检索结果-内蒙古大学图书馆

PowerDetector:Malicious powershell Script Family Classification Based on Multi-Modal Semantic Fusion and Deep Learning

引用

China Communications 2023年第11期20卷 202-224页

作者： Xiuzhang Yang Guojun Peng Dongni Zhang Yuhang Gao Chenguang Li School of Cyber Science and Engineering Wuhan UniversityWuhan 430072China Key Laboratory of Aerospace Information Security and Trusted Computing Ministry of EducationWuhan 430072China School of Information Guizhou University of Finance and EconomicsGuiyang 550025China

Power Shell has been widely deployed in fileless malware and advanced persistent threat(APT)attacks due to its high stealthiness and live-off-theland ***,existing works mainly focus on deobfuscation and malicious detection,lacking the malicious Power Shell families classification and behavior ***,the state-of-the-art methods fail to capture fine-grained features and semantic relationships,resulting in low robustness and *** this end,we propose Power Detector,a novel malicious Power Shell script detector based on multimodal semantic fusion and deep ***,we design four feature extraction methods to extract key features from character,token,abstract syntax tree(AST),and semantic knowledge ***,we intelligently design four embeddings(i.e.,Char2Vec,Token2Vec,AST2Vec,and Rela2Vec) and construct a multi-modal fusion algorithm to concatenate feature vectors from different ***,we propose a combined model based on transformer and CNN-Bi LSTM to implement Power Shell family *** experiments with five types of Power Shell attacks show that PowerDetector can accurately detect various obfuscated and stealth powershell scripts,with a 0.9402 precision,a 0.9358 recall,and a 0.9374 ***,through singlemodal and multi-modal comparison experiments,we demonstrate that PowerDetector’s multi-modal embedding and deep learning model can achieve better accuracy and even identify more unknown attacks.

关键词： deep learning malicious family detection multi-modal semantic fusion powershell

来源：评论

学校读者我要写书评

暂无评论

Effective method for detecting malicious powershell scripts based on hybrid features

引用

NEUROCOMPUTING 2021年 448卷 30-39页

作者： Fang, Yong Zhou, Xiangyu Huang, Cheng Sichuan Univ Coll Cybersecur Chengdu Sichuan Peoples R China

At present, network attacks are rampant in the Internet world, and the attack methods of hackers are changing steadily. powershell is a programming language based on the command line *** framework, with powerful functions and good compatibility. Therefore, hackers often use powershell malicious scripts to attack the victims in APT attacks. When these malicious powershell scripts are executed, hackers can control the victim's computer or leave a backdoor on their computers. In this paper, a detection model of malicious powershell scripts based on hybrid features is proposed, we analyzed the differences between malicious and benign samples in text characters, functions, tokens and the nodes of the abstract syntax tree. Firstly, the script of powershell is embedded by FastText. Then the textual features, token features and the nodes features of powershell code extracted from the abstract syntax tree are added. Finally, the hybrid features of scrips will be classified by a Random Forest classifier. In the experiment, the malicious scripts are inserted into the benign scripts to weaken the features of the malicious samples in the level of abstract syntax tree nodes and tokens, which makes the scripts more complex. Even in such a complex data set, the proposed model which is based on hybrid features still achieves an accuracy of 97.76% in fivefold cross-validation. Moreover, the accuracy of this proposed model on the original scripts is 98.93%, which means that the proposed model has the ability to classify complex scripts. (c) 2021 Elsevier B.V. All rights reserved.

关键词： powershell Abstract syntax tree Scripts detection Machine learning

来源：评论

学校读者我要写书评

暂无评论

powershell Core for Linux Administrators Cookbook: Use powershell Core 6.x on Linux to automate complex, repetitive, and time-consuming tasks 1

