Malware Proliferation Research Articles

Fraud and Malware Detection of Apps in Google Play

Abstract: Fraudulent Behaviors in Google Play, the Most Popular Android App Market, Fuel Search Rank Abuse and Malware Proliferation. To Identify Malware, Previous Work Has Focused on App Executable and Permission Analysis. In This Paper, We Introduce FairPlay, a Novel System That Discovers and Leverages Traces Left Behind by Fraudsters, to Detect Both Malware and Apps Subjected to Search Rank Fraud. FairPlay Correlates Review Activities and Uniquely Combines Detected Review Relations with Linguistic and Behavioral Signals Gleaned from Google Play App Data (87K Apps, 2.9M Reviews, and 2.4M Reviewers, Collected Over Half a Year), in Order to Identify Suspicious Apps. FairPlay Achieves Over 95% Accuracy in Classifying Gold Standard Datasets of Malware, Fraudulent and Legitimate Apps. We Show That 75% of the Identified Malware Apps Engage in Search Rank Fraud. FairPlay Discovers Hundreds of Fraudulent Apps That Currently Evade Google Bouncer’s Detection Technology. FairPlay Also Helped the Discovery of More Than 1,000 Reviews, Reported for 193 Apps, That Reveal a New Type of “Coercive” Review Campaign: Users Are Harassed into Writing Positive Reviews, and Install and Review Other Apps

Normal cyber accidents

ABSTRACT Several of the most serious cyber incidents affecting critical infrastructure to date have been the result of collateral damage, indirect effects, malware that ‘escaped’ their intended target and/or incontrollable malware proliferation. This tendency has so far been under-explored in the International Relations (IR) literature, and its potential implications largely overlooked. By focusing on the role of socio-technical system dynamics, this article aims to contribute to advancing our understanding of collateral (incidental) damage and unexpected consequences connected to offensive cyber operations. More specifically, it introduces an analytical framework based on Normal Accidents (NA) theory. The framework highlights dynamics which make complex systems more difficult to analyse and more prone to cascading failures. Its application is explored using in-depth interviews and empirical case examples of large-scale cyber incidents. The results highlight the difficulty of achieving controlled and precise effects when disrupting components in complex systems. The article concludes with a discussion on the need for renewed attention to escalatory risks connected to destructive offensive cyber.

IoT malware detection architecture using a novel channel boosted and squeezed CNN

Interaction between devices, people, and the Internet has given birth to a new digital communication model, the internet of things (IoT). The integration of smart devices to constitute a network introduces many security challenges. These connected devices have created a security blind spot, where cybercriminals can easily launch attacks to compromise the devices using malware proliferation techniques. Therefore, malware detection is a lifeline for securing IoT devices against cyberattacks. This study addresses the challenge of malware detection in IoT devices by proposing a new CNN-based IoT malware detection architecture (iMDA). The proposed iMDA is modular in design that incorporates multiple feature learning schemes in blocks including (1) edge exploration and smoothing, (2) multi-path dilated convolutional operations, and (3) channel squeezing and boosting in CNN to learn a diverse set of features. The local structural variations within malware classes are learned by Edge and smoothing operations implemented in the split-transform-merge (STM) block. The multi-path dilated convolutional operation is used to recognize the global structure of malware patterns. At the same time, channel squeezing and merging helped to regulate complexity and get diverse feature maps. The performance of the proposed iMDA is evaluated on a benchmark IoT dataset and compared with several state-of-the CNN architectures. The proposed iMDA shows promising malware detection capacity by achieving accuracy: 97.93%, F1-Score: 0.9394, precision: 0.9864, MCC: 0. 8796, recall: 0.8873, AUC-PR: 0.9689 and AUC-ROC: 0.9938. The strong discrimination capacity suggests that iMDA may be extended for the android-based malware detection and IoT Elf files compositely in the future.

Finding Grade Fake and Virus Identifying in Play Store

Deceitful behaviors in Google Play, the leading favored robot application market, fuel search ranking misuse as well as malware proliferation. to spot malware, previous job has actually centred on application practicable and also permission analysis. during this paper, we often tend to introduce Justice, a distinct system that finds and leverages traces left by scammers, to sight each malware as well as applications based on go looking rank fraudulence. Fair game correlates review tasks as well as unambiguously incorporates identified testimonial relations with linguistic and also task signals obtained from Google Play application expertise (87 K applications, 2.9 M evaluations, and 2.4 M customers, gathered over 0.5 a year), to spot suspicious applications. Fair game attains over ninety-five plc. accuracy in categorizing gold normal datasets of malware, unethical as well as Bonafede apps. we tend to reveal that seventy-five plc. of the identified malware apps have interaction in search rank fraud. Fair Play discovers numerous dishonest applications that presently escape Google Baby bouncer's detection innovation. Fair Play furthermore helped the creation of rather one,000 reviews, reportable for 193 apps, that reveal a new sort of "forceful" review project: users are troubled into composing favorable evaluations and also mount as well as assess alternative applications.

