PE Header Research Articles

Zero-Ran Sniff: A zero-day ransomware early detection method based on zero-shot learning

Ransomware attacks, which blackmail victims into paying a ransom by locking their devices or encrypting their files, have become one of the major threats to network security. Conventional anti-ransomware tools often fail to detect zero-day ransomware attacks due to the inability to obtain zero-day ransomware signatures in advance to train detection models. In addition, zero-day ransomware attacks often use sophisticated encryption techniques to launch attacks on new vulnerabilities, and these encryption attacks cause irreversible damage to victims' digital files even if they choose to pay a ransom. Hence, it is imperative and urgent to detect unknown ransomware attacks at the earliest possible stage, ideally before the encryption phase. To this end, this paper proposes Zero-Ran Sniff (ZRS), an early zero-day ransomware detection method based on zero-shot learning, which can detect zero-day ransomware attacks in the early stage. ZRS leverages the portable executable header (PE header) feature from executable files to identify ransomware. It comprises two stages: an auto-encoding network-based core attribute learning (AE-CAL) stage and a self-attentive mechanism-based convolutional neural network inference Stage (SA-CNN-IS). During the AE-CAL stage, the core features of known and unknown classes of ransomware are extracted using self-encoding networks, and the SA-CNN-IS phase identifies ransomware. To the best of our knowledge, we are the first to explore the use of zero-shot learning for zero-day ransomware early detection. Experimental results demonstrate that the proposed ZRS outperforms traditional machine learning methods. Compared to previous zero-day detection work, ZRS achieves a recall of 98.47% and an accuracy of 96.31%

A Machine Learning-Based PE Header Analysis for Malware Detection

The malware is file or piece of code which is delivered over network that infects or conducts any behavior as attacker desired. So, it is one of the most serious threats to modern world specially who are in touch of computerand information technology. The older signature-based detection is not convenient all the time. This was not the perfect approach as it was detection which uses unique signature or digital footprint from software running on secured system. This method is used in antivirus programs. These programs scan any software program and try to identify the signatures. These signatures are then compared to signature of known malwares. But signatures may not be known to us every time. This method has some lots of limitations. It is unable to the new patterns or indicators of new threats that are not already known. As a result, security professionals often this method in conjunction with tools that provide context into their network behavior. The PE is actually file layout that is present in .exe, .dll file formats and other machine level code and their PE headers contains information that can help us distinguish between malicious malware files and legitimate files. This method is helpful to find hidden patterns and to establish new techniques to recognize the files. The virus share suffixedfiles are also the files which performs malicious activities and malware in nature. Even this type of files can be trained and recognized with the help of PE headers-based method to recognize the nature of file. Its possible to identify the malware by looking at some key features from headers such as checksum, section name, initialized data Size, DLL characteristics and major image version.Looking at the PE header is much faster than scanning the whole information in the PE. Thus, the prediction of files are possible even with faster rate. In this paper, we will understand the different attributes available in PE headers to carefully analyses the trends and to distinguish the given executable files as malicious or legitimate on basis of PE headers using advance machine learning algorithms.

Detecting Malicious .NET Files Using CLR Header Features and Machine Learning

The .Net Framework has made writing windows applications easier than ever. Several programming languages can be used to write software using the .Net Framework, the most common one being C#. Due to the abundance of modules and pre-built functionalities that allow programmers to easily manipulate the windows operating system with high abstraction and no need for low-level coding, the .Net framework has also become a desirable environment for malicious actors to write their malware. To best of our knowledge, researchers have been treating .NET malware and other malware the same way by utilizing features from the PE header to classify the files. This is not possible for.Net files because their PE headers are nearly identical. In this paper, we tackle the problem of detecting malicious .Net files by extracting features from the CLR header. As far as we know, we are the first ones to explore this approach. Furthermore, we create a new dataset comprised of.Net malware and benign files, which we freely distribute to the research community. Finally, we assess the performance of several machine learning algorithms to detect malicious .NET files. The random forest model was the best solution among the set of algorithms tested, exhibiting a performance of 92% for this predictive task.

