Signature-based Detection Techniques Research Articles

SDN-based detection and mitigation of DDoS attacks on smart homes

The adoption of the Internet of Things (IoT) has proliferated across various domains, where everyday objects like refrigerators and washing machines are now equipped with sensors and connected to the internet. Undeniably, the security of such devices, which were not primarily designed for internet connectivity, is of utmost importance but has been largely neglected. In this paper, we propose a framework for the real-time DDoS attack detection and mitigation in SDN-enabled smart home networks. We capture network traffic during regular operations and during DDoS attacks. This captured traffic is used to train several machine learning (ML) models, including Support Vector Machine (SVM), Logistic Regression, Decision Trees, and K-Nearest Neighbors (KNN) algorithms. These trained models are executed as SDN controller applications and subsequently employed for real-time attack detection. While we utilize ML techniques to protect IoT devices, we propose the use of SNORT, a signature-based detection technique, to secure the SDN controller itself. Real-world experiments demonstrate that without SNORT, the SDN controller goes offline shortly after an attack, resulting in a 100% packet loss. Furthermore, we show that ML algorithms can efficiently classify traffic into benign and attack traffic, with the Decision Tree algorithm outperforming others with an accuracy of 99%.

Effects of Ransomware: Analysis, Challenges and Future Perspective

This review paper highlights the challenges and best practices in malware analysis, specifically focusing on the age of ransomware. It provides an overview of malware and its impact on computer systems and user privacy by lists various types of malware, including viruses, Trojans, spyware,adware, worms and highlights major malware attacks including the methods used and the resulting damages. Further, the article explores the challenges faced in ransomware analysis, including advanced encryption and evasion techniques, anti-analysis mechanisms, zero-day exploits and vulnerabilities, polymorphic and dynamic behavior, lack of resources, complexity of ransomware, collaboration difficulties, and cost implications. These challenges make it necessary for security researchers to constantly update their knowledge and techniques to effectively analyze ransomware. This study concludes best practices for ransomware analysis including isolating and segmenting ransomware samples in controlled environments, emphasizing behavior analysis and threat hunting, investing in advanced reverse engineering and automated analysis techniques, promoting collaborative intelligence and information sharing, and implementing security measures to protect against ransomware attacks. Additionally, the article briefly mentions static analysis techniques which explains that static analysis involves examining malware files and code without executing them. It can be used to identify ransomware characteristics, such as encryption algorithms, ransom demands, remote command execution, and obfuscation techniques. Moreover, file and code analysis methods, signature-based detection, code deobfuscation and unpacking techniques, and malicious document analysis and exploit detection are also suggested as part of static analysis.

Transfer Learning Approach for Malware Images Classification on Android Devices Using Deep Convolutional Neural Network

More malware types are being developed today to carry out numerous destructive operations due to the Internet and software industries' rapid expansion. Malware variants cannot be detected using conventional signature-based detection techniques. Given their escalating complexity and volume, dealing with malware is becoming more and more difficult. Many researchers have become interested in malware analysis, detection, and classification in recent years. This topic has been approached using a variety of techniques based on machine learning (ML), computer vision, and deep learning, which have shown some useful results. Antivirus software and conventional detection methods have poor accuracy. Furthermore, there aren't enough samples overall, particularly when it comes to malware samples, and the representativeness of the malware features that have been discovered is still weak. The types and quantity of samples in the malware sample dataset need to be regularly improved. The hybrid model's computing requirements are greater than those of the single model and the conventional machine learning techniques. Transfer learning, on the other hand, deals with the issue of how to use a large amount of labeled data based on existing Deep Learning models that have been pre-trained on enormous image datasets to solve related but distinct problems in a target domain, even when the training and testing problems have different distributions or features, thus dealing with the issue of building a model from scratch. We propose an Android malware image classifier that leverages transfer learning based on convolutional neural network (TL-CNN) architectures to distinguish between benign and malignant images in response to this success. According to experimental findings, the proposed model had the highest detection accuracy, scoring an average of 97.24% followed by the hybrid DBN-GRU with an average accuracy score of 96.82%. the other deep learning algorithms (DBN and GRU) show competitive results with accuracies of 94.55% and 92.50% respectively. These results suggest that deep learning algorithms have overall superior performance compared to the convention machine learning algorithms which includes (SVM with 90.57%, KNN with 83.36% and NB with 82.27%). This result suggests that transfer learning has the advantage of decreasing the training time for a learning model and can result in lower generalization error with better accuracy compared to the conventional approach of training a model from scratch.

