Malware Outbreaks Research Articles

Modeling of Malware Propagation Under the Clustering Approach in Scale‐Free Networks

ABSTRACTIn this paper, we present an innovative malware propagation model that combines epidemic spread and clustering techniques, specifically designed for scale‐free networks. The proposed model builds upon the susceptible–exposed–infected–recovered (SEIR) framework, effectively simulating the dissemination of malware across the network. Our research demonstrates a notable reduction in the rate of malware transmission compared to the traditional SEIR model, with this improvement in containment being attributed to the incorporation of clustering methodologies. We also calculate the basic reproduction ratio (R0) for the proposed model, which offers valuable insights into the potential consequences of malware outbreaks within the network. By exploring variations in key parameters, we deepen our understanding of the model's behavior under different conditions. Furthermore, we evaluate the role of clustering in mitigating malware spread, highlighting its significant effectiveness in reducing the overall impact of infections.

Enhanced Malware Detection Using Grey Wolf Optimization and Deep Belief Neural Networks

Standard identification methods are flattering and less effective as attacks from malware get increasingly sophisticated. Considering current malware outbreaks employ tactics such as polymorphism, obfuscation and encryption, to avert identification, growing complicated approaches must be developed. This paper deals with a mixed model utilizing Deep Belief Neural Network (DBNN) for classifying and Grey Wolf Optimization (GWO) for choosing features. Whereas DBNN encodes complicated patterns by hierarchical learning, GWO optimizes the choosing of the more essential features, lowering the cost of computing and dataset complexity. Investigations reveal that the suggested GWO-DBNN model beats existing machine learning procedures in terms of detection accuracy, recall, precision, and false positive rate (FPR). These mixed tactics offer dependable and scalable solutions to the challenges faced by modern malware threats.

Enhanced Malware Detection Using Grey Wolf Optimization and Deep Belief Neural Networks

Standard identification methods are flattering and less effective as attacks from malware get increasingly sophisticated. Considering current malware outbreaks employ tactics such as polymorphism, obfuscation and encryption, to avert identification, growing complicated approaches must be developed. This paper deals with a mixed model utilizing Deep Belief Neural Network (DBNN) for classifying and Grey Wolf Optimization (GWO) for choosing features. Whereas DBNN encodes complicated patterns by hierarchical learning, GWO optimizes the choosing of the more essential features, lowering the cost of computing and dataset complexity. Investigations reveal that the suggested GWO-DBNN model beats existing machine learning procedures in terms of detection accuracy, recall, precision, and false positive rate (FPR). These mixed tactics offer dependable and scalable solutions to the challenges faced by modern malware threats.

A Scalable Malware Detection Approach through Significant Permission Identification for Android Devices

The global ubiquity of smartphones has led to the availability of many free apps for gaming, communication, financial, and educational needs. However, hazardous malicious software targeting smartphones has increased as the global adoption of these devices has grown. Malware is growing rapidly, with reports predicting a new Android app every 10 seconds, threatening the mobile ecosystem. Due to Android's versatility, users can install apps from third-party app shops and file-sharing websites, compounding malware outbreaks. The seriousness of this situation requires scalable malware detection. Based on permission usage analysis, this project introduces Significant Permission Identification (SigPID), a novel malware detection technique. SigPID uses a three-tiered permission pruning mechanism to discover the most important permissions for distinguishing benign from malicious apps, unlike standard methods that scan all Android permissions. The system first uses the Random Forest method for machine learning classifications. The study reduces non-sensitive permissions by identifying benign and harmful permission lists. Support Vector Machine classification, K-Nearest Neighbor, and Linear Regression are then used to a fresh dataset. SigPID, written in Python 3.7, is a powerful and scalable Android malware countermeasure. SigPID uses advanced machine learning and large permissions to protect the mobile ecosystem from harmful apps, making it safer and more secure.

Modeling and analyzing malware propagation Over wireless networks based on hypergraphs

Malware posts an increasing threat to the security of cyberspace, given the growing popularity of wireless networks. In this paper, we propose a hypergraph-based model to describe the malware propagation over a large-scale wireless network, where the hypergraph adequately describes the limited range and Internet-independent transmission over the wireless network. In the proposed model, the malware on an infected device will attack the wireless router and infect all normal devices on the wireless network. From a heterogeneous mean-field approach, we obtain the malware outbreak threshold. Through theoretical analysis and numerical simulations, we show that the malware pandemic on large-scale wireless networks depends mainly on the number of devices covered by the wireless network and the nature of the malware. Moreover, we find that isolating connections on the Internet does not completely inhibit the malware pandemic. These phenomena are also reflected in the hypergraph constructed from real data. We demonstrate that heterogeneous distributions of devices on wireless networks can lead to malware outbreaks more easily. Finally, we show that malware propagation on large-scale wireless networks is more sensitive to the number of initially infected devices compared to the propagation on the Internet.

