检索结果-南通市图书馆

Covalent Bond Based Android malware Detection Using Permission and System Call Pairs

Computers, Materials & Continua 2024年第3期78卷 4283-4301页

作者： Rahul Gupta Kapil Sharma R.K.Garg Department of Information Technology Delhi Technological UniversityNew Delhi110042India Department of Mechanical Engineering Deenbandhu Chhotu Ram University of Science and TechnologyMurthal131039India

The prevalence of smartphones is deeply embedded in modern society,impacting various aspects of our lives.Their versatility and functionalities have fundamentally changed how we communicate,work,seek entertainment,and access information.Among the many smartphones available,those operating on the Android platform dominate,being the most widely used type.This widespread adoption of the Android OS has significantly contributed to increased malware attacks targeting the Android ecosystem in recent years.Therefore,there is an urgent need to develop new methods for detecting Android malware.The literature contains numerous works related to Android malware detection.As far as our understanding extends,we are the first ones to identify dangerous combinations of permissions and system calls to uncover malicious behavior in Android applications.We introduce a novel methodology that pairs permissions and system calls to distinguish between benign and malicious samples.This approach combines the advantages of static and dynamic analysis,offering a more comprehensive understanding of an application’s behavior.We establish covalent bonds between permissions and system calls to assess their combined impact.We introduce a novel technique to determine these pairs’Covalent Bond Strength Score.Each pair is assigned two scores,one for malicious behavior and another for benign behavior.These scores serve as the basis for classifying applications as benign or malicious.By correlating permissions with system calls,the study enables a detailed examination of how an app utilizes its requested permissions,aiding in differentiating legitimate and potentially harmful actions.This comprehensive analysis provides a robust framework for Android malware detection,marking a significant contribution to the field.The results of our experiments demonstrate a remarkable overall accuracy of 97.5%,surpassing various state-of-the-art detection techniques proposed in the current literature.

关键词： Android malware android security hybrid analysis permission and system call pairs

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

malware Attacks Detection in IoT Using Recurrent Neural Network(RNN)

引用

Intelligent Automation & Soft Computing 2024年第2期39卷 135-155页

作者： Abeer Abdullah Alsadhan Abdullah A.Al-Atawi Hanen karamti Abid Jameel Islam Zada Tan N.Nguyen Computer Science Department Imam Abdulrahman Bin Faisal UniversityDamam32232Saudi Arabia Department of Computer Science Applied CollegeUniversity of TabukTabuk47512Saudi Arabia Department of Computer Sciences College of Computer and Information SciencesPrincess Nourah bint Abdulrahman UniversityP.O.Box 84428Riyadh11671Saudi Arabia Department of Computer Sciences and Information Technology Hazara UniversityMansehraPakistan Faculty of Computing Department of Software EngineeringInternational Islamic UniversityIslamabadPakistan Department of Architectural Engineering Sejong UniversitySeoul05006Korea

IoT(Internet of Things)devices are being used more and more in a variety of businesses and for a variety of tasks,such as environmental data collection in both civilian and military situations.They are a desirable attack target for malware intended to infect specific IoT devices due to their growing use in a variety of applications and their increasing computational and processing power.In this study,we investigate the possibility of detecting IoT malware using recurrent neural networks(RNNs).RNNis used in the proposed method to investigate the execution operation codes of ARM-based Internet of Things apps(OpCodes).To train our algorithms,we employ a dataset of IoT applications that includes 281 malicious and 270 benign pieces of software.The trained model is then put to the test using 100 brand-new IoT malware samples across three separate LSTM settings.Model exposure was not previously conducted on these samples.Detecting newly crafted malware samples with 2-layer neurons had the highest accuracy(98.18%)in the 10-fold cross validation experiment.A comparison of the LSTMtechnique to other machine learning classifiers shows that it yields the best results.

