Zero-day Vulnerabilities Research Articles

DAEMON: Dataset/Platform-Agnostic Explainable Malware Classification Using Multi-Stage Feature Mining

Numerous metamorphic and polymorphic malicious variants are generated automatically on a daily basis by mutation engines that transform the code of a malicious program while retaining its functionality, in order to evade signature-based detection. These automatic processes have greatly increased the number of malware variants, deeming their fully-manual analysis impossible. Malware classification is the task of determining to which family a new malicious variant belongs. Variants of the same malware family show similar behavioral patterns. Thus, classifying newly discovered malicious programs and applications helps assess the risks they pose. Moreover, malware classification facilitates determining which of the newly discovered variants should undergo manual analysis by a security expert, in order to determine whether they belong to a new family (e.g., one whose members exploit a zero-day vulnerability) or are simply the result of a concept drift within a known malicious family. This motivated intense research in recent years on devising high-accuracy automatic tools for malware classification. In this work, we present DAEMON - a novel dataset-agnostic malware classifier. A key property of DAEMON is that the type of features it uses and the manner in which they are mined facilitate understanding the distinctive behavior of malware families, making its classification decisions explainable. We've optimized DAEMON using a large-scale dataset of x86 binaries, belonging to a mix of several malware families targeting computers running Windows. We then re-trained it and applied it, without any algorithmic change, feature re-engineering or parameter tuning, to two other large-scale datasets of malicious Android applications consisting of numerous malware families. DAEMON obtained highly accurate classification results on all datasets, establishing that it is also platform-agnostic.

A System Dynamics, Epidemiological Approach for High-Level Cyber-Resilience to Zero-Day Vulnerabilities

Cyber-attacks are serious threats to operations in most industries, enabled by a growing dependence on Information Technology (IT). To minimize disruptive effects on operations, organizations with complex system derive value both from preventing cyber-attacks and from responding promptly and coherently when cyber-attacks happen, capacity is known as cyber-resilience. Frameworks have been presented in literature to promote cyber-resilient response, yet little is known about the structures that result in a cyber-resilient behavior. This paper explores an approach to modeling the structure of a system that is subject to an infection an eventual recovery from zero-day malware cyber-attacks, based on mechanisms derived from epidemiology. By analyzing the relationship between the system vulnerabilities and the incidence of malware infections in a population of systems, this paper derives structural recommendations for resilience response, and policy requirements based on the claim that cyber-threats are a public-cyber-health issue instead of merely a competitive factor.

A Study on Hacking E-Mail Detection using Indicators of Compromise

In recent years, hacking and malware techniques have evolved and become sophisticated and complex, and numerous c yber-attacks are constantly occurring in various fields. Among them, the most widely used route for compromise incident s such as information leakage and system destruction was found to be E-Mails. In particular, it is still difficult to detect and identify E-Mail APT attacks that employ zero-day vulnerabilities and social engineering hacking techniques by detec ting signatures and conducting dynamic analysis only. Thus, there has been an increased demand for indicators of compr omise (IOC) to identify the causes of malicious activities and quickly respond to similar compromise incidents by sharing the information. In this study, we propose a method of extracting various forensic artifacts required for detecting and inv estigating Hacking E-Mails, which account for large portion of damages in security incidents. To achieve this, we employ ed a digital forensic indicator method that was previously utilized to collect information of client-side incidents.

Cyberthreat risk identification based on constructing entity-event ontologies from publicly available texts