Modeling and Control of Malware Propagation in Wireless IoT Networks

Wireless Internet of Things (IoT) devices densely populate our daily life, but also attract many attackers to attack them. In this paper, we propose a new Heterogeneous Susceptible-Exposed-Infected-Recovered (HSEIR) epidemic model to characterize the effect of heterogeneity of infected wireless IoT devices on malware spreading. Based on the proposed model, we obtain the basic reproduction number, which represents the threshold value of diffusion and governs that the malware is diffusion or not. Also, we derive the malware propagation scale under different cases. These analyses provide theoretical guidance for the application of defense techniques. Numerical simulations validated the correctness and effectiveness of theoretical results. Then, by using Pontryagin’s Minimum Principle, optimal control strategy is proposed to seek time-varying cost-effective solutions against malware outbreaks. More numerical results also showed that some control strategies, such as quarantine and vaccination, should be taken at the beginning of the malware outbreak immediately and become less necessary after a certain period. However, the repairing and fixing strategy, for example applying antivirus patches, would be keep on going constantly.

Safeguarding the IoT From Malware Epidemics: A Percolation Theory Approach

The upcoming Internet of Things (IoT) is foreseen to encompass massive numbers of connected devices, smart objects, and cyber-physical systems. Due to the large scale and massive deployment of devices, it is deemed infeasible to safeguard 100% of the devices with state-of-the-art security countermeasures. Hence, large-scale IoT has inevitable loopholes for network intrusion and malware infiltration. Even worse, exploiting the high density of devices and direct wireless connectivity, malware infection can stealthily propagate through susceptible (i.e., unsecured) devices and form an epidemic outbreak without being noticed to security administration. A malware outbreak enables adversaries to compromise a large population of devices, which can be exploited to launch versatile cyber and physical malicious attacks. In this context, we utilize spatial firewalls, to safeguard the IoT from malware outbreak. In particular, spatial firewalls are computationally capable devices equipped with state-of-the-art security and anti-malware programs that are spatially deployed across the network to filter the wireless traffic in order to detect and thwart malware propagation. Using tools from percolation theory, we prove that there exists a critical density of spatial firewalls beyond which malware outbreak is impossible. This, in turn, safeguards the IoT from malware epidemics regardless of the infection/treatment rates. To this end, a tractable upper bound for the critical density of spatial firewalls is obtained. Furthermore, we characterize the relative communications ranges of the spatial firewalls and IoT devices to ensure secure network connectivity. The percentage of devices secured by the firewalls is also characterized.

Enforcing situation-aware access control to build malware-resilient file systems

Traditional non-semantic file systems are not sufficient in protecting file systems against attacks, either caused by ransomware attacks or software-related defects. Furthermore, outbreaks of new malware often cannot provide a large quantity of training samples for machine-learning-based approaches to counter malware campaigns. The malware defense system should aim to achieve the best balance between early detection and detection accuracy. In this paper, we present a situation-aware access control framework to work with existing file systems as a stackable add-on. Our framework enables the access control decision making to be deferred when required, to observe the consequence of such an access request to the file system and to roll back changes if required. As an application against ransomware attacks, it can be applied to preserve file content integrity, by enforcing that all binary files written to the file system have consistent internal file structures with the declared file types, and rolling back changes that violate such constraints. We envision our access control framework to complement existing operating system access control frameworks, to significantly reduce the dimension of data required for machine learning, and to build extra resilience into the operating systems against damages caused by either malware or software defects. We demonstrate the practicality of our framework through a prototype testing, capturing relevant ransomware situations. The experimental results along with a large ransomware dataset show that our framework can be effectively applied in practice.

Advanced malware propagation on random complex networks

In this work a novel model to simulate advanced malware spreading is introduced and analyzed. It is an individual-based model such that the dynamics of the malware outbreak is governed by means of a cellular automaton. The network topologies considered are complex random networks and each device is endowed at every step of time with one of the following possible states: susceptible, infected, attacked and recovered. A study analyzing the influence of topology variability and the structural characteristics of initially infected devices is done.