Searching Grade Scheme and Malware Recognition Within Google Play Application

To introduce FairPlay, a work of fiction system that discover and leverages traces left behind by fraudsters, to distinguish both malware and apps subjected to investigate status fraud. FairPlay associate review behavior and distinctively combine detect review associations with linguistic and behavioral signals gleaned from Google Play app records (87 K apps, 2.9 M reviews, and 2.4M reviewers, unruffled over half a year), in order to organize suspicious apps. FairPlay achieves over 95 percent accuracy in classify gold regular datasets of malware, counterfeit and legitimate apps. Deceptive behaviors in Google Play, the most trendy Android app market, fuel Search rank abuse and malware proliferation. To make out malware, preceding work has paying attention on app executable and acquiescence analysis. It will show that 75 percent of the acknowledged malware apps engage in hunt rank fraud. FairPlay discover hundreds of fraudulent apps that presently evade Google Bouncer’s recognition machinery.

Malware Image Classification Using One-Shot Learning with Siamese Networks

Machine learning has largely applied to malware detection and classification, due to the ineffectiveness of signature-based method toward rapid malware proliferation. Although state-of-the-art machine learning models tend to achieve high performances, they require a large number of training samples. It is infeasible to train machine learning models with sufficient malware samples while facing newly appeared malware variants. Therefore, it is important for security protectors to train a model given a small set of data, which can identify malware variants based on the similarity function. In addition, security protectors should keep re-training the models on newly-found samples, while the typical machine learning models based on massive data are not efficient for the instant update. Inspired by recent success using Siamese neural networks for one-shot image recognition, we aim to apply the networks to malware image classification task. The implementation includes three main stages: pre-processing, training, and testing. In the pre-processing stage, the system transforms malware samples to the resized gray-scale images and classifies them by average hash in the same family. In the training and testing stages, Siamese networks are trained to rank similarity between samples and the accuracy is calculated through N-way one-shot tasks. The experiment results showed that our networks outperformed the baseline methods. Besides, this paper indicated that our networks were more suitable for malware image one-shot learning than typical deep learning models.

Use of Data Visualisation for Zero-Day Malware Detection

With the explosion of Internet of Things (IoT) worldwide, there is an increasing threat from malicious software (malware) attackers that calls for efficient monitoring of vulnerable systems. Large amounts of data collected from computer networks, servers, and mobile devices need to be analysed for malware proliferation. Effective analysis methods are needed to match with the scale and complexity of such a data-intensive environment. In today’s Big Data contexts, visualisation techniques can support malware analysts going through the time-consuming process of analysing suspicious activities thoroughly. This paper takes a step further in contributing to the evolving realm of visualisation techniques used in the information security field. The aim of the paper is twofold: (1) to provide a comprehensive overview of the existing visualisation techniques for detecting suspicious behaviour of systems and (2) to design a novel visualisation using similarity matrix method for establishing malware classification accurately. The prime motivation of our proposal is to identify obfuscated malware using visualisation of the extended x86 IA-32 (opcode) similarity patterns, which are hard to detect with the existing approaches. Our approach uses hybrid models wherein static and dynamic malware analysis techniques are combined effectively along with visualisation of similarity matrices in order to detect and classify zero-day malware efficiently. Overall, the high accuracy of classification achieved with our proposed method can be visually observed since different malware families exhibit significantly dissimilar behaviour patterns.

Search Rank Fraud and Malware Detection in Google Play

Fraudulent behaviors in Google Play, the most popular Android app market, fuel search rank abuse and malware proliferation. To identify malware, previous work has focused on app executable and permission analysis. In this paper, we introduce FairPlay, a novel system that discovers and leverages traces left behind by fraudsters, to detect both malware and apps subjected to search rank fraud. FairPlay correlates review activities and uniquely combines detected review relations with linguistic and behavioral signals gleaned from Google Play app data (87 K apps, 2.9 M reviews, and 2.4M reviewers, collected over half a year), in order to identify suspicious apps. FairPlay achieves over 95 percent accuracy in classifying gold standard datasets of malware, fraudulent and legitimate apps. We show that 75 percent of the identified malware apps engage in search rank fraud. FairPlay discovers hundreds of fraudulent apps that currently evade Google Bouncer's detection technology. FairPlay also helped the discovery of more than 1,000 reviews, reported for 193 apps, that reveal a new type of “coercive” review campaign: users are harassed into writing positive reviews, and install and review other apps.

