Windows-based Systems Research Articles

Proactively Defending Enterprise Computer Systems Against Threats and Vulnerabilities

Cybersecurity remains a critical concern, even amidst global events like the COVID-19 pandemic. The rise of COVID-19 has deepened cybersecurity threats, with phishing emails and phone scams attempting to exploit the situation. This paper focuses on proactive strategies to protect enterprise environments against threats and vulnerabilities, specifically in Windows-based systems. Tracing threats and vulnerabilities to their source aims to address them in their early stages rather than after an attack has occurred. This research tackles three prevalent issues: phishing emails, vulnerability patching, and industrial internet-connected devices. Through analyzing various cyber defense models and vulnerability databases, this paper proposes frameworks to mitigate these issues effectively. The study includes a detailed examination of sources of threats and vulnerabilities, aiming to develop methodologies for practical implementation. Ultimately, the goal is to summarize best practices to enhance tool utilization and process improvement and propose new proactive defense methods. The research emphasizes the shift from reactive to proactive defense strategies to better protect enterprise networks.

Analyzing Tor Browser Artifacts for Enhanced Web Forensics, Anonymity, Cybersecurity, and Privacy in Windows-Based Systems

The Tor browser is widely used for anonymity, providing layered encryption for enhanced privacy. Besides its positive uses, it is also popular among cybercriminals for illegal activities such as trafficking, smuggling, betting, and illicit trade. There is a need for Tor Browser forensics to identify its use in unlawful activities and explore its consequences. This research analyzes artifacts generated by Tor on Windows-based systems. The methodology integrates forensic techniques into incident responses per NIST SP (800-86), exploring areas such as registry, storage, network, and memory using tools like bulk-extractor, autopsy, and regshot. We propose an automated PowerShell script that detects Tor usage and retrieves artifacts with minimal user interaction. Finally, this research performs timeline analysis and artifact correlation for a contextual understanding of event sequences in memory and network domains, ultimately contributing to improved incident response and accountability.

Behavioral fingerprinting to detect ransomware in resource-constrained devices

The Internet of Things (IoT), a network of interconnected devices, has grown and gained traction over the last few years. This paradigm can impact our lives while also providing significant economic benefits. However, although resource-constrained IoT devices offer numerous advantages, they are also vulnerable to cyberattacks. As a result, ransomware severely threatens IoT devices managing sensitive and relevant information. Solutions based on Machine and Deep Learning (ML/DL) that consider behavioral data have been identified as promising. However, most detection solutions have been developed for Windows-based systems, which generally have more resources than IoT devices. As a result, these solutions are not suitable for resource-constrained components. In addition, no solution compares the pros and cons of different behavioral dimensions of resource-constrained devices. Thus, this work presents a framework that combines three different behavioral sources with supervised and unsupervised ML/DL algorithms to detect and classify heterogeneous ransomware impacting resource-constrained spectrum sensors. A pool of experiments has demonstrated the suitability of the proposed solution and compared its performance with a rule-based system. In conclusion, the usage of resources combined with local outlier factor and decision tree are the most promising combinations to detect anomalies and classify ransomware while consuming CPU, RAM, and time of devices in a reduced manner.

A multi-view feature fusion approach for effective malware classification using Deep Learning

The number of malware infected machines from all over the world has been growing day by day. New malware variants appear in the wild to evade the malware detection and classification systems and may infect with ransomware or crypto miners for adversary financial gain. A recent colonial pipeline ransomware attack is an example of these attacks that impacted daily human activities, and the victim had to pay ransom to restore their operations. Windows-based systems are the most adopted systems across different industries for running applications. They are prone to get targeted by installing the malware. In this paper, we propose a Deep Learning (DL)-based Convolutional Neural Network (CNN) model to perform the malware classification on Portable Executable (PE) binary files using the fusion feature set approach. We present an extensive performance evaluation of various DL model architecture and Machine Learning (ML) classifier i.e. Support Vector Machine (SVM), on multi-aspect feature sets covering the static, dynamic, and image features to select the proposed CNN model. We further leverage the CNN-based architecture for effective classification of the malware using different combinations of feature sets and compare the results with the best-performed individual feature set. Our performance evaluation of the proposed model shows that the model classifies the malware or benign files with an accuracy of 97% when using fusion feature sets. The proposed model is robust and generalizable and showed similar performances on completely unseen two malware datasets. In addition, the embedding features of the CNN model are visualized, and various visualization methods are employed to understand the characteristics of the datasets. Further, large-scale learning and stacked classifiers were employed after the penultimate layer to enhance the CNN classification performance.