关键词： malware malicious code code obfuscation IoT machine learning deep learning

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

An Innovative Approach Using TKN-Cryptology for Identifying the Replay Assault

引用

Computers, Materials & Continua 2024年第1期78卷 589-616页

作者： Syeda Wajiha Zahra Muhammad Nadeem Ali Arshad Saman Riaz Muhammad Abu Bakr Ashit Kumar Dutta Zaid Alzaid Badr Almutairi Sultan Almotairi Department of Computer Science Alhamd Islamic UniversityIslamabad44000Pakistan Department of Computer Science and Technology University of Science and Technology BeijingBeijing100083China Department of Computer Science National University of TechnologyIslamabad44000Pakistan Department of Electrical Engineering National University of TechnologyIslamabad44000Pakistan Department of Computer Science and Information Systems College of Applied SciencesAlMaarefa UniversityRiyadh13713Saudi Arabia Department of Computer Science Faculty of Computer and Information SystemsIslamic University of MadinahMedinah42351Saudi Arabia Department of Information Technology College of Computer Sciences and Information Technology CollegeMajmaah UniversityAl-Majmaah11952Saudi Arabia Department of Natural and Applied Sciences Faculty of Community CollegeMajmaah UniversityMajmaah11952Saudi Arabia

Various organizations store data online rather than on physical servers.As the number of user’s data stored in cloud servers increases,the attack rate to access data from cloud servers also increases.Different researchers worked on different algorithms to protect cloud data from replay attacks.None of the papers used a technique that simultaneously detects a full-message and partial-message replay attack.This study presents the development of a TKN(Text,Key and Name)cryptographic algorithm aimed at protecting data from replay attacks.The program employs distinct ways to encrypt plain text[P],a user-defined Key[K],and a Secret Code[N].The novelty of the TKN cryptographic algorithm is that the bit value of each text is linked to another value with the help of the proposed algorithm,and the length of the cipher text obtained is twice the length of the original text.In the scenario that an attacker executes a replay attack on the cloud server,engages in cryptanalysis,or manipulates any data,it will result in automated modification of all associated values inside the backend.This mechanism has the benefit of enhancing the detectability of replay attacks.Nevertheless,the attacker cannot access data not included in any of the papers,regardless of how effective the attack strategy is.At the end of paper,the proposed algorithm’s novelty will be compared with different algorithms,and it will be discussed how far the proposed algorithm is better than all other algorithms.

关键词： Replay attack malware message attack file encryption cryptology data security

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Robust Malicious Executable Detection Using Host-Based Machine Learning Classifier

引用

Computers, Materials & Continua 2024年第4期79卷 1419-1439页

作者： Khaled Soliman Mohamed Sobh Ayman M.Bahaa-Eldin Department of Computer and Systems Engineering Ain Shams UniversityCairo11517Egypt Department of Computer Engineering Technology ElSewedy University of TechnologyCairo44629Egypt

The continuous development of cyberattacks is threatening digital transformation endeavors worldwide and leadsto wide losses for various organizations. These dangers have proven that signature-based approaches are insufficientto prevent emerging and polymorphic attacks. Therefore, this paper is proposing a Robust Malicious ExecutableDetection (RMED) using Host-based Machine Learning Classifier to discover malicious Portable Executable (PE)files in hosts using Windows operating systems through collecting PE headers and applying machine learningmechanisms to detect unknown infected files. The authors have collected a novel reliable dataset containing 116,031benign files and 179,071 malware samples from diverse sources to ensure the efficiency of RMED approach.The most effective PE headers that can highly differentiate between benign and malware files were selected totrain the model on 15 PE features to speed up the classification process and achieve real-time detection formalicious executables. The evaluation results showed that RMED succeeded in shrinking the classification timeto 91 milliseconds for each file while reaching an accuracy of 98.42% with a false positive rate equal to 1.58. Inconclusion, this paper contributes to the field of cybersecurity by presenting a comprehensive framework thatleverages Artificial Intelligence (AI) methods to proactively detect and prevent cyber-attacks.

关键词： Portable executable malware intrusion detection cybersecurity zero-day threats Host IntrusionDetection System(HIDS) machine learning Anomaly-based Intrusion Detection System(AIDS) deep learning

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Framework for understanding intention-unbreakable malware

引用

Science China(Information Sciences) 2023年第4期66卷 174-192页

作者： Tiantian JI Binxing FANG Xiang CUI Zhongru WANG Peng LIAO Shouyou SONG Key Laboratory of Trustworthy Distributed Computing and Service(BUPT) Ministry of Education Beijing University of Posts and Telecommunications Cyberspace Institute of Advanced Technology Guangzhou University Chinese Academy of Cyberspace Studies Beijing Dig Apis Technology Co. Ltd.

