect these carefully organized and posted collusive CQA spam. In this paper, taking Baidu Zhidao, a popular CQA platform in Chinese, as the study object, we propose a Collective Classification framework for community Question Answering spam detection (CCQA), which collectively identifies the collusive CQA spam using Q&A features and the correlations among Q&As. First, we define the Deceptive Pattern of Q&As, based on which the real Q&A groups are extracted. Then, we extract several highly discriminative Q&A features from both individual and group levels, and propose several types of correlations, which correlate the Q&As that are more likely to have the same labels. After uniformly modeling the Q&As, features, and correlations in the Attributed Heterogeneous Information Network (AHIN), a semi-supervised collective classification algorithm is proposed to detect the collusive Q&A spam. Experimental results on a real-life dataset demonstrate that CCQA can accurately detect the collusive CQA spam, and outperform a number of competitive baselines.

TRE-DSP: A traceable and revocable CP-ABE based data sharing scheme for IoV with partially hidden policy

With the popularity of the Internet of Vehicles (IoV), a large amount of data is being generated every day. How to securely share data between the IoV operator and various value-added service providers becomes one of the critical issues. Due to its flexible and efficient fine-grained access control feature, Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is suitable for data sharing in IoV. However, there are many flaws in most existing CP-ABE schemes, such as attribute privacy leakage and key misuse. This paper proposes a traceable and revocable CP-ABE-based data sharing with partially hidden policy for IoV (TRE-DSP). A partially hidden access structure is adopted to hide sensitive user attribute values, and attribute categories are sent along with the ciphertext to effectively avoid privacy exposure. In addition, key tracking and malicious user revocation are introduced with broadcast encryption to prevent key misuse. Since the main computation task is outsourced to the cloud, the burden of the user side is relatively low. Analysis of security and performance demonstrates that TRE-DSP is more secure and practical for data sharing in IoV.

Employing Incremental Learning for the Detection of Multiclass New Malware Variants

Background/Objectives: The study aims to achieve two main objectives. The first is to reliably identify and categorize malware variations to maintain the security of computer systems. Malware poses a continuous threat to digital information and system integrity, hence the need for effective detection tools. The second objective is to propose a new incremental learning method. This method is designed to adapt over time, continually incorporating new data, which is crucial for identifying and managing multiclass malware variants. Methods: This study utilised an incremental learning technique as the basis of the approach, a type of machine learning whereby a system retains previous knowledge and builds upon the information from the newly acquired data. Particularly, this method is suitable for tackling mutating character of malware dangers. The researchers used various sets of actual world malwares for evaluating the applicability of these ideas which serves as an accurate test environment. Findings: The findings of the research are significant. We utilizing 6 different datasets, which included 158,101 benign and malicious instances, the method demonstrated a high attack detection accuracy of 99.34%. Moreover, the study was successful in identifying a new category of malware variants and distinguishing between 15 different attack categories. These results underscore the effectiveness of the proposed incremental learning method in a real-world scenario. Novelty: This research is unique because of the novel use of a tailored incremental learning technique for dealing with dynamic threat environment of malwares. However, with a new threat they cannot be so well adapted using traditional machine learning methods. On the other hand, the technique put forward in this paper facilitates continuous learning that can be modified to match different types of malicious software as they develop. The ability to evolve and adapt is an important addition to current cybersecurity practices that include malware identification and classification. Keywords: Cybersecurity, Malware Detection, Incremental learning

TV-ADS: A Smarter Attack Detection Scheme Based on Traffic Visualization of Wireless Network Event Cell

<p>To protect the increasing cyberspace assets, attack detection systems (ADSs) as well as intrusion detection systems (IDSs) have been equipped in various network environments. Recently, with the development of big data, machine learning, deep learning, neural networks and other artificial intelligence (AI) technologies, more and more ADSs/IDSs based on Artificial Intelligence are presented in academia and industry. Particularly, depending on the outstanding performance and efficiency in recognizing and classifying images, computer vision algorithms have been employed to detect malicious software and malicious traffic. However, we found that in wireless networks, the results vary significantly depending on the mapping methods used to transform the original network traffic data into visual images. Therefore, in this paper, we propose an AI-based attack detection scheme (TV-ADS) by introducing a novel traffic-image mapping method, which segments the sequential network traffic into individual event cells and transforms variant images to a uniform standard size, and design a CNN model to recognize normal and malicious traffics with these visible network event images. Finally, the results of our experiments on the AWID3 dataset demonstrate that our TV-ADS outperforms the existing schemes in terms of accuracy, precision, recall, F1-score and efficiency.</p> <p> </p>

WORM-VIRUS DETECTION METHOD ACCORDING TO MULTI-CLASS CLASSIFICATION

The work presents the results of research on worm viruses and methods of their detection. Malware distribution happens all the time. The analyzed modern tools and systems for prevention, detection and countermeasures against malicious software and computer attacks are quite effective, provide a high percentage of detection and function at an adequate level. But criminals constantly study the capabilities of such tools and systems, improve malicious software and computer attacks, and achieve certain results. Therefore, developers of tools and systems for prevention, detection and countermeasures against malicious software and computer attacks must constantly improve them. The protection of corporate networks is relevant. They can be effectively configured to increase computing resources when solving the tasks of warning, detecting and countering malicious software and computer attacks to protect corporate networks. Therefore, the article defines as an urgent scientific task - the development of methods to improve the efficiency of the functioning of distributed systems with partial centralization for detection of malicious software and computer attacks in computer networks and detection of malicious software with their use due to the synthesis of their architecture in such a way that the principles of functioning of such systems make it difficult for criminals to understand them. The work considers a set of worm viruses, which covers network features as much as possible. Therefore, to study the effectiveness of methods of creating distributed systems and the systems themselves based on them, worm viruses were considered. The purpose of the work is to develop a method for detecting worm viruses in corporate networks. The work developed a method of detecting worm viruses using their division into classes based on common features and defined criteria according to the classification of objects according to many classes and taking into account its implementation in the architecture of partially centralized distributed systems to obtain a complete sensor and make a decision regarding the classification of worms virus to a certain class. This improved the reliability of detection by 8-11% compared to using the method without directly involving the elements and components of the system. As a result of setting up experiments and conducting them, results were obtained that confirm the correct functioning of a partially centralized distributed system for the detection of worm viruses.