Malware Detection System Using Mathematics of Random Forest Classifier

Most cyberattacks including data breaches, identity theft, fraud, and other issues, are known to be caused by malware. Some of the malware attacks are categories as adware, spyware, virus, worm, trojan, rootkit, backdoor, ransomware and command and control (C&C) bot, based on its purpose and behaviour. Malware detectors still utilise signature-based approaches to detect malicious software, which can only detect known malware. Attacks by malware pose a serious threat to people's and organizations' cybersecurity globally. These attacks are occurring more frequently and more frequently lately. Over eight billion malware attacks occurred in 2020, up 4% over the previous year, according to a Symantec report. It is crucial that computer users safeguard their computers with a malware detector like an antivirus, anti-spyware, etc. When creating a machine learning model to differentiate between malicious and benign files, it might be challenging to use domain-level expertise to extract the necessary attributes. This research aims to create a malware detector that uses a trained random forest classifier model to find malware and stop zero-day assaults. A dataset (including both harmful and benign software PE header information) was obtained from virusshare.com and used to train the random forest classifier in order to create this malware detector. The Random Forest Classifier generate greater accuracy when compared with other machine learning classifiers, such as KNN (K-Nearest Neighbors), Decision Tree, Logistic Regression etc., the random forest classifier gives a better accuracy of 99.4%. The Classifier model used here will be a better option to use in order to efficiently and effectively detect malware, it shows that the methodology can be utilized as the basis for an operational system for detecting an unknown malicious executable.

Malware Analysis with Machine Learning: Classifying Malware based on PE Header

Abstract: If we study the adventures of malware, it has been since the evolution of the computer itself. Since then, they have been a fascinating tool for hackers to exploit computers. Due to the advancement of technology, the malware also has been becoming more complex and hard to detect which in turn creates a cat and mouse chase between security researchers and hackers trying to outsmart each other. While traditional anti-virus softwares are failing to detect these malware variants, in consequence, new technologies have to be adapted to detect them. This paper presents an approach to detect malware using machine learning techniques. This paper explores different malware detection techniques and how ML can be integrated to make it more reliable. ML models are trained with PE features of malware and benign executables. It is observed that the model predicts with 99.4% accuracy. This approach would help researchers to understand and develop more sophisticated antiviruses to detect even complex malware

Detecting Malware in Portable Executable Files using Machine Learning Approach

There have been many solutions proposed to increase the ability to detection of malware in executable files in general and in Portable Executable files in particular. In this paper, we rely on the PE header structure of Portable Executablefiles to propose another approach in using Machine learning to classify these files, as malware files or benign files. Experimental results show that the proposed approach still uses the Random Forest algorithm for the classification problem but the accuracy and execution time are improved compared to some recent publications (accuracy reaches 99.71%).

A novel approach for ransomware detection based on PE header using graph embedding

A novel approach for ransomware detection based on PE header using graph embedding

Malicious Code Detection Method Based on Static Features and Ensemble Learning

In recent years, malicious code emerges in endlessly. New types of malicious code evade the traditional malicious code detection technology through polymorphism, shelling, confusion and other ways. In order to solve the challenges brought by various technologies to the research of malicious code detection, in this paper, we propose a malicious code detection method based on static features and ensemble learning. This method extracts the information in the PE header file of malicious code samples as static features, and on this basis, builds a malicious code detection model by using stacking ensemble learning. In order to verify the effectiveness of the model, experiments are carried out on a dataset containing 5000 malicious codes and 4943 benign codes. Experiments show that the classification model based on stacking ensemble learning is the best, with 97.22% precision rate and 96.45% stable F1 score.