Aim . Out of the currently used methods of ensuring cyber security the most productive ones are traffic analysis, malware detection, denial of unauthorized access to internal networks, incident analysis and other methods of corporate perimeter protection. The efficiency of such methods however depends on the timeliness and quality of threat data. The Aim of the paper is to study the ways of improving the cyber threat awareness and capabilities to analyze texts in open sources for the purpose of cyberattack prediction, identification and monitoring of new threats, detection of zero-day vulnerabilities before they are made public and leaks are discovered. Methods. Publicly available knowledge on cyber security is acquired through continuous collection of data from the Internet (including fragments of its non-indexed part and specialized sources) and other public data networks (including a large number of specialized resources and sites in the TOR network). The collected texts in various languages are analyzed using methods of natural language processing for the purpose of extracting entities and events that are then grouped into canonical entities and events, and all of that information is used for continuous updating of a subject-matter event-entity ontology. It includes general forms of entities and events required for the context and specialized forms of events and entities for purposes of cyber security (technical identifiers, attack vectors, attack surfaces, hashes, identifiers, etc.) Such ontology can function as a knowledge base and be used for structured queries by cyber security analysts. Results. The proposed method and the system based upon it can be used for analyzing computer security information, monitoring, detection of zero-day vulnerabilities before they are made public and leaks are discovered. The information retrieved by the system can be used as highly informative features in statistical models. The latter served as the basis for a classifier that defines the risk of exploits for a specific vulnerability, as well as an IP address scoring system that can be used for automatic blocking. Additionally, a method was developed for risk-based ranking of events and entities associated with cyber threats that allows identifying – within the abundance of available information – the entities and events that require special attention, as well as taking timely and appropriate preventive measures. Conclusion. The proposed method is of direct practical value as regards the problems of analytics, risk-based ranking and monitoring of cyber threats, and can be used for the analysis of large volumes of text-based information and creation of informative features for improving the quality of machine learning models used in computer security.

An Efficient Hybrid Evolutionary Approach for Identification of Zero-Day Attacks on Wired/Wireless Network System

Attacks from network applications establish considerable security threats for computer networks and end users. Existing cyber-attack detection methods are designed primarily in signature-based approaches that can not recognize zero-day vulnerabilities. In addition, with the minimum availability of network attack data in the real world, the effectiveness of such approaches is even more limited. Today, in network security, an Intrusion Detection System (IDS) plays an important role in detecting intrusive activity. To address the existing challenges, we propose an architectural scheme through an evolutionary hybrid algorithm that incorporates Teaching Learning based optimization (TLBO) and Simulated Annealing (SA), called TLBOSA for IDS that extracts the most notable characteristics and eliminates the irrelevant from the high-dimensional data sets. In the proposed method, SA is integrated into the TLBO, while using it to increase the quality of the solution after each iteration of the TLBO algorithm. Support Vector Machine (SVM) is used as a fitness function in the proposed method to select the relevant attributes that can help classify the attacks accurately. For performance verification, the proposed method is used in two large datasets, such as NSL-KDD and UNSW-NB15. The empirical evaluations show that our approach outperforms the existing state-of-the-art algorithms in terms of detection rate, accuracy and false alarm rates on both NSL-KDD and UNSWNB15 data.

Attention-Based Automated Feature Extraction for Malware Analysis.

Every day, hundreds of thousands of malicious files are created to exploit zero-day vulnerabilities. Existing pattern-based antivirus solutions face difficulties in coping with such a large number of new malicious files. To solve this problem, artificial intelligence (AI)-based malicious file detection methods have been proposed. However, even if we can detect malicious files with high accuracy using deep learning, it is difficult to identify why files are malicious. In this study, we propose a malicious file feature extraction method based on attention mechanism. First, by adapting the attention mechanism, we can identify application program interface (API) system calls that are more important than others for determining whether a file is malicious. Second, we confirm that this approach yields an accuracy that is approximately 12% and 5% higher than a conventional AI-based detection model using convolutional neural networks and skip-connected long short-term memory-based detection model, respectively.