引用

2018年

作者： Prashanth Jayaram Ram Iyer

ISBN: (数字)9781789138870

ISBN: (纸本)9781789137231

Over 150 recipes to leverage Microsoft's open source automation framework and command line shell Key Features • Work effectively on Windows, Linux, and macOS with powershell’s object-oriented approach and capabilities • Handle structured data seamlessly without the need for manual parsing • Enhance your native Linux capabilities with powershell Core 6.1 Book Description powershell Core, the open source, cross-platform that is based on the open source, cross-platform .NET Core, is not a shell that came out by accident; it was intentionally created to be versatile and easy to learn at the same time. powershell Core enables automation on systems ranging from the Raspberry Pi to the cloud. powershell Core for Linux Administrators Cookbook uses simple, real-world examples that teach you how to use powershell to effectively administer your environment. As you make your way through the book, you will cover interesting recipes on how powershell Core can be used to quickly automate complex, repetitive, and time-consuming tasks. In the concluding chapters, you will learn how to develop scripts to automate tasks that involve systems and enterprise management. By the end of this book, you will have learned about the automation capabilities of powershell Core, including remote management using OpenSSH, cross-platform enterprise management, working with Docker containers, and managing SQL databases. What you will learn • Leverage the object model of the shell, which is based on .NET Core • Administer computers locally as well as remotely using powershell over OpenSSH • Get to grips with advanced concepts of powershell functions • Use powershell for administration on the cloud • Know the best practices pertaining to powershell scripts and functions • Exploit the cross-platform capabilities of powershell to manage scheduled jobs, Docker containers and SQL Databases Who this book is for powershell Core for Linux Administrators Cookbook is for you if you are a system admini

关键词： powershell powershell Core 6.1 Linux System administration Linux admin

来源：评论

学校读者我要写书评

暂无评论

powershell-based novel framework for Big health data analysis

引用

International Journal of Information Technology (Singapore) 2021年第1期13卷 287-290页

作者： Ren, Wei Wan, Dong Zhu, Huifeng Liu, Fangfang Mirt, Greg Xu, Fan Department of Humanities and Information Management Chengdu Medical College Chengdu 610500 China First Affiliated Hospital of Chongqing Medical University Chongqing 410016 China College of Pharmaceutical Science and Chinese Medicine Southwest University Chongqing 400715 China Southwest Minzu University Chengdu 610500 China Department of Public Health Chengdu Medical College Chengdu 610500 China Neuro Occupational Activity Centre Novo mesto Ljubljana Slovenia

An obvious feature of the big data is overload. When we are held up in the Lake of big data, it is necessary to filter the most meaningful information [Khan et al. (ICCWAMTIP 2018:232–236, 2018), (Int J Inf Technol 12(2):409–417, 2020)]. The key element is segmentation, which involves the breakdown of the dataset into smaller ones. MIMIC-III (Medical Information Mart for Intensive Care III), an open critical care database, comprises data flow that encompasses patient information during whole hospital length of stay, i.e., from the beginning of hospital admission to patients’ discharge from the hospital. As MIMIC III stores a large volume of shared data, selecting useful data using traditional data mining approach to tailor academic research would be time consuming and resource demanding. Herein, we introduced a robust Windows build-in tool known as powershell, which is used to segment the big data into a practical dataset. Since the powershell script is open on the platform to demonstrate its use for further public research, we would present the step-by-step operation here to help readers grab a general idea of its mechanism. © 2020, Bharati Vidyapeeth's Institute of Computer Applications and Management.

关键词： Big data Breakdown powershell Segment

来源：评论

学校读者我要写书评

暂无评论

powershell Deep Dives

引用

2013年

作者： Jeffery Hicks ■ Richard Sidd...

ISBN: (纸本)9781617291319

SummaryHere's your chance to learn from the best in the business. powershell Deep Dives is a trove of essential techniques, practical guidance, and the expert insights you earn only through years of experience. Editors Jeffery Hicks, Richard Siddaway, Oisin Grehan, and Aleksandar Nikolic hand-picked the 28 chapters in the book's four parts: Administration, Scripting, Development, and *** the Technologypowershell has permanently changed Windows administration. This powerful scripting and automation tool allows you to control virtually every aspect of Windows and most Microsoft servers like IIS and SQL Server. Here's your chance to learn from the best in the *** this Bookpowershell Deep Dives is a trove of essential techniques and practical guidance. It is rich with insights from experts who won them through years of experience. The book's 28 chapters, grouped in four parts (Administration, Scripting, Development, and Platforms), were hand-picked by four section editors: Jeffery Hicks, Richard Siddaway, Oisin Grehan, and Aleksandar *** you're just getting started with powershell or you already use it daily, you'll find yourself returning to this book over and ***'s InsideManaging systems through a keyhole The Ten Commandments of powershell scripting Scalable scripting for large datasets Adding automatic remoting Provisioning web servers and websites automatically to IIS 8 And 23 more fantastic chaptersPurchase of the print book includes a free eBook in PDF, Kindle, and ePub formats from Manning *** the Authors Editors Jeffery Hicks, Richard Siddaway, Oisin Grehan, and Aleksandar Nikolic are joined by powershell experts Chris Bellee, Bartek Bielawski, Robert C. Cain, Jim Christopher, Adam Driscoll, Josh Gavant, Jason Helmick, Don Jones, Ashley McGlone, Jonathan Medd, Ben Miller, James O'Neill, Arnaud Petitjean, Vadims Podans, Karl Prosser, Boe Prox, Matthew Reynolds, Mike Robbins, Donabel Santos, Will Steele, Trev

关键词： dives powershell

来源：评论

学校读者我要写书评

暂无评论

The Power of powershell: Examples of how powershell Scripts can Supplement a Patch Management System to Solve Unusual Problems 17

The Power of PowerShell: Examples of how PowerShell Scripts ...

