Spread Of Malware Research Articles

CPS Device-Class Identification via Behavioral Fingerprinting: From Theory to Practice

Cyber-Physical Systems (CPS) utilize different devices to collect sensitive data, communicate with other systems, and monitor essential processes in critical infrastructure applications. However, in the ecosystem of CPS, unauthorized or spoofed devices may danger or compromise the performance and security of the critical infrastructure. The unauthorized and spoofed devices may include tampered pieces of software or hardware components that can negatively impact CPS operations or collect vital CPS metrics from the network. Such devices can be outsider or insider threats trying to impersonate other real CPS devices via spoofing their legitimate identifications to gain access to systems, steal information, or spread malware. Device fingerprinting techniques are promising approaches to identify unauthorized or illegitimate devices. However, current fingerprinting solutions are not suitable as they disrupt critical real-time operations in CPS due to the nature of their extensive data analysis or too much overhead on the devices' computational resources. To address these concerns, in this work, we propose STOP-AND- FRISK (S&F), a novel fingerprinting framework to identify CPS device classes and complement traditional security mechanisms in CPS. S&F is based on a secure challenge/response mechanism that analyzes the behavior of the CPS devices at both the hardware and OS/kernel levels. Specifically, the proposed novel mechanism combines system and function call tracing techniques, signal processing, and hardware performance analysis to create specific device-class signatures. Then, the signatures are correlated against known behavioral ground-truth to identify the device types. To test the efficacy of S&F extensively, we implemented a realistic testbed that included different classes of CPS devices with a variety of computing resources, architectures, and configurations. Our experimental results reveal an excellent rate on the CPS device-class identification. Finally, extensive performance analysis demonstrates that the use of S&F yields minimal overhead on the CPS devices' computing resources.

Design and Development of Future Estimate in Confronting Ransomware

Ransomware might be a one assortment of malignant PC code which is that the quickest spreading malware risk as they focusing on each kind of clients records result in brief or perpetual loss of touchy information issue to ordinary activities, cash misfortunes caused to resuscitate framework documents that partners potential hurt to an association. As a consequences of an essential information’s unit encoded on the pc arrange by the programmers which they request the payment to pay a computerized cash style of a bitcoin inside a particular date, if installment isn’t done no information are back to unique sort of mystery composing. The proposed framework demonstrates that gathering of bitcoin datasets are accustomed to anticipating the eventual fate of bitcoin rates then examination the ransomware, that investigation are utilized to discover the ransomware extends then the client can shutting the framework doors for keeping away from the trail technique for malware go into the framework. It shows the security measures for the framework from the ransomware prediction.

MAKING OF DIGITAL FORENSIC READINESS INDEX (DiFRI) MODELS TO MALWARE ATTACKS

The increasing number of malware spread in the world today, then there will be more opportunities to commit crime, so readiness is needed for every internet user in dealing with these crimes. The readiness to handle crime is called digital forensic readiness. Therefore, we need a specific digital forensic readiness model to measure the level of readiness of internet users or institutions in achieving malware attacks. This model has the main components used to determine or calculate the level of readiness of internet users or institutions, the main components are the strategy component, the policy & procedure component, the technology & security component, the digital forensic response component, the control & legality component. The calculation method used in this study is a Likert Scale, with this method the results will be obtained that are closer to the real situation. The value / index of readiness level obtained will provide recommendations to internet users and these recommendations can be used to make improvements properly and on target.

Optimal Control of Malware Spreading Model with Tracing and Patching in Wireless Sensor Networks

Wireless sensor networks (WSNs), which emerge from an un-attended environment monitoring, are deployed for monitoring purposes in different environments. But, WSNs suffer from vulnerable malware to propagate via exploiting message exchange among the sensor nodes. To draw attention to this issue, this paper investigates an optimal control strategy to reduce the spread of malware in wireless sensor networks. A node-based epidemic model Susceptible-Infected-Traced-Patched-Susceptible is analyzed. The optimal control strategies are analytically investigated. The proposed optimal strategy achieves a low level of infections at a low cost. Finally, numerical illustrations are presented to show the spread of malware through infected nodes which can be effectively suppressed by adopting the suitable optimal control strategy.