The anti-analysis technology of malware has always been the focus in the cyberspace security field. As malware analysis techniques evolve, malware writers continually employ sophisticated anti-reverse engineering techniques to defeat and evade state-of-the-art analyzers. Therefore, to prepare for unknown attacks, studying malware analysis techniques is insufficient. More importantly, we should study new antianalysis techniques for malware. This paper expands the concept of anti-analysis malware and defines a type of intention-unbreakable malware(IUM). To help defenders fully understand and establish a defense system against the new security threats, this paper systematically discusses IUM from the perspectives of threat discovery, threat modeling, attribute analysis, and threat assessment; in addition, this study also provides the Po C implementations of IUM and demonstrates how attackers can use this type of malware to evade advanced security analysis, that is, accurate identification of target(class) victims and intention concealment in reaching non-target(class) victims. Finally, this paper provides several mitigation directions for combating IUM.

关键词： malware unbreakable property modeling mechanism accurate identification intention concealment

来源：

同方期刊数据库评论

在线全文

同方期刊数据库

学校读者我要写书评

暂无评论

A malware propagation prediction model based on representation learning and graph convolutional networks

引用

Digital Communications and Networks 2023年第5期9卷 1090-1100页

作者： Tun Li Yanbing Liu Qilie Liu Wei Xu Yunpeng Xiao Hong Liu College of Computer Science and Technology Chongqing University of Posts and TelecommunicationsChongqing400065China

The traditional malware research is mainly based on its recognition and detection as a breakthrough point,without focusing on its propagation trends or predicting the subsequently infected nodes.The complexity of network structure,diversity of network nodes,and sparsity of data all pose difficulties in predicting propagation.This paper proposes a malware propagation prediction model based on representation learning and Graph Convolutional Networks(GCN)to address the aforementioned problems.First,to solve the problem of the inaccuracy of infection intensity calculation caused by the sparsity of node interaction behavior data in the malware propagation network,a mechanism based on a tensor to mine the infection intensity among nodes is proposed to retain the network structure information.The influence of the relationship between nodes on the infection intensity is also analyzed.Second,given the diversity and complexity of the content and structure of infected and normal nodes in the network,considering the advantages of representation learning in data feature extraction,the corresponding representation learning method is adopted for the characteristics of infection intensity among nodes.This can efficiently calculate the relationship between entities and relationships in low dimensional space to achieve the goal of low dimensional,dense,and real-valued representation learning for the characteristics of propagation spatial data.We also design a new method,Tensor2vec,to learn the potential structural features of malware propagation.Finally,considering the convolution ability of GCN for non-Euclidean data,we propose a dynamic prediction model of malware propagation based on representation learning and GCN to solve the time effectiveness problem of the malware propagation carrier.The experimental results show that the proposed model can effectively predict the behaviors of the nodes in the network and discover the influence of different characteristics of nodes on the malware propagation situation.

关键词： malware Representation learning Graph convolutional networks(GCN) Tensor decomposition Propagation prediction

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Using Capsule Networks for Android malware Detection Through Orientation-Based Features

引用

Computers, Materials & Continua 2022年第3期70卷 5345-5362页

作者： Sohail Khan Mohammad Nauman Suleiman Ali Alsaif Toqeer Ali Syed Hassan Ahmad Eleraky Deanship of Preparatory Year and Supporting Studies Computer Science DepartmentImam Abdulrahman Bin Faisal UniversityDammamSaudi Arabia National University of Computer and Emerging Sciences Pakistan Department of Computer Science Islamic University of MedinaMedinaSaudi Arabia