引用

45th ACM Annual Conference on SIGUCCS (SIGUCCS)

作者： Palumbo, Timothy Lehigh Univ 8B East Packer Ave Bethlehem PA 18015 USA

ISBN: (纸本)9781450349192

Lehigh University currently utilizes the Flexera Corporate Software Inspector (CSI, formerly Secunia CSI) application to patch faculty/staff computers on campus. This system patches third-party applications on all currently supported Windows operating systems by leveraging the Windows Server Update Service (WSUS). This presentation is not meant to focus on a particular patch management product or system, but instead it will discuss how such a system can be used to solve unusual problems when coupled with a powerful scripting language such as powershell. This presentation will focus on specific scenarios that powershell solved when combined with our patch management system. The scenarios it will present include: an update to our internet browser software, Mozilla Firefox, which when updated disabled our ad-blocking extension, an issue of unknown origin which caused all of our Windows 7 systems to no longer activate utilizing our Key Management Service (KMS) (this included Microsoft Office products), a glitch in Windows 7 which caused garbage files to generate non-stop and completely fill end user hard drives, and our rather unusual implementation of Java. powershell saved us immeasurable time in resolving these issues across our entire campus. Using powershell with our patch management solution allows us to resolve almost any issue, campus-wide, with the push of a button.

关键词： powershell troubleshooting patch management remote support

来源：评论

学校读者我要写书评

暂无评论

Effective and Light-Weight Deobfuscation and Semantic-Aware Attack Detection for powershell Scripts 19

Effective and Light-Weight Deobfuscation and Semantic-Aware ...

引用

ACM SIGSAC Conference on Computer and Communications Security (CCS)

作者： Li, Zhenyuan Chen, Qi Alfred Xiong, Chunlin Chen, Yan Zhu, Tiantian Yang, Hai Zhejiang Univ Hangzhou Peoples R China Univ Calif Irvine Irvine CA USA Northwestern Univ Evanston IL 60208 USA Zhejiang Univ Technol Hangzhou Peoples R China MagicShield Inc Oceanside CA USA

ISBN: (纸本)9781450367479

In recent years, powershell is increasingly reported to appear in a variety of cyber attacks ranging from advanced persistent threat, ransomware, phishing emails, cryptojacking, financial threats, to fileless attacks. However, since the powershell language is dynamic by design and can construct script pieces at different levels, state-of-the-art static analysis based powershell attack detection approaches are inherently vulnerable to obfuscations. To overcome this challenge, in this paper we design the first effective and light-weight deobfuscation approach for powershell scripts. To address the challenge in precisely identifying the recoverable script pieces, we design a novel subtree-based deobfuscation method that performs obfuscation detection and emulation-based recovery at the level of subtrees in the abstract syntax tree of powershell scripts. Building upon the new deobfuscation method, we are able to further design the first semantic-aware powershell attack detection system. To enable semantic-based detection, we leverage the classic objective-oriented association mining algorithm and newly identify 31 semantic signatures for powershell attacks. We perform an evaluation on a collection of 2342 benign samples and 4141 malicious samples, and find that our deobfuscation method takes less than 0.5 seconds on average and meanwhile increases the similarity between the obfuscated and original scripts from only 0.5% to around 80%, which is thus both effective and light-weight. In addition, with our deobfuscation applied, the attack detection rates for Windows Defender and VirusTotal increase substantially from 0.3% and 2.65% to 75.0% and 90.0%, respectively. Furthermore, when our deobfuscation is applied, our semantic-aware attack detection system outperforms both Windows Defender and VirusTotal with a 92.3% true positive rate and a 0% false positive rate on average.

关键词： powershell deobfuscation abstract syntax tree semantic-aware

来源：评论

学校读者我要写书评

暂无评论

Transformer-Based Original Content Recovery from Obfuscated powershell Scripts 29th

Transformer-Based Original Content Recovery from Obfuscated ...