X-ware: a proof of concept malware utilizing artificial intelligence

<p>Recent years have witnessed a dramatic growth in utilizing computational intelligence techniques for various domains. Coherently, malicious actors are expected to utilize these techniques against current security solutions. Despite the importance of these new potential threats, there remains a paucity of evidence on leveraging these research literature techniques. This article investigates the possibility of combining artificial neural networks and swarm intelligence to generate a new type of malware. We successfully created a proof of concept malware named X-ware, which we tested against the Windows-based systems. Developing this proof of concept may allow us to identify this potential threat’s characteristics for developing mitigation methods in the future. Furthermore, a method for recording the virus’s behavior and propagation throughout a file system is presented. The proposed virus prototype acts as a swarm system with a neural network-integrated for operations. The virus’s behavioral data is recorded and shown under a complex network format to describe the behavior and communication of the swarm. This paper has demonstrated that malware strengthened with computational intelligence is a credible threat. We envisage that our study can be utilized to assist current and future security researchers to help in implementing more effective countermeasures</p>

Aging Analysis Framework of Windows-Based Systems through Differential-Analysis of System Snapshots

When a Windows-based system is used for an exceedingly long time, its performance degrades, and the error occurrence rate tends to increase. This is generally called system aging. To investigate the reasons for system aging, various studies have been conducted within the range of the operating system kernel to the user application. However, finding an accurate reason for system performance degradation remains challenging research topic. In this study, system monitoring was conducted by dividing a system into ‘before software installation,’ ‘after software installation,’ and ‘after software removal.’ We confirmed that when a software installed in a system is removed, various system elements, such as storage and memory, are not restored to the level prior to the software installation. Consequently, we established a hypothesis regarding the performance degradation of a computer system owing to repeated software installation/removal operations, investigated the correlation between system aging and repeated software installation/removal operations, and proposed a system aging analysis framework for analyzing the reason behind system aging. In the proposed system aging analysis framework, we aim to forcibly age a Windows-based system by repeating the software installation/removal operation by utilizing the system forced aging module. The framework identifies the elements affecting system performance through a differential data analysis of the system time-series data extracted by the system performance extraction and system component snapshot modules. Consequently, the aging analysis framework presented in this study is expected to be effectively utilized as an index for studying system aging.

A Study on Decision-Making Opinion Exploration in Windows-Based Information Security Monitoring Tool Development

In the information era, information security monitoring tools would be helpful for enterprises/organizations to monitor employees’ computer usage behaviors and improve their information security protection. The Windows-based operating systems have the largest market share in the world. Therefore, the study target is the development of a Windows-based information security monitoring tool in this study. We proposed an assessment model for developing an information security tool in this study to explore the significances of functionalities in a Windows-based information security monitoring tool and the decision-makers’ decision opinions. We adopted four steps with four study methods: the literature study method, the Delphi method, the analytic hierarchy process (AHP) method, and the analysis methods related to data-driven decision-making in the proposed model. In Step 1, we studied some literature about information security monitoring, and we discovered 26 functionalities as the decision criteria in this study. In Step 2, using the Delphi method, we confirmed the decision criterion set with potential decision-makers and organized the decision criteria hierarchy. In Step 3, we designed an AHP questionnaire to get the criterion weight vectors from the 12 decision-makers. With the AHP method, this study received the weights of the decision criteria and found that the 16 functionalities among the 26 functionalities should receive their corresponding developing priority in a Windows-based information security monitoring tool. Finally, we used the Pearson correlation coefficient and cosine distance to explore the correlations and similarities among the decision-makers’ decision opinions. This study found the relevance among the decision-makers’ decision opinions in a Windows-based information security monitoring tool developed with the Pearson correlation coefficients/the cosine distances among all pairs of decision-makers’ decision opinions.

BioBlend: automating pipeline analyses within Galaxy and CloudMan

We present BioBlend, a unified API in a high-level language (python) that wraps the functionality of Galaxy and CloudMan APIs. BioBlend makes it easy for bioinformaticians to automate end-to-end large data analysis, from scratch, in a way that is highly accessible to collaborators, by allowing them to both provide the required infrastructure and automate complex analyses over large datasets within the familiar Galaxy environment. http://bioblend.readthedocs.org/. Automated installation of BioBlend is available via PyPI (e.g. pip install bioblend). Alternatively, the source code is available from the GitHub repository (https://github.com/afgane/bioblend) under the MIT open source license. The library has been tested and is working on Linux, Macintosh and Windows-based systems.