Predicting the Spread of Malware Outbreaks Using Autoencoder Based Neutral Networks

Malware Outbreaks are pervasive in today's digital world. However, there is a lack of awareness on part of general public on how to safeguard against such attacks and a need for increased cooperation between various national and international research as well as governmental organizations to combat the threat. On the positive side, cyber security websites, blogs and newsletters post articles outlining the working and spread of a malware outbreak and steps to recover from the same as well. In this project, an effective approach to predicting the spread of malware outbreaks is presented. The scope of the project is 15 Malware Outbreaks and the approach involves collecting these cyber aware articles from the web, assigning them to the 15 Malware Outbreaks using Topic Modeling and Similarity Analysis and along with Spread information of the Malware Outbreaks, this is input to auto encoder neural network for learning latent space representations which are further used to predict the spread of malware outbreak as either high or low spread outbreak, achieving a prediction accuracy of 75.56. This work can be used to process large amount of cyber aware content for effective and accurate prediction in the era of much-needed cyber security.

Cyber resilience recovery model to combat zero-day malware attacks

This paper presents the implementation of an epidemiological model to combat a zero-day outbreak within a closed network. The proposed dynamic Cyber Resilience Recovery Model (CRRM) is used to combat the simulated outbreak and minimize disruptions to business operations. CRRM combines the National Institute of Standards and Technology Special Publication 800-61 incident response life cycle and Susceptible-Infected-Quarantined-Recovered epidemiological model. It provides insights into the strengths and weaknesses of current recovery processes and presents possible solutions for addressing changing cybersecurity threats. Evaluation results demonstrate that CRRM accurately simulates malware outbreaks on a network and has the potential to serve as a valuable tool for supporting decision-making and technological investments that improve cyber resilience.

Combinatorial detection of malware by IAT discrimination

While most of the detection techniques used in modern antivirus software need frequent and constant update (engines and databases), modern malware attacks are processed and managed efficiently only a few hours after the malware outbreak. This situation is especially concerning when considering targeted attacks which usually strike targets of high criticity. The aim of this paper is to present a new technique which enabled to detect (binary executable) malware proactively without any prior update neither of the engine nor of the relevant databases. By considering a combinatorial approach that focuses on malware behavior by synthetizing the information contained in the Import Address Table, we have been able to detect unknown malware with a detection probability of 98 % while keeping the false positive rate close to 1 %. This technique has been implemented in the French Antivirus Software Initiative (DAVFI) and has been intensively tested on real cases confirming the detection performances.

Modeling the spread of malware with the influence of heterogeneous immunization

The immunities of computers against malware are actually heterogeneous depending upon the level of secure protection, which is largely determined by the security awareness of users. To understand the effects this can have on the propagation of malicious software, we herein develop a new compartmental model that takes into account heterogeneous immunization of the computer. In terms of protection levels, the traditional susceptible compartment is newly separated into two sub-compartments, weakly-protected and strongly-protected. Besides, our model includes two assumptions: a computer immediately possesses infectivity once it is infected by malware, and weakly-protected susceptible computers have a higher infection rate than strongly-protected susceptible computers. Appropriate Lyapunov functions are introduced to fully analyze the qualitative properties of this model. Specifically, it is proved that the malware-free equilibrium is globally asymptotically stable if the threshold is below unit, whereas the malware equilibrium is globally asymptotically stable if the threshold is above unit. Furthermore, the sensitivity of each parameter on the model’s threshold is also analyzed. Through numerical simulations, a collection of effective measures for controlling malware spread is proposed, such as keeping as many systems strongly-protected as possible. These findings suggest that the security awareness of users should be taken both in the interpretation of malware parameters, as well as in the prediction of the evolution of future malware outbreaks.

An Improved the Optimal Distributed Dummy Signature for Malicious Software in Mobile Network

Now a day the world is mobile and internet oriented, each and every person must have the both of things. While in using the mobile and internet we have to face many problems such as malware attacks in while in sending and receiving message. We consider a malware attack in sending an MMS and Bluetooth. We found many problems while sending message we used distributed algorithm and dummy signature to protect the message from malware [3].In mobile network malware attacks frequently occur while sending and receiving information [2]. Develop an efficient system to protect infection and infected nodes to recover and produce dummy signature to overcome of spreading and outbreaks of malware [1]. We found that the problem is how to optimally distribute contentbased signature of malware, that help to detect malware and disable further propagation to minimize the no of infected nodes[4]. we can go through two different approaches 1. MMS 2. Bluetooth. In MMS a malware send a copy of itself to all devices whose numbers are found in address book of infected device. We use optimal distributed solution to efficiently avoid malware spreading and apply dummy signature to help infected nodes to recover [1].

