Software Attacks Research Articles

Malware Detection using Machine Learning

As the level of malware and viruses is on the rise, the prominence of effective detection systems is crucial. Malwares are the modern-day threats that have troubled major companies worldwide. This article explores in depth two powerful machine learning tools, Random Forest, Support Vector Machines in particular, for the detection of malware. Our study revealed the Random Forest's capacity to reach the upper detection accuracy limit of 98% by applying an analysis of a dataset of variousmalware samples. The feature selection process as well as the model improvement that we've adopted have substantially improved use of our approach for malware detection, and this is thereby highly crucial for organizations to fight against evolving cyber threats. The results of the present research support the ongoing actionsof strengthening cybersecurity security, therefore, providing invaluable information for proactive defense approach mechanisms against malicious software attacks.

Anti-Software Attack Ear Identification System Using Deep Feature Learning and Blockchain Protection

Ear recognition has made good progress as an emerging biometric technology. However, the recognition performance, generalization ability, and feature robustness of ear recognition systems based on hand-crafted features are relatively poor. With the development of deep learning, these problems have been partly overcome. However, the recognition performance of existing ear recognition systems still needs to be improved when facing unconstrained ear databases in realistic scenarios. Another critical problem is that most systems with ear feature template databases are vulnerable to software attacks that disclose users’ privacy and even bring down the system. This paper proposes a software-attack-proof ear recognition system using deep feature learning and blockchain protection to address the problem that the recognition performance of existing systems is generally poor in the face of unconstrained ear databases in realistic scenarios. First, we propose an accommodative DropBlock (AccDrop) to generate drop masks with adaptive shapes. It has an advantage over DropBlock in coping with unconstrained ear databases. Second, we introduce a simple and parameterless attention module that uses 3D weights to refine the ear features output from the convolutional layer. To protect the security of the ear feature template database and the user’s privacy, we use Merkle tree nodes to store the ear feature templates, ensuring the determinism of the root node in the smart contract. We achieve Rank-1 (R1) recognition accuracies of 83.87% and 96.52% on the AWE and EARVN1.0 ear databases, which outperform most advanced ear recognition systems.

CacheIEE: Cache-Assisted Isolated Execution Environment on ARM Multi-Core Platforms

ARM TrustZone technology has been widely used to create Trusted Execution Environments (TEEs) for enhancing the security of applications. However, the increasing number of installed security-sensitive applications in the secure world will inevitably enlarge the trusted computing base (TCB) of TEE systems. To minimize the TCB of the secure world and increase application portability, Isolated Execution Environments (IEEs) are proposed to protect applications in enclaves created in the normal world. However, existing IEE systems cannot provide the same level of security as the TEE systems, particularly, on resolving the multi-vector attacks that include both physical memory disclosure attacks and software attacks. In this paper, we develop a new cache-assisted IEE system called CacheIEE that creates enclaves in the L1 data cache of the normal world to protect sensitive data against multi-vector attacks. First, by always storing the sensitive data in the L1 data cache, CacheIEE can effectively prevent physical memory disclosure attacks. Second, we protect the L1 data cache against untrusted rich OS running in other cores. To support more applications, CacheIEE can process large-size sensitive data in the L1 data cache with constrained capacity. We implement a system prototype of CacheIEE and verify its security and practicability.

БЕЗОПАСНОСТЬ МИКРОКОНТРОЛЛЕРОВ В ВСТРОЕННЫХ СИСТЕМАХ: УГРОЗЫ И МЕТОДЫ ЗАЩИТЫ

The paper discusses the current security issues of microcontrollers used in embedded systems. The main threats faced by microcontrollers, including physical and software attacks, are described. An overview of modern protection techniques such as hardware and software solutions, as well as their combinations, is provided. The effectiveness of different approaches depending on threat type and application specificity is evaluated. Special attention is paid to trends and prospects for the development of protection methods in the context of microcontroller architecture complexity. Based on the analysis carried out, practical recommendations for the development of more secure systems were proposed.

