检索结果-内蒙古大学图书馆

2nd International Conference on AIML Systems

作者： Rathore, Hemant Sewak, Mohit BITS Pilani Sancoale Goa India Microsoft R&D Hyderabad Telangana India

Often computer/mobile users call everything that disturbs/corrupts their system a VIRUS without being aware of what it means or accomplishes. This tutorial systematically introduces the different malware varieties, th... 详细信息

ISBN: (纸本)9781450398473

关键词： Artificial Intelligence Deep Learning malware analysis and detection Machine Learning Static analysis

来源：评论

学校读者我要写书评

暂无评论

malware analysis and detection 22

Malware Analysis and Detection

引用

Proceedings of the Second International Conference on AI-ML Systems

作者： Hemant Rathore Mohit Sewak BITS Pilani K K Birla Goa Campus India Microsoft R & D India

ISBN: (纸本)9781450398473

关键词： Static analysis Artificial Intelligence Deep Learning Machine Learning malware analysis and detection

来源：评论

学校读者我要写书评

暂无评论

A new approach for detecting process injection attacks using memory analysis

引用

INTERNATIONAL JOURNAL OF INFORMATION SECURITY 2024年第3期23卷 2099-2121页

作者： Nasereddin, Mohammed Al-Qassas, Raad Polish Acad Sci IITiS PAN Inst Theoret & Appl Informat PL-44100 Gliwice Poland Princess Sumaya Univ Technol Dept Comp Sci Amman Jordan

This paper introduces a new approach for examining and analyzing fileless malware artifacts in computer memory. The proposed approach offers the distinct advantage of conducting a comprehensive live analysis of memory without the need for periodic memory dumping. Once a new process arrives, log files are collected by monitoring the Event Tracing for Windows facility as well as listing the executables of the active process for violation detection. The proposed approach significantly reduces detection time and minimizes resource consumption by adopting parallel computing (programming), where the main software (Master) divides the work, organizes the process of searching for artifacts, and distributes tasks to several agents. A dataset of 17411 malware samples is used in the assessment of the new approach. It provided satisfactory and reliable results in dealing with at least six different process injection techniques including classic DLL injection, reflective DLL injection, process hollowing, hook injection, registry modifications, and .NET DLL injection. The detection accuracy rate has reached 99.93%\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$99.93\%$$\end{document} with a false-positive rate of 0.068%\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$0.068\%$$\end{document}. Moreover, the accuracy was monitored in the case of launching several malwares using different process injection techniques simultaneously, and the detector was able to detect them efficiently. Also, it achieved a detection time with an average of 0.052 msec per detected malware.

关键词： Fileless malware Intrusion detection malware analysis and detection Memory forensics Process injection attacks

来源：评论

学校读者我要写书评

暂无评论

LAM: Scrutinizing Leading APIs For Detecting Suspicious Call Sequences

引用

COMPUTER JOURNAL 2023年第11期66卷 2638-2655页

作者： Alam, Shahid Adana Alparslan Turkes Sci & Technol Univ Dept Comp Engn Adana Turkey

The proliferation of smartphones has given exponential rise to the number of new mobile malware. These malware programs are employing stealthy obfuscations to hide their malicious activities. To perform malicious activities a program must make application programming interface (API) calls. Unlike dynamic, static analysis can find all the API call paths but have some issues: large number of features;higher false positives when features reduced;and lowering false positives increases the detection rate. Certain Android API calls, e.g. ***:boolean requestWindowFeature(int) enable malware programs to call other APIs to hide their activities. We call them leading APIs as they can lead to malicious activities. To overcome these issues, we propose new heuristics and feature groupings for building a Leading API-call Map, named LAM. We create LAM from a dominant (leading) API call tree. Dominance is a transitive relation and hence enumerates all the call sequences that a leading API leads to. LAM substantially reduces the number and improves the quality of features for combating obfuscations and detecting suspicious call sequences with few false positives. For the dataset used in this paper, LAM reduced the number of features from 509 607 to 29 977. Using 10-fold cross-validation, LAM achieved an accuracy of 97.9% with 0.4% false positives.