Ransomware Detection Based on PE Header Using Convolutional Neural Networks

With the spread of information technology in human life, data protection is a critical task. On the other hand, malicious programs are developed, which can manipulate sensitive and critical data and restrict access to this data. Ransomware is an example of such a malicious program that encrypts data, restricts users' access to the system or their data, and then request a ransom payment. Many types of research have been proposed for ransomware detection. Most of these methods attempt to identify ransomware by relying on program behavior during execution. The main weakness of these methods is that it is not explicit how long the program should be monitored to show its real behavior. Therefore, sometimes, these researches cannot detect ransomware early. In this paper, a new method for ransomware detection is proposed that does not need executing the program and uses the PE header of the executable file. To extract effective features from the PE header file, an image is constructed based on PE header. Then, according to the advantages of Convolutional Neural Networks in extracting features from images and classifying them, CNN is used. The proposed method achieves high detection rates. Our results indicate the usefulness and practicality of our method for ransomware detection.

Influence of amphotericin B on the thermodynamic properties and surface morphology of saturated phospholipid monolayer with different polar head at the air-water interface

Amphotericin B is not only a widely used antifungal drug, but also a potential novel immunotherapy anticancer drug. But it has great side effects on human body due to its pore-forming activity on cell’s membrane. Some researchers have found that AmB can form pores on the phospholipid monolayer in the absence of sterol. However, the effect of different polar heads of phospholipids on the pore-forming activity of AmB on the membrane is rarely reported. In this work, the influence of amphotericin B on the thermodynamic properties and surface morphology of saturated phospholipid monolayer with different polar head at the air-water interface have been studied. The results suggested that the intermolecular force between AmB and DPPC or DPPE molecules was attractive but the force between AmB and DPPG or DPPS molecules was repulsive. No matter what kind of phospholipid’s polar head, AmB can enhance the disorder of the AmB/phospholipid mixed monolayer. But at 30 mN/m, this effect of AmB from strong to weak was in the presence of PS head, PG head, PC head and PE head. And the drug can induce the phase state of the phospholipid monolayer to change from LC phase to LC-LE phase at 30 mN/m. Differently, the shape and distribution of LC phase domains in the mixed monolayer film with non-charged head group were different from that with negatively charged head group, which may be due to the intermolecular force between AmB and different phospholipid. The results are helpful to understand the influence of AmB on the domains without sterols on cell membrane, to lay the foundation for the interaction between AmB and phospholipid-sterol binary model membranes in the further study and to provide a basis for understanding the interaction between AmB and liposome materials.

Malware Detection Based on Multiple PE Headers Identification and Optimization for Specific Types of Files

This paper follows our previous research in which we made a basic experiment to find out if it is possible to detect malware by multiple PE header detection. The previous results show us that there is a considerable amount of malwares that connect themselves to another file. This paper summarizes our previous results, updates the results and also expands them by adding an optimization method and also by including the scan of another (specific) types of data. This is an Open Access article distributed under the terms of the Creative Commons Attribution License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

Polyethylene‐Based Tadpole Copolymers

Novel well‐defined polyethylene‐based tadpole copolymers {(c‐PE)‐b‐PS, PE: polyethylene, PS: polystyrene} with ring PE head and linear PS tail are synthesized by combining polyhomologation, atom transfer radical polymerization (ATRP), and Glaser coupling reaction. The OH groups of the 3‐miktoarm star copolymers (PE‐OH)2‐b‐PS, synthesized by polyhomologation and ATRP, are transformed to alkyne groups by esterification with propiolic acid, followed by Glaser cyclization and removal of the unreacted linear with Merrifield's resin–azide. The characterization results of intermediates and final products by high‐temperature size exclusion chromatography, 1H NMR spectroscopy, and differential scanning calorimetry confirm the tadpole topology. image

Static Malware Detection System Using Data Mining Methods

A serious threat today is malicious executables. It is designed to damage computer system and some of them spread over network without the knowledge of the owner using the system. Two approaches have been derived for it i.e. Signature Based Detection and Heuristic Based Detection. These approaches performed well against known malicious programs but cannot catch the new malicious programs. Different researchers have proposed methods using data mining and machine learning for detecting new malicious programs. The method based on data mining and machine learning has shown good results compared to other approaches. This work presents a static malware detection system using data mining techniques such as Information Gain, Principal component analysis, and three classifiers: SVM, J48, and Naive Bayes. For overcoming the lack of usual anti-virus products, we use methods of static analysis to extract valuable features of Windows PE file. We extract raw features of Windows executables which are PE header information, DLLs, and API functions inside each DLL of Windows PE file. Thereafter, Information Gain, calling frequencies of the raw features are calculated to select valuable subset features, and then Principal Component Analysis is used for dimensionality reduction of the selected features. By adopting the concepts of machine learning and data-mining, we construct a static malware detection system which has a detection rate of 99.6%.

