Malware Prevention Research Articles

Image-based malware analysis for enhanced IoT security in smart cities

To develop safer smart city solutions, it is crucial to investigate new technologies for malware analysis and detection to enhance existing malware prevention systems. Deep learning (DL) techniques have surpassed conventional machine learning as the dominant method for network security; therefore, it is crucial for researchers to utilise DL techniques to address the velocity, volume, and complexity of modern malware, as these approaches can effectively handle large amounts of data and extract representative information robustly. This study investigates the application of deep learning techniques, specifically different autoencoders (AEs), to improve malware analysis and prevention in Internet of Things (IoT)-based smart cities. This research evaluates different convolutional neural network based AE structures and aims to establish a robust malware analysis method by focusing on image classification. By experimenting on both greyscale and RGB malware imagery datasets, it has been demonstrated that variational AE can not only detect nearly all malware but also illustrate the generalisability and efficacy of AE in addressing malware threats. The study systematically evaluates different AE configurations, and this comparative analysis can inspire further research into deep learning techniques for IoT security measures.

African Vulture Optimization-Based Decision Tree (AVO-DT): An Innovative Method for Malware Identification and Evaluation through the Application of Meta-Heuristic Optimization Algorithm

Abstract Malware remains a big threat to cyber security, calling for machine learning-based malware detection. Malware variations exhibit common behavioral patterns indicative of their source and intended use to enhance the existing framework’s usefulness. Here we present a novel model, i.e., African Vulture Optimization-based Decision Tree (AVO-DT) to increase the overall optimization. The datasets from Android apps and malware software train the AVO-DT model. After training, the datasets are pre-processed by removing training errors. The DT algorithm is used by the developed AVO model to carry out the detection procedure and predict malware activity. To detect malware activities and improve accuracy, such an AVO-DT model technique employs both static and dynamic methodologies. The other measurements on Android applications might be either malicious or benign. Here we also developed malware prevention and detection systems to address ambiguous search spaces in multidimensionality difficulties and resolve optimization challenges.

Malware and Windows APIs: A Dangerous Duo

This paper introduces its interaction with malware and Windows APIs (application programming
 interface). The first section describes malware and investigates various types such as viruses, worms
 and trojans, as well as provides a brief history of malware and its evolution. The second section
 provides an overview of the Windows APIs. It shows how these interfaces allow software and
 operating systems to communicate with each other. It also highlights the most commonly used
 Windows APIs and their functions۔ The follow-up section explores how malware uses Windows
 APIs for malicious purposes، Explains the common methods used by malware to communicate with
 these interfaces۔ Includes real-world examples of malware attacks that use some Windows APIs. The
 study then turns its attention to the Windows API security mechanism, given the security measures
 taken by Windows to prevent the use of unauthorized APIs۔ The importance of user account control
 (UAC) and various monitoring and access control systems has been highlighted. The next section
 introduces the API Hoking and its application to malware. Which explains the strategies used by
 malware to hook Windows APIs۔ The effects of API hooking and possible detection methods are also
 discussed. This article provides an in-depth overview of real-world malware that exploits Windows
 APIs through case studies and analysis. Notable malware analyzes examples using family and
 API-based attacks۔ The article discusses security tools and ways to identify and block API-based
 malware, as well as how to design secure programs with Windows APIs Suggestions for this have
 also been discussed. Finally, malware tactics targeting Windows APIs discuss potential trends and
 issues, as well as expected API security challenges in the Windows context. This study continues to
 look at advances in Windows API security and their implications for malware prevention.

Detection and Prevention of Malware in Android Mobile Devices: A Literature Review

Detection and Prevention of Malware in Android Mobile Devices: A Literature Review

A Spectrum Injection-Based Approach for Malware Prevention in UHF RFID Systems

A Spectrum Injection-Based Approach for Malware Prevention in UHF RFID Systems

Fileless malware threats: Recent advances, analysis approach through memory forensics and research challenges

The rapid advancements in cyber-attack strategies are in parallel with the measures for detection, analysis, and prevention. Attackers have recently developed fileless malware that can simply bypass existing security mechanisms. Researchers publish reports to help discover fileless malware and to better understand the threatʼs scope to counteract it. However, with the lack of studies on fileless malware regarding the classification and the scale of the threat, they have not been thoroughly analyzed. As a result, in this research, we explored the most recent advancements in fileless malware prevention and detection and highlighted future research challenges. We also propose an analytical approach based on the attack strategies and attributes of the selected sample. Our method simplifies feature extraction and reduces processing load. Furthermore, compared to the static analysis we do not need for decompression and unpacking for the analysis. We applied the proposed method on a real case example. It has been seen that information about fileless malware detection, working mechanism, attack method and attacker named “Kovter” can be accessed. Our approach is advantageous and can be applied as a new technique for fileless malware detection to protect systems from cyber threats. This paper also presents an insight to the fileless malware threat and provides a basic review of the methods and techniques used in the detection and analysis of fileless malware attacks.