Governing Proliferation in Cybersecurity

This article compares state activities to control the international spread of malware with efforts to counter the proliferation of weapons of mass destruction (WMD). The analysis focuses on representative institutions, the Wassenaar Arrangement (Wassenaar) which began to address malware in 2013, and the Proliferation Security Initiative (PSI), comparing the origins, operation, and relative success of each. The article challenges the idea that PSI might serve as a successful model for countering malware proliferation, examining several basic questions about governing proliferation to offer insight into cybersecurity for the research and practitioner community. Looking at both intentional proliferation, through alliances, proxy relationships, or the malware markets, and unintentional proliferation, the article outlines key ideas in cybersecurity and underlines the challenges to governance. Concluding, the article argues PSI is a poor model to address malicious software, but that there are two substantive goals which may see more success: creating legal protections for cybersecurity research; and limiting the supply of software vulnerabilities available to attackers. Highlighting these differences between the approaches of Wassenaar and the PSI, this article presents cybersecurity as an interdependent ecosystem of people and ideas suitable for examination rather than being inaccessible or a purely technical space.

A Game Theoretical Method for Cost-Benefit Analysis of Malware Dissemination Prevention

ABSTRACTLiterature in malware proliferation focuses on modeling and analyzing its spread dynamics. Epidemiology models, which are inspired by the characteristics of biological disease spread in human populations, have been used against this threat to analyze the way malware spreads in a network. This work presents a modified version of the commonly used epidemiology models Susceptible Infected Recovered (SIR) and Susceptible Infected Susceptible (SIS), which incorporates the ability to capture the relationships between nodes within a network, along with their effect on malware dissemination process. Drawing upon a model that illustrates the network’s behavior based on the attacker’s and the defender’s choices, we use game theory to compute optimal strategies for the defender to minimize the effect of malware spread, at the same time minimizing the security cost. We consider three defense mechanisms: patch, removal, and patch and removal, which correspond to the defender’s strategy and use probabilistically with a certain rate. The attacker chooses the type of attack according to its effectiveness and cost. Through the interaction between the two opponents we infer the optimal strategy for both players, known as Nash Equilibrium, evaluating the related payoffs. Hence, our model provides a cost-benefit risk management framework for managing malware spread in computer networks.

Managing your data risk: back to basics

It is estimated that enterprises spent more than $70bn on security technology in 2014, according to an industry analyst, and are expected to increase that spend by nearly 10% in 2015.1 With such increased year-over-year expenditure, it would be easy to believe the enterprise sector is winning the battle against cyber-criminals. Wrong. Malware proliferation, network penetrations and data breaches continue to have an impact on organisations at an alarming rate and with increased consequences.A major challenge for organisations is that the cost to implement cyber-security defences will continue to rise as attacks become stealthier and more difficult to combat.Instead of spending more, businesses need to spend smarter. Rather than throwing money at the problem, it is more important to take a step back and conduct a carefully thought-out risk assessment. This way, companies can actually determine how best to secure their biggest asset - data - as Chris Richter of Level 3 Communications explains.

A Step towards Static Script Malware Abstraction: Rewriting Obfuscated Script with Maude

SUMMARY Modern web applications incorporate many programmatic frameworks and APIs that are often pushed to the client-side with most of the application logic while contents are the result of mashing up several resources from different origins. Such applications are threatened by attackers that often attempts to inject directly, or by leveraging a stepstone website, script codes that perform malicious operations. Web scripting based malware proliferation is being more and more industrialized with the drawbacks and advantages that characterize such approach: on one hand, we are witnessing a lot of samples that exhibit the same characteristics which make these easy to detect, while on the other hand, professional developers are continuously developing new attack techniques. While obfuscation is still a debated issue within the community, it becomes clear that, with new schemes being designed, this issue cannot be ignored anymore. Because many proposed countermeasures confess that they perform better on unobfuscated contents, we propose a 2-stage technique that first relieve the burden of obfuscation by emulating the deobfuscation stage before performing a static abstraction of the analyzed sample’s functionalities in order to reveal its intent. We support our proposal with evidence from applying our technique to real-life examples and provide discussion on performance in terms of time, as well as possible other applications of proposed techniques in the areas of web crawling and script classification. Additionally, we claim that such approach can be generalized to other scripting languages similar to JavaScript.