Vulnerability market as a public-good auction with privacy preservation

Exploitations of zero-day vulnerabilities cause enormous damages to organizations. Hence, organizations would invest in buying zero-day vulnerabilities to patch their systems. On the other hand, hackers are interested in buying zero-day vulnerabilities to exploit their targets. Considering such a market, the vulnerability finder decides whether to sell the vulnerability information to the organizations or to the hackers in the black market. In this paper, we model the vulnerability market as a public-good auction where the organizations collaboratively bid for the vulnerability information. In this case, an organization determines how much to invest in the vulnerability information to maximize its payoff. First, we characterize the auction and study the bidding strategies in centralized and decentralized approaches, and then, we compare the efficiency of the coalition. Moreover, as the bidding value in such an auction is sensitive information, we present a novel privacy-preserving mechanism based on cryptographic primitives to protect the organizations’ bidding value. Our mechanism can also be applicable in other public-good auctions. Security analysis and performance evaluation are conducted showing the practicality of our proposed mechanism.

Smart seed selection-based effective black box fuzzing for IIoT protocol

Connections of cyber-physical system (CPS) components are gradually increasing owing to the introduction of the Industrial Internet of Things (IIoT). IIoT vulnerability analysis has become a major issue because complex skillful cyber-attacks on CPS systems exploit their zero-day vulnerabilities. However, current white box techniques for vulnerability analysis are difficult to use in real heterogeneous environments, where devices supplied by various manufacturers and diverse firmware versions are used. Therefore, we herein propose a novel protocol fuzzing test technique that can be applied in a heterogeneous environment. As seed configuration can significantly influence the test result in a black box test, we update the seed pool using test cases that travel different program paths compared to the seed. The input, output, and Delta times are used to determine if a new program area has been searched in the black box environment. We experimentally verified the effectiveness of the proposed.

Strategy and Knowledge-Based XML Attack Detection Systems using Ontology

Today's highly skilled attackers exploit many of the vulnerabilities in their network. On the other hand, the risk of data leakage has increased dramatically because software or application vulnerability is always left without a fix. Such vulnerability using the (Zero Day), hackers will receive the target network, and can steal sensitive data. Detection of zero day traditional defenses is difficult, because the signature information zero-day attacks are unknown. Therefore, the need for new security solutions, that detect zero-day attacks, and evaluate the identified zero day vulnerability severity. The paper proposed an approach for detecting unknown vulnerabilities. The system is a framework that is a comprehensive approach for detecting and prioritizing zero-day attacks and removes these detected attacks. The proposed framework is based on probabilistic approach, to determine the Zero-Day attack path, and the subsequent degree of severity of the identified zero-day vulnerability. It is a hybrid of detection and removal method based on the detection of unknown defects present in the network, which is not yet detected. The system also shows the file with original size and with an attacked size.

Zero-Day Vulnerabilities: Detection and Mitigation Strategies

Zеro-day vulnеrabilitiеs constitutе a grеat dangеr to thе sеcurity of facts systеms, as thеy takе advantagе of undisclosеd and unpatchеd softwarе program flaws, lеaving businеssеs at risk of malicious assaults. This study's papеr еxplorеs advancеd dеtеction and mitigation stratеgiеs to copе with thе challеngеs posеd by zеro-day vulnеrabilitiеs. Thеy havе lookеd at and invеstigatеd thе modеrn panorama of zеro-day thrеats, analyzing thеir еvolving naturе and thеir ability to affеct numеrous industriеs. Thе studiеs dеlvе into rеvolutionary procеdurеs for thе timеly idеntification of 0-day vulnеrabilitiеs, such as anomaly dеtеction, gadgеt mastеring algorithms, and hеuristic еvaluation. Additionally, thе papеr discussеs thе importancе of collaboration within thе cybеrsеcurity nеtwork, еmphasizing information sharing and coordination to dеcoratе еarly thrеat dеtеction capabilitiеs. Furthеrmorе, thе papеr еxplorеs mitigation stratеgiеs that pass past convеntional patching stratеgiеs, thinking about thе constraints of dеpеnding еntirеly on dеalеr-providеd fixеs. It еxaminеs thе function of proactivе safеty fеaturеs, which includе nеtwork sеgmеntation, softwarе manipulation, and consumеr schooling, in minimizing thе capacity damagе as a rеsult of 0-day еxploits. Through a comprеhеnsivе rеviеw of modеrn-day litеraturе, casе rеsеarch, and rеal-intеrnational еxamplеs, this rеsеarch ambitions to offеr insights into thе dynamic landscapе of zеro-day vulnеrabilitiеs. By offеring a holistic anglе on dеtеction and mitigation tеchniquеs, thе papеr contributеs to thе continuеd discoursе on strеngthеning cybеrsеcurity rеsiliеncе in thе facе of hastily еvolving thrеats. Thе findings suppliеd hеrеin function as a valuablе aid for cybеrsеcurity practitionеrs, rеsеarchеrs, and groups looking to еnhancе thеir dеfеnsеs against thе еvеr-gift and еlusivе mеnacе of 0-day vulnеrabilitiеs. Keywords: Zero-Day Vulnerabilities, Cybersecurity Threats, Detection Strategies, Mitigation Techniques, Anomaly Detection, Collaboration in Cybersecurity.