Blockhain and Biometrics Challenges and Solutions

Blockchain technology has garnered significant attention in recent years due to its ability to revolutionize conventional processes by providing faster, more secure, and cost-effective solutions. This study explores the symbiotic relationship between blockchain and biometrics, investigating how these technologies can mutually reinforce each other. The research makes a dual contribution: firstly, it comprehensively analyses blockchain and biometrics, highlighting their convergence's potential advantages and obstacles. Secondly, it delves deeper into utilising blockchain for safeguarding biometric templates. Although the potential benefits outlined earlier are promising, integrating blockchain and biometric technologies faces challenges due to constraints within current blockchain technology. These constraints include a limited transaction processing capacity, the need to store all system transactions leading to increased storage demands, and insufficiently explored resilience against diverse attacks. Historically, biometric systems have been vulnerable to both physical and software-based attacks. While techniques like presentation attack detection can somewhat mitigate physical sensor vulnerabilities, safeguarding against software attacks necessitates adopting biometric template protection measures. Despite advancements in this area, there remains scope for enhancing these methods. Integrating blockchain and biometrics promises to enhance security and efficiency across various sectors. By combining blockchain's immutability and transparency with biometric data's uniqueness and reliability, organizations can establish robust systems that protect sensitive information while streamlining processes. This research underscores the importance of understanding the intricacies of merging these technologies to leverage their full potential effectively. Overall, this study sheds light on the transformative power of integrating blockchain and biometrics, offering insights into how this synergy can drive innovation, improve security measures, and optimize operations in a rapidly evolving digital landscape.

On the Impact of Refactorings on Software Attack Surface

On the Impact of Refactorings on Software Attack Surface

ProMiSE: A High-Performance Programmable Hardware Monitor for High Security Enforcement of Software Execution

In recent years, to prevent computer systems from software attacks, hardware monitors are proposed as a type of efficient security enforcement scheme, which can detect software attacks at runtime. However, due to the limited flexibility of dedicated hardware monitors, one monitor can be only applied to a few targeted application scenarios, and is hard to defend against unconsidered attacks. This leads to high cost for redesigning monitors for new scenarios. Although recent studies propose flexible hardware monitors, the scope and security of the reconfigurable monitoring policies are still limited. To further improve the flexibility and security, this work proposes a monitor instruction set and multiple security-assisting designs for supporting general operations needed by various attack detection schemes. Based on the above efforts, an efficient programmable hardware monitor named ProMiSE is designed. After implemented on the RocketChip RISC-V processor, ProMiSE can be programmed to realize a wider range of monitoring policies with higher security and similar hardware resource overhead, compared with stateof-the-art flexible hardware monitors. With these advantages, ProMiSE still has the detection latency as low as 18-59 CPU cycles. The performance overhead ranges from 0%-23.4%, which is also reasonable compared with the dedicated hardware monitors of corresponding policies.

Experimental EMFI detection on a RISC-V core using the Trace Verifier solution

Physical attacks are powerful threats that can cause changes in the execution behavior of a program. Control-Flow Integrity (CFI) is used to check the program’s flow execution, ensuring that it remains unaltered by these attacks. The RISC-V Trace Encoder (TE) provides valuable information about the user program’s execution path, and is used as part of a CFI solution. An enhanced version of the TE specifications permits detecting intricate fault models such as the corruption of any discontinuity instruction, using an additional Trace Verifier (TV) hardware module. In this paper, we present a buffer overflow software attack simulation and experimental ElectroMagnetic Fault Injection (EMFI) attacks conducted on an Field Programmable Gate Array (FPGA) board that implements a RISC-V core linked to the enhanced TE and TV modules. Unlike existing CFI solutions, our proposed approach does not require modifications to the RISC-V compiler, user application code or the RISC-V core. The average overhead of our solution in terms of hardware area, memory and power consumption are equal to 13.6%, 3.5% and 9% respectively.

A novel method for the dynamics of worms in wireless sensor networks with fuzzy partition

Wireless sensor networks (WSNs) have gained much interest due to their enormous potential in civil and military applications. The power and radio communication capabilities of the sensor nodes are limited. Because sensor nodes have limited resources, they have weak defense capabilities and are attractive targets for software attacks. Worm-based cyberattacks are among the most significant threats to computers and WSNs’ security and integrity. In this article, a five-compartmental WSN epidemic model is considered. We conducted an investigation into equilibrium analysis and the reproductive number, followed by the development of a nonstandard finite difference numerical scheme for our model. The outcomes of our numerical simulations are then presented. This method yields reliable predictions, which can be valuable for regulators when making decisions related to designing and implementing control strategies. Furthermore, some interesting properties of the developed scheme are investigated, such as positivity, convergence, and consistency. The developed scheme preserves the essential characteristics of disease epidemic models like positivity, convergence, and consistency.