Safe and Secure? Healthcare in The Cyberworld

Safe and Secure? Healthcare in The Cyberworld

Parallel Performance of MPI Sorting Algorithms on Dual-Core Processor Windows-Based Systems

Message Passing Interface (MPI) is widely used to implement parallel programs. Although Windowsbased architectures provide the facilities of parallel execution and multi-threading, little attention has been focused on using MPI on these platforms. In this paper we use the dual core Window-based platform to study the effect of parallel processes number and also the number of cores on the performance of three MPI parallel implementations for some sorting algorithms.

Reinforcing the concept of calculating isotope pattern using theoretical isotope generator (TIG)

This paper describes how the isotope patterns are calculated for chemists, students, lecturers and researchers using Theoretical Isotope Generator (TIG) integrated from the .NET framework (specifically VB.NET) with the data from the dual databases (Microsoft Access and Microsoft SQL 2000). Accordingly, TIG in terms of its functionality and features is an application developed to gain related information on molecules and their relative intensity for educational purposes (chemists, students, lecturers and researchers). Although various mass spectrometer applications are available as web-based and windows-based systems, the projected software is indeed practical, beneficial and constructive for the academic learners as well for the intellectual researchers for rapidly defining the numbers of the possibility isotope patterns obtainable from a substance(chemical compound) for example methane (CH2). Therefore, TIG with the mathematical application called Cartesian Products is used to obtain the isotope patterns of any atom or molecules. TIG provides extra features than others that are proficient to retrieve the information of the mass (atomic/molecular weight) from the substance specified based from the isotope patterns available. Additionally, TIG is completely with several functionalities such as drawing, normalizing and zooming the generated graph that convey with the molecular information in a number of formats by providing the details of the calculation and molecules.

Detecting and categorizing kernel-level rootkits to aid future detection

Existing techniques to detect kernel-level rootkits expose some infections, but they don't identify specific attacks. This rootkit categorization approach helps system administrators identify the extent of specific infections, aiding in optimal recovery and faster reactions to future attacks. The authors present a framework to detect and classify rootkits and discuss a methodology for determining if a system has been infected by a kernel-level rootkit. Once infection is established, administrators can create new signatures for kernel-level rootkits to detect them. The authors conducted their research on a Red Hat Linux-based system, but the methodology is applicable to other Linux distributions based on the standard Linux kernel. They also believe the method can apply to other Unix- and Windows-based systems.

ANTHEPROT: An integrated protein sequence analysis software with client/server capabilities

Programs devoted to the analysis of protein sequences exist either as stand-alone programs or as Web servers. However, stand-alone programs can hardly accommodate for the analysis that involves comparisons on databanks, which require regular updates. Moreover, Web servers cannot be as efficient as stand-alone programs when dealing with real-time graphic display. We describe here a stand-alone software program called ANTHEPROT, which is intended to perform protein sequence analysis with a high integration level and clients/server capabilities. It is an interactive program with a graphical user interface that allows handling of protein sequence and data in a very interactive and convenient manner. It provides many methods and tools, which are integrated into a graphical user interface. ANTHEPROT is available for Windows-based systems. It is able to connect to a Web server in order to perform large-scale sequence comparison on up-to-date databanks. ANTHEPROT is freely available to academic users and may be downloaded at http://pbil.ibcp.fr/ANTHEPROT.

PC-based operator interface [for paper industry

Personal computers (PCs) are increasingly being used in industrial applications. Graphical user interface (GUI) software and Windows-based operating systems are proving to be cost-effective, rugged and reliable. This paper describes how these advances have, over the past four years, allowed the successful installation of several human-machine interface (HMI) systems for paper machine winders.

Open audiometric reporting standard (OARS)

Communicating data and/or graphs from hearing test instruments to hearing-aid-fitting systems or office management systems which are typically produced by different manufacturers has proved an impediment to the use of programmable hearing aids. In an attempt to resolve this difficulty, a flexible standard software protocol for communicating data and graphs between PC-based systems has been developed by Qualitone and has been offered royalty-free to the hearing health community. Called the open audiometric reporting standard (OARS), it is based on the existing Windows open database connectivity (ODBC) standard. The purpose of OARS is to allow systems to store or transfer data or graphical information in an open and standardized way, independent of the database language. Effort has been made to insure compatibility with all Windows-based systems (including test instruments, hearing aid programmers, and office management systems) and to provide a method whereby all possible system configurations and their data and graphic needs can be supported.