A Comprehensive Review of Android Security: Threats, Vulnerabilities, Malware Detection, and Analysis

The popularity and open-source nature of Android devices have resulted in a dramatic growth of Android malware. Malware developers are also able to evade the detection methods, reducing the efficiency of malware detection techniques. It is hence desirable that security researchers and experts come up with novel and more efficient methods to analyze existing and zero-day Android malware. Most of the researchers have focused on Android system security. However, to examine Android security, with a specific focus on malware development, investigation of malware prevention techniques and already known malware detection techniques needs a broad inclusion. To overcome the research gaps, this paper provides a broad review of current Android security concerns, security implementation enhancements, significant malware detected during 2017–2021, and stealth procedures used by the malware developers along with the current Android malware detection techniques. A comparative analysis is presented between this article and similar recent survey articles to fill the existing research gaps. In the end, a three-phase model is proposed to efficiently identify and characterize Android malware. In the first phase, a lightweight deep transfer learning approach is used to classify Android applications into benign and malicious. In the second phase, the malicious applications are executed in a virtual emulator to reduce the number of false positives. Finally, the malicious applications having the same characteristic ratio are grouped into their corresponding families using the topic modelling approach. The proposed model can efficiently detect, characterize, and provide a familial classification of Android malware with a good accuracy rate.

The Predicting and Prevention of Malware from Cyber Hacking Breaches in Online Social Network

Abstract: Analyzing cyber incident information units is an essential approach for deepening our information of the evolution of the risk situation. This is a notably new studies topic, and plenty of research continue to be to be done. In this paper, we record a statistical evaluation of a breach incident information set similar to 12 years (2005–2017) of cyber hacking sports that encompass malware attacks. We display that, in evaluation to the findings suggested withinside the literature, each hacking breach incident inter-arrival instances and breach sizes need to be modeled through stochastic processes, instead of through distributions due to the fact they show off autocorrelations. Then, we recommend specific stochastic method fashions to, respectively, match the inter-arrival instances and the breach sizes. In this paper we be aware that, through reading their actions, we are able to classify malware right into a small quantity of Behavioral classes, every of which plays a restrained set of misbehaviors that signify them. These misbehaviors may be described through tracking capabilities belonging to exclusive platforms. In this paper we gift a singular host-primarily based totally malware detection machine in OSN which concurrently analyzes and correlates capabilities at 4 levels: kernel, application, person and package, to come across and prevent malicious behaviors. It has been designed to do not forget the ones behaviors traits of virtually each actual malware which may be observed withinside the wild. This prototype detects and efficaciously blocks greater than 96% of malicious apps, which come from 3 massive datasets with approximately 2,800 apps, through exploiting the cooperation of parallel classifiers and a behavioral signature-primarily based totally detector. Keywords: Cyber security, Malware, Emerging technology trends, Emerging cyber threats, Cyber attacks and countermeasures

Detection and Prevention of Malware in Android Operating System

The Internet is not safe anymore, malware can be discovered anywhere on the Internet. The risk of malware has increased also due to the increasing popularity and use of Smartphones and their underlying cost-free applications. With its great market share, the Android operating system has become a prime target for malware developers. When an Android phone is injected with a malware, it may result in compromising the privacy of the user by stealing sensitive and private information like contacts, ids, passwords, photos, call records, and so on. Compared to any other Android-based application category, games are the most preferred zone for attackers, due to the high interest of users in game applications. When an end user downloads a game, which is injected with malicious code, user data is infected without bringing in the knowledge of the user. Though, there still are not sufficient protection mechanisms or guidelines stated for end user against Android malware, this study offers a novel approach to detect Android malware in order to ensure the safe usage of Android applications. The advantage of this approach is its ability to utilize Android manifest files for the detection of malware. The availability of manifest file in every Android application makes this approach applicable to all Android applications. It can also be considered as a lightweight method for malware detection, and its efficiency is experimentally confirmed by testing and comparing the results of 50 Android games samples. Experiments are carried out using the Android Package Kit (APK) tools, and based on the experiments, different kinds of malware identification and prevention guidelines have been proposed for the safe and secure usage of the Android operating system.