Internet-scale Insecurity of Consumer Internet of Things

The number of Internet-of-Things (IoT) devices actively communicating across the Internet is continually increasing, as these devices are deployed across a variety of sectors, constantly transferring private data across the Internet. Due to the extensive deployment of such devices, the continuous discovery and persistence of IoT-centric vulnerabilities in protocols, applications, hardware, and the improper management of such IoT devices has resulted in the rampant, uncontrolled spread of malware threatening consumer IoT devices. To this end, this work adopts a novel, macroscopic methodology for fingerprinting Internet-scale compromised IoT devices, revealing crucial cyber threat intelligence on the insecurity of consumer IoT devices. By developing data-driven techniques rooted in machine learning methods and analyzing 3.6 TB of network traffic data, we discover 855,916 compromised IP addresses, with 310,164 fingerprinted as IoT. Further analysis reveals China and Brazil to be hosting the most significant population of compromised IoT devices (100,000 and 55,000, respectively). Additionally, we provide a longitudinal analysis on data from one year ago against this work, revealing the evolving trends of IoT exploitation, such as the increased number of vendors targeted by malware, rising from 50 to 131. Moreover, countries such as China (420% increased infected IoT count) and Indonesia (177% increased infected IoT count) have seen notably high increases in infection rates. Last, we compare our geographic results against Global Cybersecurity Index (GCI) ratings, verifying that countries with high GCI ratings, such as the Netherlands and Germany, had relatively low infection rates. However, upon further inspection, we find that the GCI rate does not accurately represent the consumer IoT market, with countries such as China and Russia being rated with “high” CGI scores, yet hosting a large population of infected consumer IoT devices.

A Remote Access Security Model based on Vulnerability Management

Information security threats exploit vulnerabilities in communication networks. Remote access vulnerabilities are evident from the point of communication initialization following the communication channel to data or resources being accessed. These threats differ depending on the type of device used to procure remote access. One kind of these remote access devices can be considered as safe as the organization probably issues it to provide for remote access. The other type is risky and unsafe, as they are beyond the organization’s control and monitoring. The myriad of devices is, however, a necessary evil, be it employees on public networks like cyber cafes, wireless networks, vendors support, or telecommuting. Virtual Private Network (VPN) securely connects a remote user or device to an internal or private network using the internet and other public networks. However, this conventional remote access security approach has several vulnerabilities, which can take advantage of encryption. The significant threats are malware, botnets, and Distributed Denial of Service (DDoS). Because of the nature of a VPN, encryption will prevent traditional security devices such as a firewall, Intrusion Detection System (IDS), and antivirus software from detecting compromised traffic. These vulnerabilities have been exploited over time by attackers using evasive techniques to avoid detection leading to costly security breaches and compromises. We highlight numerous shortcomings for several conventional approaches to remote access security. We then adopt network tiers to facilitate vulnerability management (VM) in remote access domains. We perform regular traffic simulation using Network Security Simulator (NeSSi2) to set bandwidth baseline and use this as a benchmark to investigate malware spreading capabilities and DDoS attacks by continuous flooding in remote access. Finally, we propose a novel approach to remote access security by passive learning of packet capture file features using machine learning and classification using a classifier model.

Effects of Malware Attacks on the Cascading Failure of Cyber-physical Power System

In this paper, a stochastic cascading failure model considering the structure and operation of cyber-physical power system is proposed. The model takes into account the community structure and the heterogeneity of networks as well as the complex interdependence of coupling networks. Moreover, the malware spreading in the cyber network and the power flow redistribution in the power grid are considered to describe the dynamic operational characteristics of the system, and a stochastic method is adopted to describe the operating state transition of network components. In addition, the effects of community structure strength and immunization strategy on the cascading failure of coupled system are studied. The results show that the cascading failure of coupled system is the result of malware attacks repeatedly triggering the power grid. Results also suggest increasing the community structure strength of cyber network helps to suppress the impact of cyber-attacks on the coupled system, and community bridge immunization is the optimal immunization strategy for inhibiting failure propagation in the modular interdependent network.

Dynamic model of Malware propagation based on tripartite graph and spread influence

The large-scale use of the Internet brings the problem of the rapid spread of computer malware over the network. Aiming at the relationship between malware, propagation paths and users in network propagation, this paper proposes a perception propagation model of computer malware based on a tripartite graph. First of all, aiming at the driving and influence of malware, propagation paths and users’ association in the network, this paper introduces a malware propagation tree structure, constructs two bipartite graphs of malware–propagation paths and propagation paths–users, and takes the paths as a bridge to form a tripartite graph of malware, propagation paths and users. Second, aiming at the complexity of the driving factors of malware in the process of propagation and the multiplicity of influence, by introducing a Cross-iteration Scoring mechanism of tripartite graph and influencing quantification algorithm, a method to measure the influence of malware propagation is proposed. At the same time, it uses multiple linear regression to uniformly quantify the impact. Finally, considering the polymorphism in the process of computer malware propagation, time slicing and infection state refinement are introduced. Based on the traditional propagation model, the infection state is divided into the normal infection state and the high infection state, and the tripartite iterative algorithm and the influence power method are comprehensively considered. A novel propagation dynamic model of malware is proposed. Experiments show that the model can not only discover the spread situation of malware in the network, but also explore the relationship between malware, propagation paths and users and their influence on the spread situation.