引用

29th International Conference on Neural Information Processing

作者： Dedeko, Michal Scherer, Rafal Czestochowa Tech Univ Czestochowa Poland

ISBN: (纸本)9789819916474;9789819916481

Microsoft powershell is a scripting language and a command-line utility, widely used by professionals to automate tasks and to manage system services. Due to the fact of its prevalence, it was recently seen abused by malicious parties in their offensive operations. Unfortunately, antimalware software is often helpless with powershell scripts, as each copy of the script can be unique thanks to obfuscation techniques. Obfuscation is a process of altering the source code through various transformations so that the syntax changes, but the program's operation is unaffected. The technique is nowadays mostly used by attackers to prevent their code from being flagged as malicious and to impede its analysis. Most of the current solutions to recover the original content from obfuscated scripts are based on human-written algorithms, which make them difficult to maintain and prone to errors. We present a solution to deal with obfuscated code by a Transformer-based model operating on a character level to reverse the obfuscation process. We do it on the example of obfuscated powershell commands, but the method is generic so that it can be used for other scripting languages as well. We were able to successfully recover full content in 92% cases and recover at least 90% of the content in 100% cases. The most important aspect of our approach is the ability to almost fully automate the process of creating a deobfuscator.

关键词： powershell deobfuscation Obfuscation detection Transformer Machine learning

来源：评论

学校读者我要写书评

暂无评论

Evaluating the Possibility of Evasion Attacks to Machine Learning-Based Models for Malicious powershell Detection 17th

Evaluating the Possibility of Evasion Attacks to Machine Lea...

引用

17th International Conference on Information Security Practice and Experience (ISPEC)

作者： Mezawa, Yuki Mimura, Mamoru Natl Def Acad Japan Yokosuka Kanagawa Japan

ISBN: (纸本)9783031212796;9783031212802

In cyber attacks, powershell has become a convenient tool for attackers. A previous study proposed a classification method for powershell scripts that combines natural language processing (NLP) techniques and machine learning models. Although it has been pointed out that the accuracy of machine learning is degraded by adversarial input, no evaluation has been reported for powershell classification. In this study, we evaluated the possibility of evasion attacks to the machine learning-based model for malicious powershell detection. In addition to Bag-of-Words, Latent Semantic Indexing (LSI), and Support Vector Machine (SVM), we combined Doc2Vec, RandomForest, and XGBoost with the previous models. As a result, we confirmed that evasion attacks are possible in powershell. In particular, the models using Doc2Vec decreased the recall rate by 0.78 at maximum. The effect mainly depends on the NLP technique, and there was almost no difference in any machine learning models with LSI.

关键词： powershell Latent semantic indexing Doc2Vec XGBoost

来源：评论

学校读者我要写书评

暂无评论

Windows powershell Desired State Configuration Revealed 1st ed.

引用

丛书名： Books for professionals by professionals;The expert's voice in powershell

2014年

作者： Ravikanth Chaganti

ISBN: (数字)9781484200162

ISBN: (纸本)9781484200179

Desired State Configuration (DSC) is a powerful new configuration management platform that makes it easier than ever to perform cross-platform configuration management of your infrastructure, whether on-premise or in the cloud. DSC provides the management platform and Application Programming Interface (API) that can be used with any programming language. Windows powershell Desired State Configuration Revealed will take you through this new technology from start to finish and demonstrates the DSC interfaces through Windows powershell. DSC allows you to manage target devices by simply declaring what state you want them to be in, using new declarative language extensions, rather than writing detailed instructions to get them into that state. This makes continuous delivery in Windows easier than ever before. In an environment where changes and deployments are happening all the time, DSC makes the necessary adjustments to the system so you dont have to. Windows powershell Desired State Configuration Revealed starts with an overview of the configuration management features in Windows, followed by a discussion of the architecture of DSC and its components. Youll then explore DSCs built-in features and resources, followed by some of the different methods provided for delivering configuration information within your ecosystem, and learn about configuration monitoring and reporting. In the latter part of the book, youll find out how to get more power out of DSC by writing your own custom DSC resources, including a range of useful examples, and the book concludes with vital information on deploying and troubleshooting DSC in a production environment, along with some expert tips and tricks you might find useful along the way. Windows powershell Desired State Configuration Revealed is your one-stop guide to this new technology and how it can change your working life for the better. What youll learn Why continuous delivery and configuration management are important Architecture a

关键词： configuration revealed state desired powershell windows

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：