Malware Threats Research Articles

Malware Detection on Local Network based on Honeypot and Yara

The malware threats have never subsided, even the trend shows an increase and varies along with the development of hardware and software technology. End user may not realize if their machine is compromised by malware. It could be the anti-malware mechanism is not working properly, such as the anti-virus is not updated or there is a zero-day attack. Therefore, it is necessary to detect the presence of malware on end-systems devices or the existence of zero-day attack in the local network. Implementation of honeypot as a security sensor that collects malware attack data in the form of malware files and malware hashes can be used as signatures for scanning and detecting malware. This research utilizes a honeypot as a security sensor to catching malware. The malware hash from the honeypot is used to scanning and detecting the presence of malware on the end-system in a local network such as a PC or server. Furthermore, Yara helps clarify the type of malware found by scanning suspected files. The results of scanning and detecting of malware by Yara will be reported to the appropriate authorities via Telegram application channles. This research contributes by providing early warning of potential security threats to the network and collecting hash code of recently malware attacking to the network. Keywords: Honeypot, Malware, Yara, Proactive Security .

Peningkatan Keamanan pada Simple Network Time Protocol (SNTP) untuk Mendeteksi Cybercrime di dalam Aktivitas Jaringan

Today's cybercrime methods are extremely diverse. The methods employed by attackers are becoming more diverse and intricate. Malicious software, commonly referred to as malware, is utilized in these various attacks. Malware threats and their propagation can be accomplished in several different ways. Good governance facilitates prevention via migration, assisting the security team and network infrastructure IT. This paper discusses efforts to enhance the security of the Simple Network Time Protocol (SNTP) to detect cybercrime on the network. Based on the results of the conducted experiments, we determined that by updating the Simple Network Time Protocol, implementing the client-server antivirus, and scanning every client connected to the local network or centrally, we could detect the types of attacks that frequently occur on the network system, thereby protecting all client computers from malware, viruses, worms, and Trojan horses. Based on the antivirus migration data, the employed research method can find information on cybercrimes that involve malware that enters the network and is successfully cleaned or quarantined before being automatically blocked.

IoT Malware Analysis Using Federated Learning: A Comprehensive Survey

The Internet of Things (IoT) has paved the way to a highly connected society where all things are interconnected and exchanging information has become more accessible through the internet. With the use of IoT devices, the threat of malware has increased rapidly. The increased number of existing and new malware variants has made protecting IoT devices and networks challenging. The malware can hide in the systems and disables its activity when there are attempts to discover and detect them. With technological advances, there are various emerging techniques to address this problem. However, they still encounter issues concerning the privacy and security of the user’s data and suffer from a single point of failure. To address this issue, there are recent research developments conducted to use Federated Learning (FL). FL is a decentralized technique that trains the user’s data on-device and exchanges the parameters without sharing the user’s data. FL is implemented to secure the user’s data, provide safe and accurate models, and prevent the single point of failure in the centralized models. This paper provides an overview of different approaches that integrate FL with IoT. Finally, we discuss the applications of FL, the research challenges, and future research directions.

Enhancing Malware Detection in Cybersecurity through Optimized Machine Learning Technique

This research is about the increasing cybersecurity challenges posed by modern malware threats and argues for an improved approach through optimized machine learning algorithms. We apply a Tree-structured Parzen Estimator (TPE) for hyperparameter tuning, focusing on the optimization of tree-based models such as Random Forest and Gradient Boosting. Our methodology includes careful correlation analysis, variable distribution examination, and feature importance assessment to make our models more robust and transparent. We present comprehensive visualizations that demonstrate the results of our optimized approach, which show improved accuracy, precision, and recall in malware detection. Our findings highlight the significance of feature engineering and model tuning, revealing subtle patterns indicative of malicious behavior. The findings indicate that our model provides a method that not only improves detection capabilities but also emphasizes the need for continuous improvement and innovation in addressing the ever-changing nature of malware threats.