Sensitivity and reliability of key electrochemical markers for detecting lithium plating during extreme fast charging

Lithium plating is one of the key challenges for enabling extreme fast charging (XFC, ≤10 to 15 min charging at ≥6C) in graphite-based lithium-ion batteries. Significant R&D effort has been focused on how to mitigate Li plating. Parallel effort is also being devoted to developing methods to detect Li plating when and if it happens during fast charging. In that regard, electrochemical (EC) signature-based detection techniques are less resource intensive, more convenient, and more practical from an end-user application perspective. However, a comprehensive understanding of key plating related EC signatures for extreme fast charging is presently unavailable. In particular, there exist distinct issues of unreliability with key plating-related EC signatures—e.g., incremental capacity (dQ.dV−1), differential OCV (dOCV.dt−1), end of lithiation (EOL) rest voltage—at XFC conditions, and the underlying reasons have not been explored and identified methodically. Using a comprehensive test matrix and XFC conditions with Li/graphite half cells, this article highlights the unreliability issues associated with the EC Li plating diagnostics and explains the underlying root cause. This study finds distinct sensitivity and unreliability issues with plating related dQ.dV−1, dOCV.dt−1, and EOL rest voltage signatures with charging rates. The complex interaction between graphite and plated Li that happens through multiple competing mechanisms —Li stripping and chemical intercalation— at different charging rates is at the core of the sensitivity and unreliability issue.

A survey on the application of deep learning for code injection detection

Code injection is one of the top cyber security attack vectors in the modern world. To overcome the limitations of conventional signature-based detection techniques, and to complement them when appropriate, multiple machine learning approaches have been proposed. While analysing these approaches, the surveys focus predominantly on the general intrusion detection, which can be further applied to specific vulnerabilities. In addition, among the machine learning steps, data preprocessing, being highly critical in the data analysis process, appears to be the least researched in the context of Network Intrusion Detection, namely in code injection. The goal of this survey is to fill in the gap through analysing and classifying the existing machine learning techniques applied to the code injection attack detection, with special attention to Deep Learning. Our analysis reveals that the way the input data is preprocessed considerably impacts the performance and attack detection rate. The proposed full preprocessing cycle demonstrates how various machine-learning-based approaches for detection of code injection attacks take advantage of different input data preprocessing techniques. The most used machine learning methods and preprocessing stages have been also identified.

Comparison study of machine learning classifiers to detect anomalies

In this era of Internet ensuring the confidentiality, authentication and integrity of any resource exchanged over the net is the imperative. Presence of intrusion prevention techniques like strong password, firewalls etc. are not sufficient to monitor such voluminous network traffic as they can be breached easily. Existing signature based detection techniques like antivirus only offers protection against known attacks whose signatures are stored in the database.Thus, the need for real-time detection of aberrations is observed. Existing signature based detection techniques like antivirus only offers protection against known attacks whose signatures are stored in the database. Machine learning classifiers are implemented here to learn how the values of various fields like source bytes, destination bytes etc. in a network packet decides if the packet is compromised or not . Finally the accuracy of their detection is compared to choose the best suited classifier for this purpose. The outcome thus produced may be useful to offer real time detection while exchanging sensitive information such as credit card details.