The State of Cyber Arms Control. An International Vulnerabilities Equities Process as the Way to go Forward?

Although the threat of cyber-conflict is rising at the moment, not much ground has been gained with cyber arms control regimes. The article analyses proposals for cyber arms control, modelled after traditional arms control regimes. It finds that challenges of the digital domain, issues of regime verification and the lack of political will are big inhibitors in transferring these to the cyber-domain. To overcome these inhibitors, cyber-experts proposed a new type of regime focusing on Zero-day vulnerabilities. Since nobody so far explained how a so-called International Vulnerabilities Equities Process (IVEP) could look like, the article picks up the task, and presents two models with their advantages and shortcomings. The article concludes that the IVEP proposal holds some promise, but due to many open questions, it is currently not feasible as a policy option.

An Intelligent and Time-Efficient DDoS Identification Framework for Real-Time Enterprise Networks: SAD-F: Spark Based Anomaly Detection Framework

Enterprise networks face a large number of threats that are managed and mitigated with a combination of proprietary and third-party security tools and services. However, the techniques and principles employed by the said tools, processes, and services are quite conventional. They lack the rapid evolution, as required to protect against modern, state-of-the-art threats faced, specifically, against distributed denial of service (DDoS) attacks. The lack of efficiency of a network is directly proportional to the number of applications and services it hosts, mainly to protect against external and internal threats. Moreover, the effectiveness of such security mechanisms relies on their independent and proactive approach, which is useful for known malware and their attack vectors, but become obsolete when there is a new malware or zero-day vulnerability is exploits. This paper presents an intelligent, highly responsive, and scalable security framework for enterprise networks. The proposed framework incorporates Apache Spark Framework for security analytics. It accurately identifies anomalies related to DDoS attacks from real-time network traffic by using customized machine learning algorithms, meticulously trained against selected feature-set. Encouraging results are obtained when tested against different scenarios and bench-marked with the results achieved by related studies in similar scenarios.

The Remarkable 10th Anniversary of Stuxnet

It has been ten years since Stuxnet, a highly sophisticated malware that was originally aimed at Iran’s nuclear facilities, was uncovered in 2010. Stuxnet is considered to be the first cyber weapon, used by a nation state threat actor in a politically motivated cyberattack. It has significantly changed the cybersecurity landscape, since it was the first publicly known malware that could cause physical damage to real processes or equipment. Its complexity and level of sophistication, due to the exploitation of four different zero-day vulnerabilities in Windows and the usage of two stolen certificates, has triggered a paradigm shift in the cybersecurity industry. The recently uncovered cyber espionage campaign known as SolarStorm is a worthy anniversary celebration for Stuxnet. Especially because now the tables have turned. This campaign targeted the United States Government and its interests with a highly sophisticated supply chain attack through the exploitation of the SolarWinds Orion Platform used by thousands of public and private sector customers for infrastructure monitoring and management. In this article, I attempt to summarise the key points about the malware deployed in the SolarStorm campaign that can be drawn from reports available at the time of the writing.

