检索结果-内蒙古大学图书馆

作者： Mayuri Wadkar San Jose State University

学位级别：硕士

malware is software that is designed to do harm to computer systems. malware often evolves over a period of time as malware developers add new features and fix bugs. Thus, malware samples from the same family from different time periods can exhibit significantly different behavior. Differences between malware samples within a single family can originate from various code modifications designed to evade signature-based detection or changes that are made to alter the functionality of the malware itself. In this research, we apply feature ranking based on linear support vector machine (SVM) weights to identify, quantify, and track changes within malware families over time. We analyze numerous malware families over an extended period of time. Our goal is to detect and analyze evolutionary changes over a wide variety of malware families using quantifiable and automated machine learning techniques.

关键词： malware evolution svm Artificial Intelligence and Robotics Information Security

来源：评论

学校读者我要写书评

暂无评论

Process mining meets malware evolution : a study of the behavior of malicious code 4

Process mining meets malware evolution : a study of the beha...

引用

4th International Symposium on Computing and Networking (CANDAR)

作者： Bernardi, Mario Luca Cimitile, Marta Mercaldo, Francesco Giustino Fortunato Univ Benevento Italy Unitelma Sapienza Univ Rome Italy Natl Res Council Italy CNR Inst Informat & Telemat Pisa Italy

ISBN: (纸本)9781509026555

Mobile phones are more and more used for sensitive resources exchange and access, becoming target for possible malware attacks. These attacks are still increasing with the birth of new and sophisticated malware that make the existing malware detection approaches often inadequate. Since the majority of new malware are generated using existing malicious code, it becomes very important tracking the mobile malware phylogeny. In this work, a Process Mining (PM) approach for building a malware phylogeny model using information contained in system calls traces, is proposed. The adoption of a declarative Process Mining technique allows to mine a constraint-based model that can be effectively used as a malware fingerprint expressing relationships and recurring execution patterns among system calls in the execution flows. The model characterizes the behavior of malware applications allowing the identification of similarities across malware families and among malware variants belonging to the same family. The proposed approach is evaluated using a dataset of more than 700 infected applications across seven malware families obtaining very encouraging results.

关键词： Process Mining Linear Temporal Logic Declare malware evolution malware Phylogeny Security

来源：评论

学校读者我要写书评

暂无评论

FeSAD ransomware detection framework with machine learning using adaption to concept drift

引用

COMPUTERS & SECURITY 2024年 137卷

作者： Fernando, Damien Warren Komninos, Nikos City Univ London Sch Math Comp Sci & Engn Dept Comp Sci London England

This paper proposes FeSAD, a framework that will allow a machine learning classifier to detect evolutionary ransomware. Ransomware is a critical player in the malware space that causes hundreds of millions of dollars of damage globally and evolves quickly. The evolution of ransomware in machine learning classifiers is often calculated as concept drift. Concept drift is dangerous as changes in the behavior of ransomware can easily lead to misclassifications, and misclassification can harm individuals and businesses. Our proposed framework consists of a feature selection layer, drift calibration layer and drift decision layer that allows a machine learning classifier to detect and classify concept drift samples reliably. We evaluate the FeSAD framework in various concept drift scenarios and observe its ability to detect drifting samples effectively. The FeSAD framework also evaluated on its ability to extend the lifespan of a classifier. The results obtained by this research show that FeSAD can successfully and reliably classify ransomware and benign samples while under concept drift and can extend the time between retraining.