Dynamic Defense against Stealth Malware Propagation in Cyber-Physical Systems: A Game-Theoretical Framework.

Stealth malware is a representative tool of advanced persistent threat (APT) attacks, which poses an increased threat to cyber-physical systems (CPS) today. Due to the use of stealthy and evasive techniques, stealth malwares usually render conventional heavy-weight countermeasures inapplicable. Light-weight countermeasures, on the other hand, can help retard the spread of stealth malwares, but the ensuing side effects might violate the primary safety requirement of CPS. Hence, defenders need to find a balance between the gain and loss of deploying light-weight countermeasures, which normally is a challenging task. To address this challenge, we model the persistent anti-malware process as a shortest-path tree interdiction (SPTI) Stackelberg game with both static version (SSPTI) and multi-stage dynamic version (DSPTI), and safety requirements of CPS are introduced as constraints in the defender’s decision model. The attacker aims to stealthily penetrate the CPS at the lowest cost (e.g., time, effort) by selecting optimal network links to spread, while the defender aims to retard the malware epidemic as much as possible. Both games are modeled as bi-level integer programs and proved to be NP-hard. We then develop a Benders decomposition algorithm to achieve the Stackelberg equilibrium of SSPTI, and design a Model Predictive Control strategy to solve DSPTI approximately by sequentially solving an approximation of SSPTI. Extensive experiments have been conducted by comparing proposed algorithms and strategies with existing ones on both static and dynamic performance metrics. The evaluation results demonstrate the efficiency of proposed algorithms and strategies on both simulated and real-case-based CPS networks. Furthermore, the proposed dynamic defense framework shows its advantage of achieving a balance between fail-secure ability and fail-safe ability while retarding the stealth malware propagation in CPS.

Stochastic Stabilization of Malware Propagation in Wireless Sensor Network via Aperiodically Intermittent White Noise

In this paper, we propose a novel heterogeneous model to describe the propagation dynamics of malware (viruses, worms, Trojan horses, etc.) in wireless sensor networks. Our model takes into consideration different battery-level sensor nodes contrary to existing models. In order to control the spread of malware, we design an aperiodically intermittent controller driven by white noise, which has striking advantages of lower cost and more flexible control strategy. We give a distinct condition on stability in probability one using graph-theoretical Lyapunov function and stochastic analysis method. Our results show that the nonlinear malware propagation system can be stabilized by intermittent stochastic perturbation under the intermittent time related to stochastic perturbation intensity. Our theoretical results can be applied to understand the observed mechanisms of malware and design interventions to control the spread of malware. Numerical simulations illustrate our analytical results clearly.

Cascading failure dynamic of cyber-physical power system considering malware attacks

With the development of cyber-physical power system, cyber security has a serious impact on the operation of power system. In this paper, a stochastic cascading failure model considering the structural and dynamical characteristics of cyber-physical power system is proposed. The model takes into account the community structure of networks, the heterogeneity of network nodes and the complex interdependence of coupling networks. Moreover, the malware spreading in the cyber network and the power flow redistribution in the power grid are considered to describe the dynamic physical processes of the system, and a stochastic method is adopted to describe the operating state transition of network components. Simulation results indicate that the cascading failure of coupled system is the result of malware attacks repeatedly triggering the power grid, and cyber coupling will aggravate the severity of grid failure propagation.

Distributed Security Framework for Reliable Threat Intelligence Sharing

Computer security incident response teams typically rely on threat intelligence platforms for information about sightings of cyber threat events and indicators of compromise. Other security building blocks, such as Network Intrusion Detection Systems, can leverage the information to prevent malicious adversaries from spreading malware across critical infrastructures. The effectiveness of threat intelligence platforms heavily depends on the willingness to share among organizations and the responsible use of sensitive information that may potentially harm the reputation of the reporting organization. The challenge that we address is the lack of trust in the source providing the threat intelligence and the information itself. We enhance our security framework TATIS—offering fine-grained protection for threat intelligence platform APIs—with distributed ledger capabilities to enable reliable and trustworthy threat intelligence sharing with the ability to audit the provenance of threat intelligence. We have implemented and evaluated the feasibility of our distributed framework on top of the Malware Information Sharing Platform (MISP) solution, and we evaluate the performance impact using real-world open-source threat intelligence feeds.