Malware Threat on Edge/Fog Computing Environments From Internet of Things Devices Perspective

Developing a secured information processing environment highly depends on securing all of the layers and devices in the environment. Edge/Fog computing environments are not an exception in this case, and the security of those environments highly depends on securing the Internet of Things (IoT) devices which are the most vulnerable devices through the environment. The adoption of Edge/Fog computing paradigms by new emerging technologies stimulated malware development for IoT platforms. Recent attacks initiated by IoT malware show that these attacks make a tremendous impact on compromised systems in terms of Quality of Service because of the number of infected IoT devices. In the light of these developments, there is an enormous need for efficient solutions. However, defense capability against these new malware types is highly constrained by the limited understanding of these new emerging paradigms and the lack of access to malware samples. This paper mainly focuses on IoT malware to understand the behaviors of malware on the most vulnerable layer of the Edge/Fog computing environments. Mainly, 64 IoT malware families are located from 2008 when the first known IoT malware emerged to October 2022. These malware families are systematically characterized from various aspects, including target architecture, target device, delivery methods, attack vectors, persistence techniques, and their evolution from existing malware. During this characterization process, two different investigation frameworks, "Cyber Kill Chain" and "Mitre ATT&CK for ICS," have been adopted in different investigation layers. This paper aims to bring light to future researches with presented features of the IoT malware.

ANALYSIS OF CURRENT THREATS TO THE INFORMATION SECURITY OF ORGANIZATIONSAND THE FORMATION OF THE INFORMATION PLATFORM AGAINST THEM

Taking into account the process of complication of the geopolitical and geoeconomic landscape space, the development of information technologies and the formation of new security challenges associated with the emergence of new cyber threats, there is a need for constant monitoring and forecasting of them in order to prevent consequences in the form of damage and leakage of valuable and confidential information. The authors analyzed the new predictable cyber security threats to organizations, with special attention paid to the protection of endpoints. Threats identified in the field of artificial intelligence development (underground development of malicious Large Language Models (LLM); “Script Kiddies” update; voice fraud for social engineering, which is created by artificial intelligence); changing trends in the behavior of threat actors (attacks on supply chains against managed file transfer solutions, malware threats that are becoming multilingual); as new emerging threats and attack methods (growing QR code rivalry; stealth attacks on peripheral devices; Python implementation in Excel creating a potentially new vector for attacks; LOL drivers changing action algorithms). The resulting detection of future threats emphasizes the need for strategic planning for the adoption of new technologies and platforms: such as Endpoint Detection and Response (EDR) capabilities, as well as the use of EDR as part of a multi-instrumented enhanced detection and response (XDR) architecture. Gartner’s research has been proven to have a tremendous impact on improving organizations’ threat detection capabilities by providing valuable insight into the strengths and weaknesses of each cybersecurity service provider with respect to emerging threat intelligence, by focusing organizations’ attention on opportunities to identify gaps in their existing security infrastructure and adopt sound decisions to invest in additional solutions or services that effectively address these gaps. The spheres of activity of the world’s leading companies were analyzed, their connection with Ukrainian companies was found, and further cooperation was proposed for the effective protection of national cyberspace.

Data-Driven Malware Detection for 6G Networks: A Survey From the Perspective of Continuous Learning and Explainability via Visualisation

5G is inherently prone to security vulnerabilities. We witness that many today's networks contain 5G security flaws due to their reliance on the existing 4G network core. A lack of security standards for 5G IoT devices means network breaches and malware threats might run uncontrolled. The future 6G network is predicted to be implemented with artificial intelligence-driven communication via machine learning, enhanced edge computing, post-quantum cryptography and so forth. With the activation of edge computing, the computing power available at supercomputing servers is to be integrated directly into the devices at the entry point of a network in a distributed manner ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">e.g.</i> , antennas, routers, IoT sensors, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">etc</i> ). This feature brings an equal quality of service everywhere including remote regions ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">a.k.a</i> service everywhere) which will trigger an exponential growth of associated applications. In this intricate environment, malware attacks are becoming more challenging to detect. This paper thus reviews the theoretical and experimental data-driven malware detection literature, in the large-scale data-intensive field, relating to: (1) continuous learning, including new concepts in multi-domain to multi-target learning and the challenges associated with unseen/unknown data, imbalance data and data scarcity, and (2) new explainability via visualisation concepts with a multi-labelling approach which allows identifying malware by their recipes while improving the interpretability of its decision process.

A Comparative Analysis of Machine Learning Algorithms for Android Malware Detection

The immense growth of Android mobile malware threats has pushed cybersecurity researchers to develop efficient systems that can detect new Android malware. In spite of the academic and industrial attempts to establish a robust, reliable, and efficient solution for Android, malware classification is considered an open problem with many challenges. This paper sheds light on the performance of several machine learning algorithms and analyzes their efficiency in detecting android malware. Moreover, it applies Synthetic Minority Oversampling Technique (SMOTE), normalizes the numerical features and PCA to reach the maximum accuracy. Furthermore, the paper develops a Light Gradient Boosting Model to identify Android malware and classify their families into five classes: Adware, Banking Malware, SMS Malware, Mobile Riskware, and Benign. The paper uses a large and recent dataset, which consists of 11,598 APK collected from several sources and provided by the Canadian Institute of Cybersecurity.