Two-Stage Ransomware Detection Using Dynamic Analysis and Machine Learning Techniques

Detecting ransomware is harder than general malware because of the ever-increasing number of ransomwares with different signatures, which makes traditional signature-based detection technique powerless against ransomware. Current ransomware detection techniques usually build a complex model that incorporates various behavioral traits. The traits include suspicious file activities, API call pattern or frequency, registry keys, file extensions, etc. In this paper, we build a two-stage mixed ransomware detection model, Markov model and Random Forest model. First we focus on Windows API call sequence pattern and build a Markov model to capture the characteristics of ransomware. Next we build Random Forest machine learning model to the remaining data in order to control both false positive (FPR) and false negative (FNR) error rates. As a result of our two-stage mixed detection method we can achieve overall accuracy 97.3% with 4.8% FPR and 1.5% FNR.

Obfuscated computer virus detection using machine learning algorithm

Nowadays, computer virus attacks are getting very advanced. New obfuscated computer virus created by computer virus writers will generate a new shape of computer virus automatically for every single iteration and download. This constantly evolving computer virus has caused significant threat to information security of computer users, organizations and even government. However, signature based detection technique which is used by the conventional anti-computer virus software in the market fails to identify it as signatures are unavailable. This research proposed an alternative approach to the traditional signature based detection method and investigated the use of machine learning technique for obfuscated computer virus detection. In this work, text strings are used and have been extracted from virus program codes as the features to generate a suitable classifier model that can correctly classify obfuscated virus files. Text string feature is used as it is informative and potentially only use small amount of memory space. Results show that unknown files can be correctly classified with 99.5% accuracy using SMO classifier model. Thus, it is believed that current computer virus defense can be strengthening through machine learning approach.

An empirical study to estimate the stability of random forest classifier on the hybrid features recommended by filter based feature selection technique

The emergence of advanced malware is a serious threat to information security. A prominent technique that identifies sophisticated malware should consider the runtime behaviour of the source file to detect malicious intent. Although the behaviour-based malware detection technique is a substantial improvement over the traditional signature-based detection technique, current malware employs code obfuscation techniques to elude detection. This paper presents the Hybrid Features-based malware detection system (HFMDS) that integrates static and dynamic features of the portable executable (PE) files to discern malware. The HFMDS is trained with prominent features advised by the filter-based feature selection technique (FST). The detection ability of the proposed HFMDS has evaluated with the random forest (RF) classifier by considering two different datasets that consist of real-world Windows malware samples. In-depth analysis is carried out to determine the optimal number of decision trees (DTs) required by the RF classifier to achieve consistent accuracy. Besides, four popular FSTs performance is also analyzed to determine which FST recommends the best features. From the experimental analysis, we can infer that increasing the number of DTs after 160 within the RF classifier does not make a significant difference in attaining better detection accuracy.

Malware Detection by Static Checking and Dynamic Analysis of Executables

The advanced malware continue to be a challenge in digital world that signature-based detection techniques fail to conquer. The malware use many anti-detection techniques to mutate. Thus no virus s...

Malware Detection by Static Checking and Dynamic Analysis of Executables

The advanced malware continue to be a challenge in digital world that signature-based detection techniques fail to conquer. The malware use many anti-detection techniques to mutate. Thus no virus scanner can claim complete malware detection even for known malware. Static and dynamic analysis techniques focus upon different kinds of malware such as Evasive or Metamorphic malware. This paper proposes a comprehensive approach that combines static checking and dynamic analysis for malware detection. Static analysis is used to check the specific code characteristics. Dynamic analysis is used to analyze the runtime behavior of malware. The authors propose a framework for the automated analysis of an executable's behavior using text mining. Text mining of dynamic attributes identifies the important features for classifying the executable as benign and malware. The synergistic combination proposed in this paper allows detection of not only known variants of malware but even the obfuscated, packed and unknown malware variants and malware evasive to dynamic analysis.