关键词： Ransomware detection Machine learning Concept drift malware evolution Genetic algorithm

来源：评论

学校读者我要写书评

暂无评论

A Review of State-of-the-Art malware Attack Trends and Defense Mechanisms

引用

IEEE ACCESS 2023年 11卷 121118-121141页

作者： Ferdous, Jannatul Islam, Rafiqul Mahboubi, Arash Islam, Md. Zahidul Charles Sturt Univ Sch Comp Math & Engn Wagga Wagga NSW 2650 Australia Charles Sturt Univ Sch Comp Math & Engn Albury NSW 2640 Australia Charles Sturt Univ Sch Comp & Math Port Macquarie NSW 2444 Australia Charles Sturt Univ Sch Comp Math & Engn Bathurst NSW 2795 Australia

The increasing sophistication of malware threats has led to growing concerns in the anti-malware community, as malware poses a significant danger to online users despite the availability of numerous defense solutions. This study aims to comprehensively review malware evolution and current attack trends to identify effective defense mechanisms. It reviews the most recent journal articles, conference proceedings, reports, and online resources published during the last five years. We extensively review the malware landscape from 1970 to the present and analyze malware types, operational mechanisms, attack vectors, and vulnerabilities. Furthermore, we explore different defensive strategies developed in response to these evolving threats. Our findings highlight the increasing sophistication of malware attack trends, including a surge in cryptojacking, attacks on mobile devices, Internet of Things devices, ransomware, advanced persistent threats, supply chain attacks, fileless malware, cloud-based attacks, exploitation of remote employees, and attack trends on edge networks. Defense strategies have also evolved in parallel, emphasizing multilayered security measures to counter these dynamic threats. This study highlights the critical need for robust, multilayered security measures to combat dynamic malware. Despite these advancements, some open challenges and significant research gaps remain, which require further innovation. This review serves as a valuable guide for cybersecurity professionals by identifying the key trends, challenges, limitations, and future cybersecurity research opportunities.

关键词： malware Market research Ransomware Trojan horses Security Rootkit Internet of Things Machine learning malware evolution malware attack trends defense mechanisms malware detection machine learning deep learning

来源：评论

学校读者我要写书评

暂无评论

Android malware concept drift using system calls: Detection, characterization and challenges

引用

EXPERT SYSTEMS WITH APPLICATIONS 2022年第0期206卷

作者： Guerra-Manzanares, Alejandro Luckner, Marcin Bahsi, Hayretdin Tallinn Univ Technol Dept Software Sci Tallinn Estonia Warsaw Univ Technol Fac Math & Informat Sci Warsaw Poland

The majority of Android malware detection solutions have focused on the achievement of high performance in old and short snapshots of historical data, which makes them prone to lack the generalization and adaptation capabilities needed to discriminate effectively new malware trends in an extended time span. These approaches analyze the phenomenon from a stationary point of view, neglecting malware evolution and its degenerative impact on detection models as new data emerge, the so-called concept drift. This research proposes a novel method to detect and effectively address concept drift in Android malware detection and demonstrates the results in a seven-year-long data set. The proposed solution manages to keep high-performance metrics over a long period of time and minimizes model retraining efforts by using data sets belonging to short periods. Different timestamps are evaluated in the experimental setup and their impact on the detection performance is compared. Additionally, the characterization of concept drift in Android malware is performed by leveraging the inner workings of the proposed solution. In this regard, the discriminatory properties of the important features are analyzed at various time horizons.

关键词： Concept drift Android malware System calls Mobile malware malware characterization malware detection malware evolution malware behavior

来源：评论

学校读者我要写书评

暂无评论

On the relativity of time: Implications and challenges of data drift on long-term effective android malware detection

引用

COMPUTERS & SECURITY 2022年 122卷

作者： Guerra-Manzanares, Alejandro Bahsi, Hayretdin Tallinn Univ Technol Dept Software Sci Tallinn Estonia

The vast body of research in the Android malware detection domain has demonstrated that machine learning can provide high performance for mobile malware detection. However, the learning models have been usually evaluated with data sets encompassing short time frames, generating doubts about the feasibility of these models in operational settings that deal with the ever-evolving malware threat landscape. Although a limited number of studies have developed concept drift resilient models for handling data drift, they have never considered the impact of different timestamps on the detection solutions. Timestamps are critical to locating the data samples within the historical timeline. Different timestamping approaches may locate samples differently, which, in turn, can significantly impact the performance of the model and, consequently, the adaptive capabilities of the system to concept drift. In this study, we conducted a comprehensive benchmarking that compares the detection performance of six distinct timestamping approaches for static and dynamic feature sets. Our experiments have demonstrated that timestamp selection is an important decision that has a significant impact on concept drift modeling and the long-term performance of the model regardless of the feature type used for model construction. (c) 2022 Elsevier Ltd. All rights reserved.