Exploring Lightweight Deep Learning Solution for Malware Detection in IoT Constraint Environment

The present era is facing the industrial revolution. Machine-to-Machine (M2M) communication paradigm is becoming prevalent. Resultantly, the computational capabilities are being embedded in everyday objects called things. When connected to the internet, these things create an Internet of Things (IoT). However, the things are resource-constrained devices that have limited computational power. The connectivity of the things with the internet raises the challenges of the security. The user sensitive information processed by the things is also susceptible to the trusability issues. Therefore, the proliferation of cybersecurity risks and malware threat increases the need for enhanced security integration. This demands augmenting the things with state-of-the-art deep learning models for enhanced detection and protection of the user data. Existingly, the deep learning solutions are overly complex, and often overfitted for the given problem. In this research, our primary objective is to investigate a lightweight deep-learning approach maximizes the accuracy scores with lower computational costs to ensure the applicability of real-time malware monitoring in constrained IoT devices. We used state-of-the-art Recurrent Neural Network (RNN), Long Short-Term Memory (LSTM), and Bi-directional LSTM deep learning algorithm on a vanilla configuration trained on a standard malware dataset. The results of the proposed approach show that the simple deep neural models having single dense layer and a few hundred trainable parameters can eliminate the model overfitting and achieve up to 99.45% accuracy, outperforming the overly complex deep learning models.

IIoT Deep Malware Threat Hunting: From Adversarial Example Detection to Adversarial Scenario Detection

Protecting widely used deep classifiers against black-box adversarial attacks is a recent research challenge in many security-related areas, including malware classification. This class of attacks relies on optimizing a sequence of highly similar queries to bypass given classifiers. In this article, we leverage this property and propose a history-based method named, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">stateful query analysis (SQA)</i> , which analyzes sequences of queries received by a malware classifier to detect black-box adversarial attacks on an industrial Internet of Things (IIoT). In the SQA pipeline, there are two components, namely the similarity encoder and the classifier, both based on convolutional neural networks. Unlike the state-of-the-art methods, which aim to identify individual adversarial examples, tracking the history of queries allows our method to identify adversarial scenarios and abort attacks before their completion. We optimize SQA using different combinations of hyperparameters on an advanced risc machine (ARM)-based IIoT malware dataset, widely adopted for malware threat hunting in industry 4.0. The use of a novel distance metric in calculating the loss function of the similarity encoder results in more disentangled representations and improves the performance of our method. Our evaluations demonstrate the validity of SQA via a detection rate of 93.1% over a wide range of adversarial examples.

Fileless malware threats: Recent advances, analysis approach through memory forensics and research challenges

The rapid advancements in cyber-attack strategies are in parallel with the measures for detection, analysis, and prevention. Attackers have recently developed fileless malware that can simply bypass existing security mechanisms. Researchers publish reports to help discover fileless malware and to better understand the threatʼs scope to counteract it. However, with the lack of studies on fileless malware regarding the classification and the scale of the threat, they have not been thoroughly analyzed. As a result, in this research, we explored the most recent advancements in fileless malware prevention and detection and highlighted future research challenges. We also propose an analytical approach based on the attack strategies and attributes of the selected sample. Our method simplifies feature extraction and reduces processing load. Furthermore, compared to the static analysis we do not need for decompression and unpacking for the analysis. We applied the proposed method on a real case example. It has been seen that information about fileless malware detection, working mechanism, attack method and attacker named “Kovter” can be accessed. Our approach is advantageous and can be applied as a new technique for fileless malware detection to protect systems from cyber threats. This paper also presents an insight to the fileless malware threat and provides a basic review of the methods and techniques used in the detection and analysis of fileless malware attacks.

FIRE: A Finely Integrated Risk Evaluation Methodology for Life-Critical Embedded Systems

Life-critical embedded systems, including medical devices, are becoming increasingly interconnected and interoperable, providing great efficiency to the healthcare ecosystem. These systems incorporate complex software that plays a significantly integrative and critical role. However, this complexity substantially increases the potential for cybersecurity threats, which directly impact patients’ safety and privacy. With software continuing to play a fundamental role in life-critical embedded systems, maintaining its trustworthiness by incorporating fail-safe modes via a multimodal design is essential. Comprehensive and proactive evaluation and management of cybersecurity risks are essential from the very design to deployment and long-term management. In this paper, we present FIRE, a finely integrated risk evaluation methodology for life-critical embedded systems. Security risks are carefully evaluated in a bottom-up approach from operations-to-system modes by adopting and expanding well-established vulnerability scoring schemes for life-critical systems, considering the impact to patient health and data sensitivity. FIRE combines a static risk evaluation with runtime dynamic risk evaluation to establish comprehensive risk management throughout the lifecycle of the life-critical embedded system. We demonstrate the details and effectiveness of our methodology in systematically evaluating risks and conditions for risk mitigation with a smart connected insulin pump case study. Under normal conditions and eight different malware threats, the experimental results demonstrate effective threat mitigation by mode switching with a 0% false-positive mode switching rate.