AIRP: A system-based selection of adaptive intrusion recognition and prevention

Machine learning techniques became a common feature of intrusion detection systems, enabling real-time responses and learning and adaptation. A well-trained model can be developed to enhance intrusion detection efficiency by using a detailed data set of many attack styles. However, for machine learning methods, high dimensional data poses an essential challenge. The processing of related features offering redundancies improves device time, which is a crucial issue for consumers with minimal resources such as battery, electricity and more. In this article we propose the Trust Malware Prevention and Precision System and the trust-based Secure Network intruder classification and prediction system. Based on a new function discovery algorithm, this reduces the number of functions in the data entry. The functions were originally randomly clustered to maximise the possibility that they would be included in the production of separate collections and organised depending on their exactness. Only the high classification functions are then chosen for any packet obtained in a network that is saved as part of the past output of the node. AIRP recommends regular machine cleaning, which evaluates and regularly renews the confidence relationships of participant nodes. AIPR gives the exact time for nodes cleaning states and limits the exposure window of nodes by offering a complex algorithm. For the final rating judgement for both models, the past behaviour of the node with the learning algorithm is determined. Any attack observed decreases the efficiency of the involved nodes and contributes to complex cleaning of the device. An appraisal using the NSLKDD and UNSW data sets reveals that both models can identify malicious activities with higher precision, detective frequencies and false alerts that offer less than state-of-the-art approaches. Accordingly, with strong defectiveness and false alarm frequency, AIRP is even better than state-of-the-art technology. • Confidence Intrusion Detection and Accuracy System and the Trust based Intrusion Identification and Classification System for Secure Network. • Only the high classification functions are then chosen for any packet obtained in a network that is saved as part of the past output of the node. • AIRP recommends regular machine cleaning, which evaluates and regularly renews the confidence relationships of participant nodes. • AIPR gives the exact time for nodes cleaning states and limits the exposure window of nodes by offering a complex algorithm. • The consistency detection for AIRP, for example, is 81% for UnSW, 83.47% for AODE online, 88% for Cadf, 90% for EDM, 80% for TANN and 72.6% for NB.

Cybersecurity and Cyber Forensics: Machine Learning Approach

The proliferation of cloud computing and internet of things has led to the connectivity of states and nations (developed and developing countries) worldwide in which global network provide platform for the connection. Digital forensics is a field of computer security that uses software applications and standard guidelines which support the extraction of evidences from any computer appliances which are perfectly enough for the court of law to use and make a judgment based on the comprehensiveness, authenticity and objectivity of the information obtained. Cybersecurity is of major concerned to the internet users worldwide due to the recent form of attacks, threat, viruses, intrusion among others going on every day among internet of things. The aim of this work is make a systematic review on the application of machine learning algorithms to cybersecurity and cyber forensics, systematic survey method was used on recent application of machine learning algorithms on cyber forensics and cyber security based on this findings it is observed that cybersecurity is based on confidentiality, integrity and validity of data, it is also noted that there are ten steps to cybersecurity; network security, user education and awareness, malware prevention, removable media control, secure configuration, managing user privileges, incident management, monitoring and home and mobile working and pave away for further research directions on the application of deep learning, computational intelligence, soft computing to cybersecurity and cyber forensics.

English

English

Spatially Clustered Autonomous Vehicle Malware: Producing New Urban Geographies of Inequity

Malicious software (malware) is both a hurdle to autonomous vehicle (AV) adoption and a serious threat to AV occupant safety. Yet, to date, the topic of how subnational transportation decision makers should handle this cybersecurity threat has been underexplored. This paper describes how malware can spread through vehicle-to-X networks and infect AVs to a non-technical planning audience. It then explains how AV malware can cluster spatially in linguistic, socioeconomic, and political enclaves of American cities. Since AVs can identify new indicators of safety imperceptible to humans, malware clusters can produce new geographies of accessibility, mobility, economic, and environmental inequity across a city. In provisioning the inherently localized technical malware prevention tools available to them, subnational transportation planners have the capacity to reproduce or overcome historical and current transportation system inequities.

Security Technique in Mobile Clouds to Ensure Malware Prevention

Objectives: Major privacy issues in Mobile Cloud Computing (MCC) environment such as security of data are focused in this research. Methods/Statistical Analysis: Two major issues relating to the MCC, first issue is that the owners have no full control over the infra-structure. Therefore, they set up their own methods to control data security and make it reliable. Secondly, the cloud owners have maximum rights because cloud owners can change and manage the user’s system and also make use of their data by implementing their rights. State the methodology adapted to meet your objectives. Findings: This study shows how data can be kept in confidentiality by maintaining necessary consistent relations in cloud. Prevention from Malware Technique is also being discussed that makes it probable for data to be compressed and encrypted by using a variety of keys prior to uploading on the cloud. It is uploaded in such a way that ending data could be decrypted and de compressed by a single key. Application/Improvements: The planed scheme empowers the user in performing utmost computation comprehensively and storage jobs which keep the users away from revealing the data guts and the personal/private information of users. Keywords: Malware Prevention, Mobile Cloud, Security Technique, Threats