关键词： Leading APIs Suspicious call sequences malware analysis and detection Heuristics Machine learning

来源：评论

学校读者我要写书评

暂无评论

Defending malware detection models against evasion based adversarial attacks

引用

PATTERN RECOGNITION LETTERS 2022年 164卷 119-125页

作者： Rathore, Hemant Sasan, Animesh Sahay, Sanjay K. Sewak, Mohit Bits Pilani Dept CS & IS Goa Campus Pilani Rajasthan India Microsoft R&D Secur & Compliance Res New Delhi India

The last decade has witnessed a massive malware boom in the Android ecosystem. Literature suggests that artificial intelligence/machine learning based malware detection models can potentially solve this problem. But, these detection models are often vulnerable to adversarial samples developed by malware designers. Therefore, we validate the adversarial robustness and evasion resistance of different malware detection models developed using machine learning in this work. We first designed a neural network agent (MalDQN) based on deep reinforcement learning that adds noise via perturbations to the malware applications and converts them into adversarial malware applications. malware designers can also generate these samples and use them to perform evasion attacks and fool the malware detection models. The proposed MalDQN agent achieved an average 98% fooling rate against twenty distinct malware detection models based on a variety of classification algorithms (standard, ensemble, and deep neural network) and two different features (android permission and intent). The MalDQN evasion attack reduced the average accuracy from 86.18% to 55.85% in the twenty malware detection models mentioned above. Later, we also developed defensive measures to counter such evasion attacks. Our experimental results show that the proposed defensive strategies considerably improve the capability of different malware detection models to detect adversarial applications and build resistance against them. (c) 2022 Published by Elsevier B.V.

关键词： Adversarial robustness Deep neural network Evasion attack malware analysis and detection Machine learning

来源：评论

学校读者我要写书评

暂无评论

Are malware detection Classifiers Adversarially Vulnerable to Actor-Critic based Evasion Attacks?

引用

EAI ENDORSED TRANSACTIONS ON SCALABLE INFORMATION SYSTEMS 2022年第1期10卷

作者： Rathore, Hemant Sharma, Sujay C. Sahay, Sanjay K. Sewak, Mohit BITS Pilani Dept CS & IS Goa Campus Pilani Rajasthan India Microsoft R&D Secur & Compliance Res Bengaluru India

Android devices like smartphones and tablets have become immensely popular and are an integral part of our daily lives. However, it has also attracted malware developers to design android malware which have grown aggressively in the last few years. Research shows that machine learning, ensemble, and deep learning models can successfully be used to detect android malware. However, the robustness of these models against well-crafted adversarial samples is not well investigated. Therefore, we first stepped into the adversaries' shoes and proposed the ACE attack that adds limited perturbations in malicious applications such that they are forcefully misclassified as benign and remain undetected by different malware detection models. The ACE agent is designed based on an actor-critic architecture that uses reinforcement learning to add perturbations (maximum ten) while maintaining the structural and functional integrity of the adversarial malicious applications. The proposed attack is validated against twenty-two different malware detection models based on two feature sets and eleven different classification algorithms. The ACE attack accomplished an average fooling rate (with maximum of ten perturbations) of 46.63% across eleven permission based malware detection models and 95.31% across eleven intent based detection models. The attack forced a massive number of misclassifications that led to an average accuracy drop of 18.07% and 36.62% in the above permission and intent based malware detection models. Later we also design a defense mechanism using the adversarial retraining strategy, which uses adversarial malware samples with correct class labels to retrain the models. The defense mechanism improves the average accuracy by 24.88% and 76.51% for the eleven permission and eleven intent based malware detection models. In conclusion, we found that malware detection models based on machine learning, ensemble, and deep learning perform poorly against adversarial samples. Th

关键词： Adversarial Robustness Android Deep Neural Network malware analysis and detection Machine Learning

来源：评论

学校读者我要写书评

暂无评论

Familial Classification of Android malware using Hybrid analysis 13

Familial Classification of Android Malware using Hybrid Anal...

引用

International Conference on Information Security and Cryptology (ISCTURKEY)

作者： Cavli, Omer Faruk Turan Sen, Sevil Hacettepe Univ WISE Lab Dept Comp Engn Ankara Turkey

ISBN: (纸本)9780738125060

With the developments in mobile and wireless technology, mobile devices have become important part of our lives. While Android is the leading operating system in the market share, it is also the most targeted platform by attackers. While there have been many solutions proposed for detection of Android malware in the literature, the family classification of detected malicious applications becomes important, especially where the number of mobile malware variants increases every day in the market. In this study, a solution based on machine learning and hybrid analysis is proposed for the Android malware familial classification problem. An extensive feature set including network-related features and activity bigrams is proposed. The effective static and dynamic analysis features are studied thoroughly and evaluated on Malgenome [l], Drebin [2], and UpDroid [3] datasets.

关键词： Android mobile security malware analysis and detection malware family classification machine learning static/dynamic analysis hybrid analysis

来源：评论

学校读者我要写书评

暂无评论

Are CNN based malware detection Models Robust?: Developing Superior Models using Adversarial Attack and Defense 21

Are CNN based Malware Detection Models Robust?: Developing S...