Static Analysis and Machine Learning-based Malware Detection System using PE Header Feature Values

Advances in information and communications technology (ICT) are improving daily convenience and productivity, but new malware threats continue to surge. This paper proposes a malware detection system using various machine learning algorithms and portable executable (PE) Header file static analysis method for malware code, which has recently changed in various forms. Methods/Statistical analysis: This paper proposes a malware detection method that quickly and accurately detects new malware using static file analysis and stacking methods. Furthermore, using information from PE headers extracted through static analysis can detect malware without executing real malware. The features of the pe_packer used in the proposed research method were most efficient in experiments because the extracted data were processed in various ways and applied to machine learning models. So, we chose pe_packer information as the shape data to be used for the stacking model. Detection models are implemented based on additive techniques rather than single models to detect with high accuracy. Findings: The proposed detection system can quickly and accurately classify malware or ordinary files. Moreover, experiments showed that the proposed method has a 95.2% malware detection rate and outperforms existing single model-based detection systems. Improvements/Applications: The proposed research method applies to detecting large new strains of malware.

Markov-Based Malware Propagation Modeling and Analysis in Multi-Layer Networks

In this paper, we focus on the dynamics of the spread of malicious software (malware) in multi-layer networks of various types, e.g., cyber-physical systems. Recurring malware has been one of the major challenges in modern networks, and significant research and development has been dedicated to mitigating it. The majority of relevant works has focused on networks characterized by “flat” topologies, namely topologies in which all nodes consist of a single layer, studying the dynamics of propagation of a specific threat or various types of malware over a homogeneous topology. As cyber-physical systems and multi-layer networks in general are gaining in popularity and penetration, more targeted studies are needed. In this work, we focus on the propagation dynamics of recurring malware, namely Susceptible–Infected–Susceptible (SIS type) in multi-layer topologies consisting of combinations of two different types of networks, e.g., a small-world overlaying a random geometric, or other such combinations. We utilize a stochastic modeling framework based on Markov Random Fields for analyzing the propagation dynamics of malware over such networks. Through analysis and simulation, we discover the most vulnerable and the most robust topology among the six considered combinations, as well as a result of rather practical use, namely that the denser the network, the more flexibility it provides for malware mitigation eventually.

A Bayesian probability model for Android malware detection

The unprecedented growth of mobile technology has generated an increase in malware and raised concerns over malware threats. Different approaches have been adopted to overcome the malware attacks yet this spread is still increasing. To combat this issue, this study proposes an Android malware detection system based on permission features using Bayesian classification. The permission features were extracted via the static analysis technique. The 10,000 samples for the judgement were obtained from AndroZoo and Drebin databases. The experiment was then conducted using two algorithms for feature selection: information gain and chi-square. The best accuracy rate of detection of permission features achieved was 91.1%.

F2DC: Android malware classification based on raw traffic and neural networks

Given the growing threat of Android malware, its family classification is important for identifying new variants, building robust signatures, assessing threat levels, and planning defenses. Since static and host-based dynamic classification techniques suffer from several limitations such as low adversarial capabilities, network-based dynamic techniques have been proposed as a complementary way. However, existing network-based approaches are heavily engineered on a specific application protocol (i.e., HTTP) and implement classification based on domain-expert driven features, rendering them hardly generalizable to many real-world classification scenarios (e.g., TLS encryption and unknown application protocols) and unable to keep pace with the rapid evolution of Android malware. To address these issues, we propose F2DC, a new Android malware classification method based on raw traffic and neural networks. F2DC characterizes Android malware from raw payload rather than application protocols and is therefore application-protocol independent and encryption-agnostic in principle. A novel traffic encoding scheme called F2D is designed to map the raw payload space into a flow-based latent feature space that facilitates convolutional neural networks (CNNs) to distill more discriminative features for effective classification. Experiments show that F2DC outperforms state-of-the-art methods and exhibits highly competitive performance against popular mobile antivirus (AV) tools. These results indicate that F2DC is a promising network-based Android malware classification solution complementary to existing alternatives.