Behavioural Analysis of Android Malware using Machine Learning

The arrival of android platforms with increased storage capabilities, better visualisations, computing competencies and the ubiquitous use of these platforms in the field of e-banking, online banking, business, and the storage of sensitive information on these devices, android platform is becoming the most targeted platform by malwares. They are primarily spread via repackaged apps to piggyback payload, update attacks, and drive by downloads. Malware constitutes a severe menace to user privacy, money, device and file veracity. It is posing benevolence challenges and difficulties to detect such malwares as signature based detection techniques available today are becoming inefficient in sensing new and anonymous malware. Hence we presents machine learning as an emerging era of modified and latest detection techniques. In this paper we will present various machine learning solutions to counter android malwares that analyse features from malicious application and use those features to classify and detect unknown malicious applications. This paper summarizes the evolution of malware detection techniques based on machine learning algorithms focused on the android OS.

A Machine Learning Approach to Anomaly-Based Detection on Android Platforms

The emergence of mobile platforms with increased storage and computing capabilities and the pervasive use of these platforms for sensitive applications such as online banking, e-commerce and the storage of sensitive information on these mobile devices have led to increasing danger associated with malware targeted at these devices. Detecting such malware presents inimitable challenges as signature-based detection techniques available today are becoming inefficient in detecting new and unknown malware. In this research, a machine learning approach for the detection of malware on Android platforms is presented. The detection system monitors and extracts features from the applications while in execution and uses them to perform in-device detection using a trained K-Nearest Neighbour classifier. Results shows high performance in the detection rate of the classifier with accuracy of 93.75%, low error rate of 6.25% and low false positive rate with ability of detecting real Android malware.

Behavior-based features model for malware detection

The sharing of malicious code libraries and techniques over the Internet has vastly increased the release of new malware variants in an unprecedented rate. Malware variants share similar behaviors yet they have different syntactic structure due to the incorporation of many obfuscation and code change techniques such as polymorphism and metamorphism. The different structure of malware variants poses a serious problem to signature-based detection technique, yet their similar exhibited behaviors and actions can be a remarkable feature to detect them by behavior-based techniques. Malware instances also largely depend on API calls provided by the operating system to achieve their malicious tasks. Therefore, behavior-based detection techniques that utilize API calls are promising for the detection of malware variants. In this paper, we propose a behavior-based features model that describes malicious action exhibited by malware instance. To extract the proposed model, we first perform dynamic analysis on a relatively recent malware dataset inside a controlled virtual environment and capture traces of API calls invoked by malware instances. The traces are then generalized into high-level features we refer to as actions. We assessed the viability of actions by various classification algorithms such as decision tree, random forests, and support vector machine. The experimental results demonstrate that the classifiers attain high accuracy and satisfactory results in the detection of malware variants.

Intrusion Detection with Hidden Markov Model and WEKA Tool

ABSTARCT The internet has become a convenient way for people exchanging information and doing business over the internet. Uptil now, intrusion detection technique has been using either anomaly based or signature based detection technique. The hybrid technique gives advantages of both the techniques. Anomaly detection strategy is to suspect of what is considered an unusual activity for the subject (users, processes, etc.) and carry on further investigation. This approach is particularly effective against novel (i.e. previously unknown) attacks. Signature based detection systems detect previously known attack in a timely and efficient way. The Hybrid technique gives better result than signature based or anomaly based technique alone.

제어시스템 보안을 위한 whitelist 기반 이상징후 탐지 기법

최근 제어시스템을 대상으로 한 사이버공격이 점차 고도화 지능화됨에 따라 기존 시그니처(signature) 기반 탐지 기법은 한계에 봉착하였고, 이에 제어시스템 환경에 적합한 화이트리스트(whitelist) 기반 보안 기법이 새롭게 주목받고 있다. 그러나 최근 개발되고 있는 화이트리스트 기법들은 어플리케이션 레벨에서 한정적으로 사용되고 있으며, 무엇보다 블랙리스트(blacklist) 기반 보안 기법과 달리 이상 징후 유형에 대한 구체적 정보 제공이 불가능하다는 단점이 존재한다. 본 논문에서는 제어시스템에서 발생할 수 있는 이상 징후 유형들을 분류하고, 네트워크 레벨에서의 화이트리스트를 통해 이상 징후를 탐지할 수 있는 모델을 제시한다. Recent cyber attacks targeting control systems are getting sophisticated and intelligent notoriously. As the existing signature based detection techniques faced with their limitations, a whitelist model with security techniques is getting attention again. However, techniques that are being developed in a whitelist model used at the application level narrowly and cannot provide specific information about anomalism of various cases. In this paper, we classify abnormal cases that can occur in control systems of enterprises and propose a new whitelist model for detecting abnormal cases.