引用

Proceedings of the 19th ACM Conference on Embedded Networked Sensor Systems

作者： Hemant Rathore Taeeb Bandwala Sanjay K. Sahay Mohit Sewak Dept. of CS & IS Goa Campus BITS Pilani India Security & Compliance Research Microsoft R&D India

ISBN: (纸本)9781450390972

The tremendous increase of malicious applications in the android ecosystem has prompted researchers to explore deep learning based malware detection models. However, research in other domains suggests that deep learning models are adversarially vulnerable, and thus we aim to investigate the robustness of deep learning based malware detection models. We first developed two image-based E-CNN malware detection models based on android permission and intent. We then acted as an adversary and designed the ECO-FGSM evasion attack against the above models, which achieved more than 50% fooling rate with limited perturbations. The evasion attack converts maximum malware samples into adversarial samples while minimizing the perturbations and maintaining the sample's syntactical, functional, and behavioral integrity. Later, we used adversarial retraining to counter the evasion attack and develop adversarially superior malware detection models, which should be an essential step before any real-world deployment.

关键词： malware analysis and detection Machine Learning Adversarial Learning Smartphones

来源：评论

学校读者我要写书评

暂无评论

Mining nested flow of dominant APIs for detecting android malware

引用

COMPUTER NETWORKS 2020年第0期167卷 107026-000页

作者： Alam, Shahid Alharbi, Soltan Abed Yildirim, Serdar Adana Alparslan Turkes Sci & Technol Univ Dept Comp Engn Adana Turkey Univ Jeddah Dept Comp & Network Engn Jeddah Saudi Arabia

According to the Kaspersky Lab threat report, mobile malware attacks almost doubled in 2018. A study conducted in 2018 by Accenture found malware attacks to be the most expensive to resolve. Android Operating System (OS) is the most dominating platform on mobile devices. This makes Android OS susceptible to malware attacks. We need to develop new techniques and methods to stop this influx of malware attacks. In this paper, we propose a novel technique named DroidDomTree that mines the dominance tree of API (Application programming interface) calls to find similar patterns in Android applications for detecting malware. Dominance is a transitive relation. A dominance tree of API calls highlights a strong flow of path and identifies the nesting structure of APIs and hence emphasizes the importance of certain APIs in an application. It also helps in finding modules and their interaction in an application. If a malicious module is embedded in an application, then this provides strong evidence that the application contains malware. We use these properties and develop a nested model of the dominance tree of API calls and a new scheme for assigning weights to each node in the dominance tree for efficient feature selection. During 10-fold cross-validation, with eight different classifiers using real malware Android applications, DroidDomTree achieved detection rates in the range of 98.1%-99.3% and false positive rates in the range of 1.7%-0.4%. (C) 2019 Elsevier B.V. All rights reserved.

关键词： Android malware analysis and detection Dominance tree API Calls Machine learning

来源：评论

学校读者我要写书评

暂无评论

Towards a Security Architecture for Protecting Connected Vehicles from malware 89

Towards a Security Architecture for Protecting Connected Veh...

引用

89th IEEE Vehicular Technology Conference (VTC Spring)

作者： Iqbal, Shahrear Haque, Anwar Zulkernine, Mohammad SecurityCompass Toronto ON Canada Western Univ Dept Comp Sci London ON Canada Queens Univ Sch Comp Kingston ON Canada

ISBN: (纸本)9781728112176

Vehicles are becoming increasingly connected to the outside world. We can connect our devices to the vehicle's infotainment system and internet is being added as a functionality. Therefore, security is a major concern as the attack surface has become much larger than before. Consequently, attackers are creating malware that can infect vehicles and perform life-threatening activities. For example, a malware can compromise vehicle ECUs and cause unexpected consequences. Hence, ensuring the security of connected vehicle software and networks is extremely important to gain consumer confidence and foster the growth of this emerging market. In this paper, we propose a characterization of vehicle malware and a security architecture to protect vehicle from these malware. The architecture uses multiple computational platforms and makes use of the virtualization technique to limit the attack surface. There is a real-time operating system to control critical vehicle functionalities and multiple other operating systems for non-critical functionalities (infotainment, telematics, etc.). The security architecture also describes groups of components for the operating systems to prevent malicious activities and perform policing (monitor, detect, and control). We believe this work will help automakers guard their systems against malware and provide a clear guideline for future research.

关键词： Connected vehicle security Vehicle malware malware analysis and detection

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：