Android Data-Clone Attack via Operating System Customization

To avoid the inconvenience of retyping a user's ID and password, most mobile apps now provide the automatic login feature for a better user experience. To this end, auto-login credential is stored locally on the smartphone. However, such sensitive credential can be stolen by attackers and placed into their smartphones via the well-known credential-clone attack. Then, attackers can imperceptibly log into the victim's account, which causes more devastating and covert losses than merely intercepting the user's password. In this article, we propose a generalized Android credential-clone attack, called data-clone attack. By exploiting the new-found vulnerabilities of original equipment manufacturer (OEM)-made phone clone apps, we design an identity theft method that overcomes the problem of incomplete credential extraction and eliminates the requirement of root authority. To evade the consistency check of device-specific attributes in apps, we design two environment customization methods for app-level and operating system (OS)-level, respectively. Especially, we develop a transparent Android OS customization solution, named CloneDroid, which simulates 101 special attributes of Android OS. We implement a prototype of CloneDroid and the experimental results show that 172 out of 175 most-downloaded apps' accounts can be jeopardized, such as Facebook and WeChat. Moreover, our study has identified 18 confirmed zero-day vulnerabilities. Our findings paint a cautionary tale for the security community that billions of accounts are potentially exposed to Android OS customization-assisted data-clone attacks.

Alerts Correlation and Causal Analysis for APT Based Cyber Attack Detection

The advent of Advanced Persistent Threat (APT) as a new concept in cyber warfare has raised many concerns in recent years. APT based cyber-attacks are usually stealthy, stepwise, slow, long-term, planned, and based on a set of varied zero-day vulnerabilities. As a result, these attacks behave as diverse and dynamic as possible, and hence the generated alerts for these attacks are normally below the common detection thresholds of the conventional attacks. Therefore, the present approaches are not mostly able to effectively detect or analyze the behavior of this class of attacks. In this article, an approach for real-time detection of APT based cyber-attacks based on causal analysis and correlating the generated alerts by security and non-security sensors is introduced. The proposed method computes the infection score of hosts by modeling, discovery, and analysis of causal relationships among APT steps. For this purpose, a dynamic programming algorithm is introduced which works on alerts of each host separately and conducts a long-term analysis on the attack process to combat the outlasting feature of the APT attacks yet coping with a high volume of alert information. The proposed method is implemented and extensively evaluated using a semi real-world dataset and simulation. The experimental results show that the proposed approach can effectively rank hosts based on their infection likelihood with acceptable accuracy.

Smart Greybox Fuzzing

Coverage-based greybox fuzzing (CGF) is one of the most successful approaches for automated vulnerability detection. Given a seed file (as a sequence of bits), a CGF randomly flips, deletes or copies some bits to generate new files. CGF iteratively constructs (and fuzzes) a seed corpus by retaining those generated files which enhance coverage. However, random bitflips are unlikely to produce valid files (or valid chunks in files), for applications processing complex file formats. In this work, we introduce smart greybox fuzzing (SGF) which leverages a high-level structural representation of the seed file to generate new files. We define innovative mutation operators that work on the virtual file structure rather than on the bit level which allows SGF to explore completely new input domains while maintaining file validity. We introduce a novel validity-based power schedule that enables SGF to spend more time generating files that are more likely to pass the parsing stage of the program, which can expose vulnerabilities much deeper in the processing logic. Our evaluation demonstrates the effectiveness of SGF. On several libraries that parse complex chunk-based files, our tool AFLsmart achieves substantially more branch coverage (up to 87 percent improvement) and exposes more vulnerabilities than baseline AFL. Our tool AFLsmart discovered 42 zero-day vulnerabilities in widely-used, well-tested tools and libraries; 22 CVEs were assigned.