ML and DL-based Phishing Website Detection: The Effects of Varied Size Datasets and Informative Feature Selection Techniques

One must interact with a specific webpage or website in order to use the Internet for communication, teamwork, and other productive activities. However, because phishing websites look benign and not all website visitors have the same knowledge and skills to inspect the trustworthiness of visited websites, they are tricked into disclosing sensitive information and making them vulnerable to malicious software attacks like ransomware. It is impossible to stop attackers from creating phishing websites, which is one of the core challenges in combating them. However, this threat can be alleviated by detecting a specific website as phishing and alerting online users to take the necessary precautions before handover sensitive information. In this study, five ML and DL algorithms—CATB, GB, RF, MLP, and DNN—were tested with three different reputable datasets and two useful feature selection techniques, to assess the scalability and consistency of each classifier's performance on varied dataset sizes. The experimental findings reveal that the CATB classifier achieved the best accuracy across all datasets (DS-1, DS-2, and DS-3) with respective values of 97.9%, 95.73%, and 98.83%. The GB classifier achieved the second-best accuracy across all datasets (DS-1, DS-2, and DS-3) with respective values of 97.16%, 95.18%, and 98.58%. MLP achieved the best computational time across all datasets (DS-1, DS-2, and DS-3) with respective values of 2, 7, and 3 seconds despite scoring the lowest accuracy across all datasets.

Survey on Architectural Attacks: A Unified Classification and Attack Model

According to the World Economic Forum, cyberattacks are considered as one of the most important sources of risk to companies and institutions worldwide. Attacks can target the network, software, and/or hardware. Over the years, much knowledge has been developed to understand and mitigate cyberattacks. However, new threats have appeared in recent years regarding software attacks that exploit hardware vulnerabilities. This article defines these attacks as architectural attacks. Today, both industry and academia have only limited comprehension of architectural attacks, which represents a critical issue for the design of future systems. To this end, this work proposes a new taxonomy, a new attack model, and a complete survey of existing architectural attacks. As a result, it provides the tools to understand architectural attacks in more depth and to start building improved designs and protection mechanisms.

Misuse of Personal Data for Commercial Purposes on Facebook Social Media as a Digital Crime and Legal Certainty for Users

This research is a qualitative descriptive study that aims to determine student perceptions related to personal data violations for commercial purposes on social media Facebook as a digital crime and legal certainty for users. This research was conducted in Ambon City, Maluku. Data collection was carried out through interviews with a number of informants who were considered to be directly involved, namely those who had been victims of personal data attacks on Facebook social media. The results of the study show that several forms of personal data attack have been experienced by Facebook users, namely, hacking with malicious intent (cracking), malicious software attacks (malware), identity theft (identity theft), and fraud by fraudsters (fraudsters), causes of data theft. These individuals exist purely because of the intent of the perpetrator or are also responsible and careless of the owner (subject) of the personal data. Laws and regulations discuss rights and obligations, prohibitions, sanctions and punishments, but cannot automatically protect personal data so that public education on the importance of protecting personal data will support the personal data it protects.

A novel architecture to virtualise a hardware-bound trusted platform module

Security and trust are particularly relevant in modern softwarised infrastructures, such as cloud environments, as applications are deployed on platforms owned by third parties, are publicly accessible on the Internet and can share the hardware with other tenants. Traditionally, operating systems and applications have leveraged hardware tamper-proof chips, such as the Trusted Platform Modules (TPMs) to implement security workflows, such as remote attestation, and to protect sensitive data against software attacks. This approach does not easily translate to the cloud environment, wherein the isolation provided by the hypervisor makes it impractical to leverage the hardware root of trust in the virtual domains. Moreover, the scalability needs of the cloud often collide with the scarce hardware resources and inherent limitations of TPMs. For this reason, existing implementations of virtual TPMs (vTPMs) are based on TPM emulators. Although more flexible and scalable, this approach is less secure. In fact, each vTPM is vulnerable to software attacks both at the virtualised and hypervisor levels. In this work, we propose a novel design for vTPMs that provides a binding to an underlying physical TPM; the new design, akin to a virtualisation extension for TPMs, extends the latest TPM 2.0 specification. We minimise the number of required additions to the TPM data structures and commands so that they do not require a new, non-backwards compatible version of the specification. Moreover, we support migration of vTPMs among TPM-equipped hosts, as this is considered a key feature in a highly virtualised environment. Finally, we propose a flexible approach to vTPM object creation that protects vTPM secrets either in hardware or software, depending on the required level of assurance.