Host Defense Peptides: Molecular Details of Attack on Bacterial and Neoplastic Mammalian Model Membranes

Membrane-active host defense peptides constitute a key part of the initial immune response in multicellular organisms. They interact with anionic lipids of bacterial membranes and are also active against neoplastic mammalian membranes. The non-specific nature of these interactions reduces the propensity for developing resistance to antimicrobial and anticancer therapies but makes development of highly effective peptides a challenging task. Various mechanisms of peptide-membrane activity were proposed, but the molecular picture is still incomplete. We employ our novel highly mobile membrane mimetic (HMMM) model with enhanced lipid mobility, combined with all-atom molecular dynamics simulations to investigate structural and dynamic properties determining initial lipid-peptide interactions of magainin 2 (MAG2) and its highly charged variant, paxiganan (MSI-78). Extended multiple simulations were performed of MAG2 and MSI-78 monomers with HMMM binary membranes representing bacterial (PE/PG) and neoplastic (PC/PS) membranes. Spontaneous association of the peptides with the membranes lead to significant clustering of anionic lipids in both membrane models, lending support to the lipid clustering model as a potential first stage of the interaction. Interestingly, membrane surface rupture was observed as a result of lipid rearrangement. PE/PG membranes appear to be more susceptible than PC/PS to rupture by both peptides, which correlates well with recent experimental observations. PE/PG appears to offer easier entry for the charged residues due to hydrogen bonding and lack of positive charges on the PE head groups that may repel the cationic peptides. We propose a “sweep-and-anchor” mechanism that initiates membrane rupture: initial clustering of charged lipids by the charged residues is creating more loose domain boundaries in which hydrophobic residues can penetrate, creating a pore in membrane leaflet. Prior to the development of the HMMM method these inquiries were out of reach of atomistic simulations.

Time-Resolved UV-Visible Studies of Rhodopsin Provide Experimental Test of Flexible Surface Model for Lipid-Protein Interactions

Time-resolved UV/Visible absorbance of the retinal chromophore of rhodopsin [1] delivers vital information about key GPCR activation steps in a membrane lipid environment [2]. Following rhodopsin photoexcitation, a minimum of four intermediates equilibrate on the millisecond-time scale [2,3]. The first equilibrium is between the protonated Schiff base (PSB) species Meta I480 and the deprotonated SB species Meta IIa and is pH independent. A second equilibrium entails spectrally silent conversion of Meta IIa to the Meta IIb substate. The final step is protonation of Glu134 of the ERY sequence in Meta IIb to yield Meta IIbH+ whose pKa characterizes the acid-base equilibrium [3]. Absorbance measurements on the microsecond-to-hundred millisecond-time scale allowed us to study effects of POPC, DOPC, or DOPC/DOPE mixtures on the first equilibrium constant K1 and on the pKa of the final equilibrium. Results were analyzed by singular-value decomposition and were fit by a linear combination of temperature-dependent basis spectra. Notably an increase in K1 was discovered due to either PE head groups or increased acyl chain unsaturation, whereas little change in pKawas evident. According to the flexible-surface model (FSM) rhodopsin becomes a sensor of negative spontaneous (intrinsic) curvature upon light activation [4]. Competition between the curvature elastic energy and the hydrophobic mismatch at the proteolipid boundary explains the influences of lipid-protein interactions [4]. Both the lipid acyl chains and polar head groups affect the Meta I-Meta II transition, revealing how protein energetics are affected by material properties of the lipid bilayer.[1] A.V. Struts et al. (2011) Nature Struct. Mol. Biol. 18, 392-394.[2] J. Epps et al. (2006) Photochem. Photobiol. 82, 1436-1441.[3] M. Mahalingam et al. (2008) PNAS 105 17795-17800.[4] A. V. Botelho et al. (2006) Biophys. J. 91, 4464-4477.