A Sponsor Incentive Attack Scheme for Feeder Automation Systems

The rapid deployment of intelligent electronic devices and the development of information and communication technology have improved distribution network (DN) reliability with feeder automation. Thus, the operation of DNs has become more dependent on the cyber-physical components. As the cyber security of smart grid has drawn increasing attention in recent years, this paper proposes a simple yet powerful type of attack targeting the remote terminal units. The proposed attack policy can manipulate the feeder automation operation with the aim of cutting off important power consumers. Regarding the realistic cyber-attacks that previously occurred, an optimal attack model is established for analyzing the attack policy. This optimization model aims to minimize the attack cost and the penalty of being caught or detected while maximizing the remuneration. A Bayesian attack graph model is adopted to quantify the successful probability of exploiting known and zero-day vulnerabilities. The probability of a cyber-attack being caught or detected is modeled based on search theory. Next, an enhanced self-adaptive evolutionary programming is developed to achieve satisfactory solutions for practical applications. Finally, the proposed model and corresponding solution strategies are verified using the RBTS bus 2 DN and the modified IEEE 123-node test feeder.

Leveraging Machine Learning Algorithms For Zero-Day Ransomware Attack

Current global huge cyber protection attacks resulting from Infected Encryption ransomware structures over all international locations and businesses with millions of greenbacks lost in paying compulsion abundance. This type of malware encrypts consumer files, extracts consumer files, and charges higher ransoms to be paid for decryption of keys. An attacker could use different types of ransomware approach to steal a victim's files. Some of ransomware attacks like Scareware, Mobile ransomware, WannaCry, CryptoLocker, Zero-Day ransomware attack etc. A zero-day vulnerability is a software program security flaw this is regarded to the software seller however doesn’t have patch in vicinity to restore a flaw. Despite the fact that machine learning algorithms are already used to find encryption Ransomware. This is based on the analysis of a large number of PE file data Samples (benign software and ransomware utility) makes use of supervised machine learning algorithms for ascertain Zero-day attacks. This work was done on a Microsoft Windows operating system (the most attacked os through encryption ransomware) and estimated it. We have used four Supervised learning Algorithms, Random Forest Classifier , K-Nearest Neighbor, Support Vector Machine and Logistic Regression. Tests using machine learning algorithms evaluate almost null false positives with a 99.5% accuracy with a random forest algorithm.

Risk Assessment for Cyberattack in Active Distribution Systems Considering the Role of Feeder Automation

The extensive application of information and communication technology (ICT) can effectively improve the operational performance of active distribution systems (ADSs). On the other hand, the use of ICT may expose the systems to cyberattacks. Since feeder automation (FA) in advanced ADS provides fast-responding self-healing capability to restore service during an outage, the potential effect of cyberattacks on ADS becomes more devastating. In this paper, two simple yet powerful cyberattack methods targeting remote terminal units (RTUs) are proposed. The physical response of ADS to malicious cyberattacks on FA is elaborately investigated considering the output fluctuation of distributed generators. The impact of this specific cyberattack on ADS is quantified by a risk assessment index measured in scale and in duration to full restoration. The probability of RTU potentially being attacked is modeled based on search theory. Furthermore, a Bayesian attack graph model is applied and designed to quantify the probability of successfully exploiting the currently known and zero-day vulnerabilities. The proposed methodology is tested and validated via using a modified three-feeder ADS and the IEEE 123 Node Test Feeder.

File Guard: automatic format-based media file sanitization

This paper proposes a format-based file sanitization mechanism, File Guard, aiming at preventing software vulnerabilities from being triggered by input files. Based on our experiments and the statistics on Common Vulnerabilities and Exposures, we observed that most of the software vulnerabilities are exploited by malformed input files which violate their corresponding format standards. Hence, repairing the input file according to the format standard is effective in preventing the vulnerabilities from being exploited. In this work, we focus on media file types, such as image, audio, video. File Guard automatically sanitizes input files of known formats, disabling the files from triggering potential vulnerabilities in a target system (or a group of systems) with minimum data loss. Existing intrusion prevention systems and anti-virus tools typically compare the input file or executable with the ones which are known to be malicious, and eliminate such data or software before they get into the protected system. Instead of blocking the malicious or damaged input file, our mechanism repairs the data and provides a more user-friendly protection. File Guard can ensure that the input file meets its standard format and thus is not exploitable even by zero-day vulnerabilities.