Detection and Prevention of Botnets and Malware in Large Scale Network Topology

Detection and Prevention of Botnets and Malware in Large Scale Network Topology

An Immunization Framework for Social Networks Through Big Data Based Influence Modeling

Social networks are critical in terms of information or malware propagation. However, how to contain the spreading of malware in social networks is still an open and challenging issue. In this paper, we propose a novel defending method through big data based influence modeling. We first establish a social interaction graph based on big data sets of the studied object. Based on the graph, we are able to measure direct influence of individuals by computing each node's strength, which includes the degree of the node and the total number of messages sent by each user to her friends. Then, we design an algorithm to construct influence spreading tree using the breadth first search strategy, and measure indirect influence of individuals by traversing the tree. We identify the top $k$ k influential nodes among all the nodes via the social influence strength, and propose an immunization algorithm to defend social networks against various attacks. The extensive experiments show that influence can spread easily in social networks, and the greater the influence of initial spread node is, the more impact it is on the malware propagation in social networks. The proposed method provides an effective solution to the prevention of malware or malicious messages propagation in social networks.

A Survey on Malware Propagation Analysis and Prevention Model

In recent years, the security threats imposed by email-based malware, modeling the propagation analysis and prevention of email malware becomes a fundamental technique for predicting its potential damages and developing effective countermeasures. Compared to earlier versions of mail malware, modern email malware exhibits two new features. One is reinfection and another one is self-start. In reinfection, whenever any healthy or infected recipients open the malicious attached file the modern email malware sends its copy to the recipients contact. In self-start, whenever compromised computers restart or malicious files are visited the malware spreads over the system. To avoid these types of issues the security specialists use some of the possible techniques and methods to stop and remove the threats. At the same time the malware developers exploit new malware that bypass implemented security features. In this paper, we analyzed the malware propagation and detecting mechanisms. This survey paper highlights the existing detection and analysis methodologies used for these malicious code.

Tap-Wave-Rub: Lightweight Human Interaction Approach to Curb Emerging Smartphone Malware

Malware is a burgeoning threat for smartphones and continuing advancing. Traditional defenses to malware, however, are not suitable for smartphones due to their resource intensive nature. This necessitates the design of novel mechanisms that can consider the specifics of the smartphone malware and smartphones themselves. In this paper, we introduce a lightweight permission enforcement approach-Tap-Wave-Rub (TWR)-for smartphone malware prevention. TWR is based on simple cyber-physical human interactions, i.e., human gestures, that are very quick and intuitive but less likely to be exhibited in users' daily activities. Presence or absence of such gestures, prior to accessing an application, can effectively inform the OS whether the access request is benign or malicious. In particular, we present the design of two mechanisms: 1) acceleration-based phone tapping detection and 2) proximity-based finger tapping, rubbing, or hand waving detection. The first mechanism is geared for near field communication applications, which usually require the user to tap her phone with another device. The second mechanism involves very simple gestures, i.e., tapping or rubbing a finger near the top of phone's screen or waving a hand close to the phone, and broadly appeals to many applications (e.g., SMS). In addition, we present the TWR-enhanced Android permission model, the prototypes implementing the underlying gesture recognition mechanisms, and a variety of novel experiments to evaluate these mechanisms. Our results suggest the proposed approach could be very effective for malware detection/prevention, with quite low false positives and false negatives, while imposing little to no additional burden on the users.

Mobile application security: malware threats and defenses

Due to the quantum leap in functionality, the rate of upgrading traditional mobile phones to smartphones is tremendous. One of the most attractive features of smartphones is the availability of a large number of apps for users to download and install. However, it also means hackers can easily distribute malware to smartphones, launching various attacks. This issue should be addressed by both preventive approaches and effective detection techniques. This article first discusses why smartphones are vulnerable to security attacks. Then it presents malicious behavior and threats of malware. Next, it reviews the existing malware prevention and detection techniques. Besides more research in these directions, it points out efforts from app developers, app store administrators, and users, who are also required to defend against such malware.

A Survey on Malware Propagation Analysis and Prevention Model

In recent years, the security threats imposed by email-based malware, modeling the propagation analysis and prevention of email malware becomes a fundamental technique for predicting its potential damages and developing effective countermeasures. Compared to earlier versions of mail malware, modern email malware exhibits two new features. One is reinfection and another one is self-start. In reinfection, whenever any healthy or infected recipients open the malicious attached file the modern email malware sends its copy to the recipients contact. In self-start, whenever compromised computers restart or malicious files are visited the malware spreads over the system. To avoid these types of issues the security specialists use some of the possible techniques and methods to stop and remove the threats. At the same time the malware developers exploit new malware that bypass implemented security features. In this paper, we analyzed the malware propagation and detecting mechanisms. This survey paper highlights the existing detection and analysis methodologies used for these malicious code.