Flexible Surface Model Explains Time-Resolved Uv-Visible Studies of Rhodopsin Activation in a Membrane Lipid Environment

Rhodopsin is the quintessential GPCR--the UV/Visible absorbance of its bound chromophore provides detailed time-resolved information about the GPCR activation steps [1]. At least four species equilibrate on the millisecond time scale after rhodopsin photoexcitation in a membrane environment [2]. The first millisecond-time scale equilibrium is between the protonated Schiff base (PSB) species Meta I480 and the deprotonated SB species Meta IIa and is pH independent. Subsequent equilibria involve spectrally silent transitions of Meta IIa to produce Meta IIb and protonation of Glu134 of the E(R)Y sequence in Meta IIb to give Meta IIbH+ where pKa describes the acid-base equilibrium. We used time-resolved absorbance measurements on the microsecond-to-hundred millisecond time scale to study effects of the membrane lipid environment on the first equilibrium constant, K1, and on the pKa of the final equilibrium. Reconstituted membranes of rhodopsin with POPC, DOPC, or DOPC/DOPE mixtures were studied at 30oC. Results were analyzed by singular value decomposition and globally fit to a sum of exponential terms. We discovered a striking increase in K1 due to either PE head groups or increased acyl chain unsaturation; by contrast pKa changed little. According to the flexible surface model (FSM), there is competition between the curvature elastic energy and the hydrophobic mismatch at the proteolipid boundary that explains the above influences of lipid-protein interactions [3]. The fact that both the lipid acyl chains and polar head groups affect the Meta I-Meta II transition of rhodopsin is a striking illustration of how protein energetics in membranes are governed by chemically nonspecific properties of the lipid bilayer. [1] J. Epps et al. (2006) Photochem. Photobiol.82, 1436-1441. [2] E. Zaitseva et al. (2010) JACS132, 4815-4821. [3] A.V. Botelho et al. (2006) BJ91, 4464-4477.

Lubrication Properties of Hydrogel-Coated Polyethylene Head

Frictional behavior of stainless steel cup against polyethylene head coated with dimethylacrylamide (DMAA) hydrogel was studied using a pendulum type friction tester. The friction coefficient of the pairs lubricated with Hyaluronic acid aq (HA) was as about 0.01, which is similar to that of living human hip or knee joint. The friction of the pair increased with loading time. When the coated head was immersed in the HA lubricant during an interval of repeated swing motions of the pendulum, the friction coefficient was above low value. The friction coefficient of the pair lubricated with a hydrophobic liquid (silicone oil) was as a high value of 0.4, close to the value without any lubricant. The friction coefficients of pairs lubricated with HA were not dependent on the load. The coefficients of friction lubricated with the biological factor (albumin, phospholipid) additive HA showed a little increase. Especially with albumin, the coefficient of friction increased with load. This behavior may be caused by the attachment albumin to hydrophilic high molecular chain by chemical adsorption. From these experimental observations, it is surmised that the low friction shown in coated PE head is caused by the formation of highly viscous zone through hydration of DMAA at the solid/liquid interface.

Characterization of a phospholipid adduct formed in Sprague Dawley rats by chloroform metabolism: NMR studies.