Online Change of Grade Attack Using SQL Injection Case Study: FUTA Cyber Security Department

Advancement in technology has made many universities to adopt the system of storing students' results in online databases in both developed and developing countries for easy accessibility and to eliminate redundancy. However, these are subject to different types of attacks ranging from hardware to software attacks. In Federal University of Technology Akure (FUTA), Cyber Security department is not left out because attackers contribute a potential threat to the institution's information security. There are various methods attackers can use to carry out this malicious act, but this research considered SQL injection attacks. The researcher reviews related works, designs and implements student database applications for FUTA Cyber Security department. The research demonstrates how SQL injection can be used to change student grades and preventive measures to minimize SQL injection attacks, such as avoiding sharing database accounts using different sites or applications, regular updates of database software, regular update of security patches and passwords and regular scanning of web applications with a web vulnerability scanner.

Investigating TrustZone: A Comprehensive Analysis

The advent of the Internet and portable devices, including smartphones and watches, has brought unprecedented opportunities for embedded application systems developments. Along with these developments, there is an increasing need for embedded devices to handle important services, such as the ability to pay bills or manage bank accounts remotely via mobile phones. Such applications and developments have also highlighted the issues of cyberattacks and computing network security--these developments have made mobile phones a potential target for malware, trojans, and viruses, so it is critical to design a set of security technologies for embedded devices. In fact, security has become an essential requirement in the process of embedded system design. Thus, ARM has proposed system-level security solutions based on TrustZone technology. TrustZone technology is tightly integrated with Cortex™-A processors and extends the system through the AMBA® AXI bus and specific TrustZone system IP blocks to protect peripherals such as secure memory, encryption blocks, keyboards, and screens from software attacks. It divides the system into TEE (Trusted Execution Environment) and REE (Rich Execution Environment) by hardware and provides intrinsic software security services and interfaces. More precisely, it has built system security by combining hardware and software. It is worth noting that it does not influence performance, power consumption, and area as much as possible. Owing to such characteristics, the technology has gained the wide attention of researchers worldwide. There is lack of systematic documentation of the technology. Therefore, this paper documents the significant progress achieved in the field. In particular, this article mainly analyses the primary mechanism implementation, and how to build the Trusted Execution Environment in different environments. Then, this paper discusses the related research works in the academic field and business applications of the technology. Furthermore, the advantages and weaknesses of the TrustZone technology as well as the proposed possible solutions aiming at the deficiency are outlined. Finally, a comparison of TrustZone technology with another mainstream commercial SGX, and future directions are presented.

Developing Resilient Cyber-Physical Systems: A Review of State-of-the-Art Malware Detection Approaches, Gaps, and Future Directions

Cyber-physical systems (CPSes) are rapidly evolving in critical infrastructure (CI) domains such as smart grid, healthcare, the military, and telecommunication. These systems are continually threatened by malicious software (malware) attacks by adversaries due to their improvised tactics and attack methods. A minor configuration change in a CPS through malware has devastating effects, which the world has seen in Stuxnet, BlackEnergy, Industroyer, and Triton. This paper is a comprehensive review of malware analysis practices currently being used and their limitations and efficacy in securing CPSes. Using well-known real-world incidents, we have covered the significant impacts when a CPS is compromised. In particular, we have prepared exhaustive hypothetical scenarios to discuss the implications of false positives on CPSes. To improve the security of critical systems, we believe that nature-inspired metaheuristic algorithms can effectively counter the overwhelming malware threats geared toward CPSes. However, our detailed review shows that these algorithms have not been adapted to their full potential to counter malicious software. Finally, the gaps identified through this research have led us to propose future research directions using nature-inspired algorithms that would help in bringing optimization by reducing false positives, thereby increasing the security of such systems.