关键词： Android malware Machine learning Timestamp malware detection Concept drift malware evolution Data drift

来源：评论

学校读者我要写书评

暂无评论

Towards enhanced PDF maldocs detection with feature engineering: design challenges

引用

MULTIMEDIA TOOLS AND APPLICATIONS 2022年第28期81卷 41103-41130页

作者： Falah, Ahmed Pokhrel, Shiva Raj Pan, Lei de Souza-Daw, Anthony Deakin Univ Melbourne Vic Australia Melbourne Polytech Melbourne Vic Australia

In this paper, we perform an in-depth analysis of a large corpus of PDF maldocs to identify the key set of significantly important features and help in maldoc detection. Existing industry-based tools for the detection are inefficient and cannot prevent PDF maldocs because they are generic and depend primarily on a signature-based approach. Besides, several other methods developed by academics suffer heavily from reduced effectiveness. The feature-set using machine learning classifiers is prone to various known attacks, such as mimicry and parser confusion. Also, we discover that increasingly more malicious files i) contain evasive and obfuscated JavaScript code, ii) include hidden contents (mostly outside the objects), iii) have a corrupted document structure, and iv) usually contain short JavaScript code blocks. We utilise maldoc attacks' evolution over a decade to highlight the essential features (e.g., concept drifts) that impact detectors and classifiers.

关键词： PDF Maldoc Concept drifts Feature engineering malware evolution malware detection

来源：评论

学校读者我要写书评

暂无评论

MALRADAR: Demystifying Android malware in the New Era

引用

PROCEEDINGS OF THE ACM ON MEASUREMENT AND ANALYSIS OF COMPUTING SYSTEMS 2022年第2期6卷 1–27页

作者： Wang, Liu Wang, Haoyu He, Ren Tao, Ran Meng, Guozhu Luo, Xiapu Liu, Xuanzhe Beijing Univ Posts & Telecommun Beijing Peoples R China Huazhong Univ Sci & Technol Wuhan Peoples R China Chinese Acad Sci Inst Informat Engn SKLOIS Beijing Peoples R China Hong Kong Polytech Univ Hong Kong Peoples R China Peking Univ Beijing Peoples R China

Mobile malware detection has attracted massive research effort in our community. A reliable and up-to-date malware dataset is critical to evaluate the effectiveness of malware detection approaches. Essentially, the malware ground truth should be manually verified by security experts, and their malicious behaviors should be carefully labelled. Although there are several widely-used malware benchmarks in our community (e.g., MalGenome, Drebin, Piggybacking and AMD, etc.), these benchmarks face several limitations including out-of-date, size, coverage, and reliability issues, etc. In this paper, we first make efforts to create MalRadar, a growing and up-to-date Android malware dataset using the most reliable way, i.e., by collecting malware based on the analysis reports of security experts. We have crawled all the mobile security related reports released by ten leading security companies, and used an automated approach to extract and label the useful ones describing new Android malware and containing Indicators of Compromise (IoC) information. We have successfully compiled MalRadar, a dataset that contains 4,534 unique Android malware samples (including both apks and metadata) released from 2014 to April 2021 by the time of this paper, all of which were manually verified by security experts with detailed behavior analysis. Then we characterize the MalRadar dataset from malware distribution channels, app installation methods, malware activation, malicious behaviors and anti-analysis techniques. We further investigate the malware evolution over the last decade. At last, we measure the effectiveness of commercial anti-virus engines and malware detection techniques on detecting malware in MalRadar. Our dataset can be served as the representative Android malware benchmark in the new era, and our observations can positively contribute to the community and boost a series of research studies on mobile security.