The formation of a covalent adduct to a single phospholipid by the oxidative chloroform metabolite, phosgene, is demonstrated in liver mitochondria of phenobarbital-pretreated Sprague Dawley (SD) rats treated with CHCl3. The densitometric analysis of the phosphorus stained extracted phospholipids showed that the formation of this adduct in liver mitochondria is accompanied by a decrease of phosphatidylethanolamine and cardiolipin. The characterization of this adduct was performed with a multinuclear NMR approach by comparison with the decreased phospholipids. Treatment of rats with [13C]chloroform resulted in an intense 13C NMR peak from either an esteric or amidic carbonyl. Very strong similarities in fatty acid composition were found between phosphatidylethanolamine and the phosgene-modified PL, using 13C and 1H NMR spectroscopy. A multiplet at 3.91 ppm coupled to a signal at 3.41 ppm was shown by two-dimensional 1H NMR in the adduct spectrum. This cross peak was interpreted as arising from the shifted resonances of the two PE head group methylene groups, due to the binding with phosgene. 31P spectrum of the adduct was identical to that of phosphatidylethanolamine. We concluded that the chloroform adduct is a modified phosphatidylethanolamine, with the phosgene-derived carbonyl bound to the amine of the head group.

Infrared spectroscopic characterization of the interaction of ascorbyl palmitate with phospholipid bilayers

The interaction of ascorbyl palmitate (AP) with phospholipid bilayers of 1,2-dipalmitoyl-sn-glycero-3-phosphocholine (DPPC), 1,2-dimyristoyl-sn-glycero-3-phosphoethanolamine (DMPE), and 1,2-dipalmitoyl-sn-glycero-3-phosphoethanolamine (DPPE) has been studied by variable temperature infrared spectroscopy. The incorporation of AP into these lipid bilayers induces a considerable increase in the gel to liquid-crystal phase transition temperature of the lipid. The increase in this temperature is dependent on the nature of the lipid head group, on the relative concentration of AP, and on its degree of ionization; i.e., smaller temperature increases are observed when AP is ionized, forming salts with cations (NH4+, Li+, K+, and Ca2+). The stabilizing effect of the long chains in the bilayers plays an important role in inducing temperature increases. However, in the case of AP the present data also demonstrate that specific interactions at the polar head group serve to further stabilize the incorporation of AP into lipid bilayers. The infrared spectra demonstrate that in the case of DPPC:AP mixtures there are changes compatible with the formation of hydrogen bonds between the OH group at position 3 in AP and the ester carbonyl group at the sn-2 chain in DPPC. in the case of PE:AP mixtures the spectra are compatible with AP intercalated between PE head groups acting as a hydrogen bond bridge linking the phosphate and ammonium groups of two different PE molecules.

Influence of phospholipid peroxidation on the phase behavior of phosphatidylcholine and phosphatidylethanolamine in aqueous dispersions.

The influence of oxygen-induced phospholipid peroxidation on the phase behavior of aqueous dispersions of both egg phosphatidylcholine (egg-PC) and egg phosphatidylethanolamine (egg-PE) has been investigated. Phospholipid peroxidation was followed via malondialdehyde formation and analyses of acyl chain compositions. 13C nuclear magnetic resonance spectroscopy (NMR) and the amino-indicating probe trinitrobenzenesulfonic acid were used to study the effect of peroxidation on the chemical structure of hydrated egg-PE. The macroscopic organization of the phospholipids was monitored by 31P NMR and small-angle X-ray diffraction. Differential scanning calorimetry was employed to study the influence of peroxidation on the thermotropic behavior of egg-PE. The results show that egg-PE is more sensitive to the effects of peroxidation than egg-PC. In the latter, no changes in the macromolecular organization were observed. However, peroxidation strongly influenced the polymorphic phase behavior of PE. Initial peroxidation stabilized hydrated egg-PE in a lamellar system up to 70 degrees C, presumably by modification of the head group. Such modifications were confirmed by 13C NMR experiments, which indicated the formation of Schiff bases between PE head groups and aldehydes. Furthermore, quantitative analyses of trinitrobenzenesulfonic acid reactable egg-PE and the corresponding fatty acid compositions revealed the presence of cross-links between the ethanolamine head groups, likely involving the bifunctional malondialdehyde. Prolonged peroxidation of egg-PE resulted in a loss of order in the system, possibly by the formation of intermediate nonbilayer structures.