An investigation into software quality and security: Past research works and existing gaps

Software security is concerned with the protection of data, facilities and applications from harm that may be occasioned by malware attacks such as password sniffing, viruses and hijacking. It is a system-wide concept that takes into account both security mechanisms such as access control as well as the design for security, such as a robust design that renders software attack complicated. It may encompass building of secure software, which comprises of the designing of software to be attack-resistant, ensuring that software is error-free, and educating software developers, architects, and users about the building of secure artifacts. In this regard, insecure software negatively affects organization’s reputations with customers, partners, and investors. The goal of this paper is to investigate some of the issues that make the software insecure, as well as the approaches that have been developed to boost software quality and security. The outcomes indicate that various models, techniques, frameworks and approaches to software quality have been developed over the recent past. However, only a few of them give reliable evidence for creating secure software applications.

Preventing Cyber-Fraud in Nigeria’s Banking System Using Fraudaeck-AI

Preventing Cyber-Fraud in Nigeria's Banking System Using Fraudaeck-AI (Fraud analysis environment for cyber-fraud check) is an in-depth analysis of artificial intelligence (AI) assisted identity verification and authentication systems to prevent cyber fraud in Nigeria's banking system. The Fraudaeck (fraud analysis environment for cyber-fraud check) is a machine learning model developed to learn the interconnected subsystems of the communication network and the banking applications and how they function seamlessly to provide customers with ease and comfort of banking even on the go. An investigation revealed how this created a vulnerability in the system, allowing malicious software attacks such as the Xenomorph Trojan to gain access to the system, paving the way for cyber fraudsters—"Yahoo-boys"—to gain access. This paper proposes a solution to cyber-fraud during electronic banking transactions by using an artificial neural network model called Fraudaeck, which can be interfaced with both the telecommunication protocols and the banking application to detect network intrusion, customer identity theft, and prevent cyber-fraud to obtain hitch-free banking activities in Nigeria.

An Efficient Convolutional Neural Network with Transfer Learning for Malware Classification

Rising prevalence of malicious software (malware) attacks represent a serious threat to online safety in the modern era. Malware is a threat to anyone who uses the Internet since it steals data and causes damage to computer systems. In addition, the exponential growth of malware hazards that affect many computer users, corporations, and governments has made malware detection, a popular issue in academic study. Current malware detection methods are slow and ineffectual because they rely on static and dynamic analysis of malware signatures and behavior patterns to detect unknown malware in real-time. Thus, this paper discusses the role of deep convolution neural networks in malware classification and solutions for utilizing machine learning to detect and classify malware families through transfer learning. We proposed a CNN pretrained model learning to classify malware families. The experiment was conducted using two classification datasets, including Malimg and ImageNet. We classified the Malimg dataset, which has turned malware binaries into malware images by using Portable Executable. The result shows that the EfficientNet3 model achieved a high accuracy of 99.93%.

An Effective and Secure Mechanism for Phishing Attacks Using a Machine Learning Approach

Phishing is one of the biggest crimes in the world and involves the theft of the user’s sensitive data. Usually, phishing websites target individuals’ websites, organizations, sites for cloud storage, and government websites. Most users, while surfing the internet, are unaware of phishing attacks. Many existing phishing approaches have failed in providing a useful way to the issues facing e-mails attacks. Currently, hardware-based phishing approaches are used to face software attacks. Due to the rise in these kinds of problems, the proposed work focused on a three-stage phishing series attack for precisely detecting the problems in a content-based manner as a phishing attack mechanism. There were three input values—uniform resource locators and traffic and web content based on features of a phishing attack and non-attack of phishing website technique features. To implement the proposed phishing attack mechanism, a dataset is collected from recent phishing cases. It was found that real phishing cases give a higher accuracy on both zero-day phishing attacks and in phishing attack detection. Three different classifiers were used to determine classification accuracy in detecting phishing, resulting in a classification accuracy of 95.18%, 85.45%, and 78.89%, for NN, SVM, and RF, respectively. The results suggest that a machine learning approach is best for detecting phishing.