Shadow attacks: automatically evading system-call-behavior based malware detection

Contemporary malware makes extensive use of different techniques such as packing, code obfuscation, polymorphism, and metamorphism, to evade signature-based detection. Traditional signature-based detection technique is hard to catch up with latest malware or unknown malware. Behavior-based detection models are being investigated as a new methodology to defeat malware. This kind of approaches typically relies on system call sequences/graphs to model a malicious specification/pattern. In this paper, we present a new class of attacks, namely “shadow attacks”, to evade current behavior-based malware detectors by partitioning one piece of malware into multiple “shadow processes”. None of the shadow processes contains a recognizable malicious behavior specification known to single-process-based malware detectors, yet those shadow processes as an ensemble can still fulfill the original malicious functionality. To demonstrate the feasibility of this attack, we have developed a compiler-level prototype tool, AutoShadow, to automatically generate shadow-process version of malware given the source code of original malware. Our preliminary result has demonstrated the effectiveness of shadow attacks in evading several behavior-based malware analysis/detection solutions in real world. With the increasing adoption of multi-core computers and multi-process programs, malware writers may exploit more such shadow attacks in the future. We hope our preliminary study can foster more discussion and research to improve current generation of behavior-based malware detectors to address this great potential threat before it becomes a security problem of the epidemic proportions.

Corrélations entre IRM et arthroscopie dans les lésions méniscales instables

Code injection is one of the top cyber security attack vectors in the modern world. To overcome the limitations of conventional signature-based detection techniques, and to complement them when appropriate, multiple machine learning approaches have been proposed. While analysing these approaches, the surveys focus predominantly on the general intrusion detection, which can be further applied to specific vulnerabilities. In addition, among the machine learning steps, data preprocessing, being highly critical in the data analysis process, appears to be the least researched in the context of Network Intrusion Detection, namely in code injection. The goal of this survey is to fill in the gap through analysing and classifying the existing machine learning techniques applied to the code injection attack detection, with special attention to Deep Learning. Our analysis reveals that the way the input data is preprocessed considerably impacts the performance and attack detection rate. The proposed full preprocessing cycle demonstrates how various machine-learning-based approaches for detection of code injection attacks take advantage of different input data preprocessing techniques. The most used machine learning methods and preprocessing stages have been also identified.

From the design of a generic metamorphic engine to a black-box classification of antivirus detection techniques

In this paper, we propose an original black-box approach concerning antivirus products evaluation. Contrary to classical tests focusing on detection rates concerning a specific malware sample, we use a generic metamorphic engine to observe the detection products behaviors. We believe that this point of view presents a double interest: First, it offers an original way of evaluating current antivirus products focusing on the observed detection technique. More precisely, the use of metamorphic malware guarantees the difficulty of static signature based detection techniques to focus only on heuristic and behavioral detection approaches. Second, by pointing out current detection capabilities, we practically evaluate the danger that complex metamorphic malware could represent. To achieve this goal, we start with the description of a generic metamorphic engine acting in two steps: obfuscation and modeling. Then, we apply this engine to a real mass-mailing worm and propose the resulting metamorphic malware samples to current antivirus products. The observed results lead to a classification of detection techniques in two main categories: the first one, relying on static detection techniques, presents low detection rates obtained by heuristic analysis. The second one, composed of behavioral detection programs, mainly focuses on elementary suspicious actions. In all cases, no product was able to detect a global malware behavior. Consequently, we consider that metamorphic malware detection still represents a real challenge for antivirus products. Through this study, we hope to help defenders understand and defend against the threat represented by this class of malware.