Modeling infection methods of computer malware in the presence of vaccinations using epidemiological models: an analysis of real-world data

Computer malware and biological pathogens often use similar infection mechanisms. For this reason, it has been suggested to model malware spread using epidemiological models developed to characterize the spread of biological pathogens. However, to date, most work examining the similarities between malware and pathogens using such methods was based on theoretical analysis and simulation. Here we extend the classical susceptible–infected–recovered epidemiological model to describe two of the most common infection methods used by malware. We fit the proposed model to malware collected between April 2017 and April 2018 from a major anti-malware vendor. We show that by fitting the proposed model it is possible to identify the method of transmission used by the malware, its rate of infection, and the number of machines which will be infected unless blocked by anti-virus software. In a large sample of malware infections, the Spearman correlation between the number of actual and predicted infected machines is \(\rho =0.84\). Examining cases where an anti-malware “signature” was transmitted to susceptible computers by the anti-virus provider, we show that the time to remove the malware will be short and independent of the number of infected computers if fewer than approximately 60% of susceptible computers have been infected. If more computers were infected, the time to removal will be approximately 3.2 times greater and will depend on the fraction of infected computers. Our results show that the application of epidemiological models of infection to malware can provide anti-virus providers with information on malware spread and its potential damage. We further propose that similarities between computer malware and biological pathogens, the availability of data on the former, and the dearth of data on the latter, make malware an extremely useful model for testing interventions which could later be applied to improve medicine.

A Network Function Virtualization System for Detecting Malware in Large IoT Based Networks

The exponential growth in the use of Internet of Things (IoT) devices has introduced numerous challenges, in particular dealing with new security threats. In addition, for connecting heterogeneous devices using different protocols, large networks need resilient software-based security systems that can defend against unprecedented attacks for which the traditional security countermeasures prove to be ineffective. Furthermore, to deal with the ever growing onslaught on data and networks, modern security systems need to utilize novel machine learning mechanisms. This paper proposes a software-based architecture that provides network function virtualization (NFV) capability to combat malware spread for heterogeneous IoT networks. To build a scalable and generalized Intrusion Detection System (IDS), we propose for these networks a RNN-LSTM learning model that can predict malware attacks in a timely manner for the NFV to deploy appropriate countermeasures. In addition, we investigate the scalability of the network and discuss how the generalized IDS can deal with a broad range of malwares that can be detected. The analysis utilizes the susceptible (S), exposed (E), infected (I), and resistant (R) (SEIR) epidemic model to moniter the spread of the malware attack and subsequently provides patching to the system. Our analysis focuses primarily on the feasibility and the performance evaluation of the proposed integrated RNN-LSTM and NFV architecture.

Threats to Online Advertising and Countermeasures

Online advertising, also known as web advertising or Internet marketing, is the means and process of promoting products and services on the Internet, and it has been one of the important business models for the Internet. Due to its lucrative nature and its large scale of adoption, it has also been a target for malicious parties with various attack aims such as getting a cut of online advertising revenues, obtaining a user’s privacy, and spreading malware. Over the years, a great deal of research has been conducted on online advertising. Recently, the health of the online advertising ecosystem has become more of a concern for both advertisers and regular Internet users. Advertising budgets have been abused, and Internet users’ privacy and security have been infringed. In this article, we broadly study threats to online advertising and trace the root causes from a systems point of view. Existing threat mitigation strategies are also reviewed and analyzed. To protect online advertising, which has been an essential funding source of many free Internet services, several challenges still need to be addressed, including the need for transparency of the advertising ecosystem and software vulnerabilities on the client-side. To overcome these challenges, we conclude by brainstorming some innovative ideas on some potentially interesting and useful research directions.