Data leakage triage: quantitative measure of effectiveness of containment plan

Increasingly organisations' deployed security defences are challenged by persistent malware attacks. There are many risks induced by successful malicious assaults against an organisation. One of the significant risks is data leakage. This risk has significant impacts to organisations and nations. To mitigate the likely occurrence of such risk, adequate preparation and response are needed. Epidemiological modelling of such malware outbreaks can aid in the development of mitigation plans. Most of these models used the number of infected hosts or time duration to analyse malware behaviours or the effectiveness of response plan. This paper proposes an extension of the agent-based malware containment model AMCM to provide a quantitative measurement of the amount of data leakage from malware infected hosts in order to evaluate the effectiveness of the response containment plan. It is believed that this form of measurement will enhance the preparation of incident response plans to deal with malware outbreak.

An agent-based model to simulate coordinated response to malware outbreak within an organisation

Malware is a major threat to organisations. It affects business continuity and induces risks to organisations. Current anti-malware solutions are challenged to keep the risks at bay. When a malware manages to penetrate an organisation's defences, there is a need to quickly contain the malware and to keep control over the organisation's IT assets before the risk escalates. In such incident, incident responders need to effectively carry out their containment plan. An ineffective containment plan will induce greater risks. Such infiltration can spread like a biological epidemic outbreak. These epidemic-like outbreaks can be modelled using mathematical models. However there are no models to assess the effectiveness of incident response plan. Additionally, there are many variable considerations that the incident response plan would need to factor in. This research paper proposes the use of an agent-based model to model containment response plan to minimise the impact of a malware outbreak.

Maximum Damage Battery Depletion Attack in Mobile Sensor Networks

Developing reliable security measures against outbreaks of malware will facilitate the proliferation of wireless sensing technologies. The first step toward this goal is to investigate potential attack strategies and the extent of damage they can incur. The malware at each infective node may seek to contact more susceptible nodes by amplifying the transmission range and the media scanning rate and thereby accelerate its spread. This may however lead to (a) easier detection of the malware and thus more effective counter-measure by the network, and (b) faster depletion of the battery which may in turn thwart further spread of the infection and/or exploitation of that node. We assume the viewpoint of the malware and cast the problem of dynamically selecting the transmission range and media access rate of the infective nodes as an optimal control problem. We utilize Pontryagin's maximum principle to find an optimum solution, and prove that the maximum damage can be attained using simple three-phase bang-bang strategies.

Cybercrimes Pose Growing Threat to Medical Devices

Securing medical devices against cyberattacks or malware outbreaks and safeguarding protected health information (PHI) stored on devices or exchanged between a device and the provider’s network is a growing challenge for clinical engineers and hospital information technology (IT) professionals. 1 This article will analyze two general trends with regard to their impact on a medical device security strategy: first, the increased exposure and vulnerability through the growing number of devices connected to a network, and, second, the changes in the cyberthreat landscape. Threats are becoming more prevalent, complex, and sophisticated, and are being driven by a cybercrime culture that is moving away from sensationalism to targeted attacks based on financial motivation. 2 A medical device, in the context of this article, is any network-connected system used in patient care in a hospital, private office, home, or other healthcare setting, and which, due to its usage model, operating system, configuration, and network communications, can be exposed to cyberthreats—for example, through a permanent or intermittent network connection or through “sneakernet,” a term that describes the transfer of electronic information by physical means, such as a USB or universal serial bus, device.

Markov Random Fields for Malware Propagation: The Case of Chain Networks

Epidemic and stochastic models have been employed for describing the dynamic behavior of malware outbreaks. However, most of them lack a holistic treatment of the problem. In this work, we model malware propagation as a Markov Random Field and employ Gibbs sampling for the analysis of the system. We demonstrate the proposed framework for the case of a chain network, a model often emerging in both wired and wireless multi-hop networks.

Optimal propagation of security patches in mobile wireless networks

Reliable security measures against outbreaks of malware is imperative to enable large scale proliferation of wireless technologies. Immunization and healing of the nodes through dissemination of security patches can counter the spread of a malware upon an epidemic outbreak. The distribution of patches however burdens the bandwidth which is scarce in wireless networks. The trade-offs between security risks and resource consumption can be attained by activating at any given time only fractions of dispatchers and dynamically selecting their packet transmission rates. We formulate the above trade-offs as an optimal control problem that seek to minimize the aggregate network costs that depend on security risks and resource consumed by the countermeasures. Using Pontryagin's maximum principle, we prove that the dynamic control strategies have simple structures. When the resource consumption cost is concave, optimal strategy is to use maximum resources for distribution of patches until a threshold time, upon which, the patching should halt. When the resource consumption cost is convex, the above transition is strict but continuous.