A Deep Convolutional Neural Network Stacked Ensemble for Malware Threat Classification in Internet of Things

Malicious attacks to software applications are on the rise as more people use Internet of things (IoT) devices and high-speed internet. When a software system crash happens caused by malicious action, a malware imaging method can examine the application. In this study, we present a novel malware classification method that captures suspected operations in a variety of discrete size image features, allowing us to identify such IoT device malware families. To decrease deep neural network training time, essential local and global image features are selected using a combined local and global feature descriptor (LBP-GLCM). The classification performance of the proposed deep learning model is improved by combining the predictions of weak learners (CNNs) and using them as knowledge input to a multi-layer perceptron meta learner. This is a neural network ensemble with stacked generalization that is used to improve network generalization ability. The public dataset used for performance evaluation contains 5472 samples from 11 different malware families. In order to compare the proposed methodology to current malware detection systems, we developed a baseline experiment. The proposed approach improved malware classification results to 98.5% accuracy and 98.4% accuracy when using [Formula: see text] and [Formula: see text] image sizes, respectively. Overall, the results showed that the stacked generalization ensemble with multi-step extracting features is a more effective method for classification performance and response time.

On the relativity of time: Implications and challenges of data drift on long-term effective android malware detection

The vast body of research in the Android malware detection domain has demonstrated that machine learning can provide high performance for mobile malware detection. However, the learning models have been usually evaluated with data sets encompassing short time frames, generating doubts about the feasibility of these models in operational settings that deal with the ever-evolving malware threat landscape. Although a limited number of studies have developed concept drift resilient models for handling data drift, they have never considered the impact of different timestamps on the detection solutions. Timestamps are critical to locating the data samples within the historical timeline. Different timestamping approaches may locate samples differently, which, in turn, can significantly impact the performance of the model and, consequently, the adaptive capabilities of the system to concept drift. In this study, we conducted a comprehensive benchmarking that compares the detection performance of six distinct timestamping approaches for static and dynamic feature sets. Our experiments have demonstrated that timestamp selection is an important decision that has a significant impact on concept drift modeling and the long-term performance of the model regardless of the feature type used for model construction.

Explainable Artificial Intelligence-Based IoT Device Malware Detection Mechanism Using Image Visualization and Fine-Tuned CNN-Based Transfer Learning Model.

Automated malware detection is a prominent issue in the world of network security because of the rising number and complexity of malware threats. It is time-consuming and resource intensive to manually analyze all malware files in an application using traditional malware detection methods. Polymorphism and code obfuscation were created by malware authors to bypass the standard signature-based detection methods used by antivirus vendors. Malware detection using deep learning (DL) approaches has recently been implemented in an effort to address this problem. This study compares the detection of IoT device malware using three current state-of-the-art CNN models that have been pretrained. Large-scale learning performance using GNB, SVM, DT, LR, K-NN, and ensemble classifiers with CNN models is also included in the results. In light of the findings, a pretrained Inception-v3 CNN-based transfer learned model with fine-tuned strategy is proposed to identify IoT device malware by utilizing color image malware display of android Dalvik Executable File (DEX). Inception-v3 retrieves the malware's most important features. After that, a global max-pooling layer is applied, and a SoftMax classifier is used to classify the features. Finally, gradient-weighted class activation mapping (Grad-CAM) along the t-distributed stochastic neighbor embedding (t-SNE) is used to understand the overall performance of the proposed method. The proposed method achieved an accuracy of 98.5% and 91%, respectively, in the binary and multiclass prediction of malware images from IoT devices, exceeding the comparison methods in different evaluation parameters.

Cybersecurity Threats and Their Mitigation Approaches Using Machine Learning—A Review

Machine learning is of rising importance in cybersecurity. The primary objective of applying machine learning in cybersecurity is to make the process of malware detection more actionable, scalable and effective than traditional approaches, which require human intervention. The cybersecurity domain involves machine learning challenges that require efficient methodical and theoretical handling. Several machine learning and statistical methods, such as deep learning, support vector machines and Bayesian classification, among others, have proven effective in mitigating cyber-attacks. The detection of hidden trends and insights from network data and building of a corresponding data-driven machine learning model to prevent these attacks is vital to design intelligent security systems. In this survey, the focus is on the machine learning techniques that have been implemented on cybersecurity data to make these systems secure. Existing cybersecurity threats and how machine learning techniques have been used to mitigate these threats have been discussed. The shortcomings of these state-of-the-art models and how attack patterns have evolved over the past decade have also been presented. Our goal is to assess how effective these machine learning techniques are against the ever-increasing threat of malware that plagues our online community.