A Graph-Based Feature Generation Approach in Android Malware Detection with Machine Learning Techniques

An explosive spread of Android malware causes a serious concern for Android application security. One of the solutions to detecting malicious payloads sneaking in an application is to treat the detection as a binary classification problem, which can be effectively tackled with traditional machine learning techniques. The key factors in detecting Android malware with machine learning techniques are feature selection and generation. Most of the existing approaches select and generate features without fully examining the structures of programs, and thus the important semantic information associated with these features is lost, consequently resulting in a low accuracy rate in detection. To address this issue, we propose a new feature generation approach for Android applications, which takes components and program structures into consideration and extracts features in a graph-based and semantics-rich style. This approach highlights two major distinguishing aspects: the context-based feature selection and graph-based feature generation. We abstract an Android application as a collection of reduced iCFGs (interprocedural control flow graphs) and extract original features from these graphs. Combining the original features and their contexts together, we generate new features which hold richer semantic information than the original ones. By embedding the features into a feature vector space, we can use machine learning techniques to train a malware detector. The experiment results show that this approach achieves an accuracy rate of 95.4% and a recall rate of 96.5%, which prove the effectiveness and advantages of our approach.

Advanced malware propagation on random complex networks

In this work a novel model to simulate advanced malware spreading is introduced and analyzed. It is an individual-based model such that the dynamics of the malware outbreak is governed by means of a cellular automaton. The network topologies considered are complex random networks and each device is endowed at every step of time with one of the following possible states: susceptible, infected, attacked and recovered. A study analyzing the influence of topology variability and the structural characteristics of initially infected devices is done.

Security of HyperLogLog (HLL) Cardinality Estimation: Vulnerabilities and Protection

Count distinct or cardinality estimates are widely used in network monitoring for security. They can be used, for example, to detect the malware spread, network scans, or a denial of service attack. There are many algorithms to estimate cardinality. Among those, HyperLogLog (HLL) has been one of the most widely adopted. HLL is simple, provides good cardinality estimates over a wide range of values, requires a small amount of memory, and allows merging of estimates from different sources. However, as HLL is increasingly used to detect attacks, it can itself become the target of attackers that want to avoid being detected. To the best of our knowledge, the security of HLL has not been studied before. In this letter, we take an initial step in its study by first exposing a vulnerability of HLL that allows an attacker to manipulate its estimate. This shows the importance of designing secure HLL implementations. In the second part of the letter, we propose an efficient protection technique to detect and avoid the HLL manipulation. The results presented strongly suggest that the security of HLL should be further studied given that it is widely adopted in many networking and computing applications.

Spam detection through feature selection using artificial neural network and sine–cosine algorithm

Detection of spam and non-spam emails is considered a great challenge for email service providers and users alike. Spam emails waste the Internet traffic and also contain malicious links that mostly direct users to phishing webpages. Another challenge of spams is their role in spreading malware on the network, further emphasizing the need for their detection. Despite the application of data mining methods such as artificial neural networks (ANNs) in spam detection, these methods are prone to a significant error in their output mostly due to including all the spam features in their training stage. To reduce the spam detection error, a feature selection-based method was provided in this paper using the sine–cosine algorithm (SCA). In the proposed method, feature vectors are updated by the SCA to select the optimal features for training the ANN. Implementation of the proposed method of the Spambase dataset in MATLAB indicated a precision, accuracy and sensitivity of 98.64%, 97.92% and 98.36%, respectively. In other words, the proposed method outperformed the multilayer perceptron (MLP) neural network, Bayesian network, decision tree and random forest classifiers in terms of spam detection. According to the test results, the feature selection error in the MLP neural network decreased by approximately 2.18% using the SCA.

Can machine learning model with static features be fooled: an adversarial machine learning approach

The widespread adoption of smartphones dramatically increases the risk of attacks and the spread of mobile malware, especially on the Android platform. Machine learning-based solutions have been already used as a tool to supersede signature-based anti-malware systems. However, malware authors leverage features from malicious and legitimate samples to estimate statistical difference in-order to create adversarial examples. Hence, to evaluate the vulnerability of machine learning algorithms in malware detection, we propose five different attack scenarios to perturb malicious applications (apps). By doing this, the classification algorithm inappropriately fits the discriminant function on the set of data points, eventually yielding a higher misclassification rate. Further, to distinguish the adversarial examples from benign samples, we propose two defense mechanisms to counter attacks. To validate our attacks and solutions, we test our model on three different benchmark datasets. We also test our methods using various classifier algorithms and compare them with the state-of-the-art data poisoning method using the Jacobian matrix. Promising results show that generated adversarial samples can evade detection with a very high probability. Additionally, evasive variants generated by our attack models when used to harden the developed anti-malware system improves the detection rate up to 50% when using the generative adversarial network (GAN) method.