关键词： Android malware dataset malware evolution security reports

来源：评论

学校读者我要写书评

暂无评论

MalRadar: Demystifying Android malware in the New Era 22

MalRadar: Demystifying Android Malware in the New Era

引用

2022 ACM SIGMETRICS/IFIP PERFORMANCE Joint International Conference on Measurement and Modeling of Computer Systems, SIGMETRICS/PERFORMANCE 2022

作者： Wang, Liu Wang, Haoyu He, Ren Tao, Ran Meng, Guozhu Luo, Xiapu Liu, Xuanzhe Beijing University of Posts and Telecommunications Beijing China Huazhong University of Science and Technology Wuhan China Institute of Information Engineering Chinese Academy of Sciences Beijing China The Hong Kong Polytechnic University Hong Kong Hong Kong Peking University Beijing China

ISBN: (纸本)9781450391412

A reliable and up-to-date malware dataset is critical to evaluate the effectiveness of malware detection approaches. Although there are several widely-used malware benchmarks in our community (e.g., MalGenome, Drebin, Piggybacking and AMD, etc.), these benchmarks face several limitations including out-of-date, size, coverage, and reliability issues, etc. In this paper, we first make effort to create MalRadar, a growing and up-to-date Android malware dataset using the most reliable way, i.e., by collecting malware based on the analysis reports of security experts. We have crawled all the mobile security related reports released by ten leading security companies, and used an automated approach to extract and label the useful ones describing new Android malware and containing Indicators of Compromise (IoC) information. We have successfully compiled MalRadar, a dataset that contains 4,534 unique Android malware samples (including both apks and metadata) released from 2014 to April 2021 by the time of this paper, all of which were manually verified by security experts with detailed behavior analysis. Then we characterize the MalRadar dataset from malware distribution channels, app installation methods, malware activation, malicious behaviors and anti-analysis techniques. We further investigate the malware evolution over the last decade. At last, we measure the effectiveness of commercial anti-virus engines and malware detection techniques on detecting malware in MalRadar. Our dataset can be served as the representative Android malware benchmark in the new era, and our observations can positively contribute to the community and boost a series of studies on mobile security. © 2022 Owner/Author.

关键词： dataset malware evolution security reports android malware

来源：评论

学校读者我要写书评

暂无评论

Evolving malware variants as antigens for antivirus systems

引用

EXPERT SYSTEMS WITH APPLICATIONS 2023年第1期226卷

作者： Murali, Ritwik Thangavel, Palanisamy Velayutham, C. Shunmuga Amrita Vishwa Vidyapeetham Amrita Sch Comp Coimbatore Dept Comp Sci & Engn Coimbatore Tamil Nadu India Amrita Vishwa Vidyapeetham Amrita Sch Phys Sci Coimbatore Dept Math Coimbatore Tamil Nadu India

This paper proposes MAGE - A malware Antigen Generating evolutionary algorithm that is capable of generating unseen variants of a given source malware. MAGE evolves malware variants by employing code transformation functions as mutation operators and intra-population Jaccard similarity metric as fitness function. By virtue of these design choices, MAGE is capable of generating active malware variants with diverse code structure variations while retaining the maliciousness of the source malware. These malware variants (similar to biological antigens) generated throughout the run of MAGE forms a potential dataset of malware variants. The dataset can be used to train an adaptive Antivirus engine to learn the code structure variations that make up the space of malware variants. This could augment the engines ability to detect unseen malware variants, thus preventing attacks from the same. The efficacy of MAGE has been demonstrated with two malware viz. Timid , a COM infector and Intruder, an EXE infector. The simulation experiments demonstrate the potential and versatility of MAGE towards generating diverse malware variants.

关键词： Antigens evolutionary algorithms malware malware evolution Virus variants

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：