Mobile phones are an essential part of modern life.The two popular mobile phone platforms,Android and iPhone Operating System(iOS),have an immense impact on the lives of millions of people.Among these two,Android currently boasts more than 84%market share.Thus,any personal data put on it are at great risk if not properly protected.On the other hand,more than a million pieces of malware have been reported on Android in just 2021 till date.Detecting and mitigating all this malware is extremely difficult for any set of human experts.Due to this reason,machine learning-and specifically deep learning-has been utilized in the recent past to resolve this issue.However,deep learning models have primarily been designed for image analysis.While this line of research has shown promising results,it has been difficult to really understand what the features extracted by deep learning models are in the domain of malware.Moreover,due to the translation invariance property of popular models based on ConvolutionalNeural Network(CNN),the true potential of deep learning for malware analysis is yet to be realized.To resolve this issue,we envision the use of Capsule Networks(CapsNets),a state-of-the-art model in deep learning.We argue that since CapsNets are orientation-based in terms of images,they can potentially be used to capture spatial relationships between different features at different locations within a sequence of opcodes.We design a deep learning-based architecture that efficiently and effectively handles very large scale malware datasets to detect Androidmalware without resorting to very deep networks.This leads tomuch faster detection as well as increased accuracy.We achieve state-of-the-art F1 score of 0.987 with an FPR of just 0.002 for three very large,real-world malware datasets.Our code is made available as open source and can be used to further enhance our work with minimal effort.

关键词： malware security Android deep learning capsule networks

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

malware homology identification based on a gene perspective

引用

Frontiers of Information Technology & Electronic Engineering 2019年第6期20卷 801-815页

作者： Bing-lin ZHAO Zheng SHAN Fu-dong LIU Bo ZHAO Yi-hang CHEN Wen-jie SUN State Key Laboratory of Mathematical Engineering and Advanced Computing Zhengzhou 450001 China Georg-August-University of Goettingen Goettingen 37077 Germany

malware homology identification is important in attacking event tracing, emergency response scheme generation, and event trend prediction. Current malware homology identification methods still rely on manual analysis, which is inefficient and cannot respond quickly to the outbreak of attack events. In response to these problems, we propose a new malware homology identification method from a gene perspective. A malware gene is represented by the subgraph, which can describe the homology of malware families. We extract the key subgraph from the function dependency graph as the malware gene by selecting the key application programming interface(API) and using the community partition algorithm. Then, we encode the gene and design a frequent subgraph mining algorithm to find the common genes between malware families. Finally, we use the family genes to guide the identification of malware based on homology. We evaluate our method with a public dataset, and the experiment results show that the accuracy of malware classification reaches 97% with high efficiency.

关键词： malware classification Gene perspective Dependency graph Homology analysis

来源：

维普期刊数据库

同方期刊数据库评论

在线全文

学校读者我要写书评

暂无评论

MBB-IoT:Construction and Evaluation of IoT DDoS Traffic Dataset from a New Perspective

引用

Computers, Materials & Continua 2023年第8期76卷 2095-2119页

作者： Yi Qing Xiangyu Liu Yanhui Du Department of Artificial Intelligence People’s Public Security University of ChinaBeijing100038China Department of Cybersecurity People’s Public Security University of ChinaBeijing100038China

Distributed Denial of Service(DDoS)attacks have always been a major concern in the security field.With the release of malware source codes such as BASHLITE and Mirai,Internet of Things(IoT)devices have become the new source of DDoS attacks against many Internet applications.Although there are many datasets in the field of IoT intrusion detection,such as Bot-IoT,ConstrainedApplication Protocol–Denial of Service(CoAPDoS),and LATAM-DDoS-IoT(some of the names of DDoS datasets),which mainly focus on DDoS attacks,the datasets describing new IoT DDoS attack scenarios are extremely rare,and only N-BaIoT and IoT-23 datasets used IoT devices as DDoS attackers in the construction process,while they did not use Internet applications as victims either.To supplement the description of the new trend of DDoS attacks in the dataset,we built an IoT environment with mainstream DDoS attack tools such as Mirai and BASHLITE being used to infect IoT devices and implement DDoS attacks against WEB servers.Then,data aggregated into a dataset namedMBB-IoTwere captured atWEBservers and IoT nodes.After the MBB-IoT dataset was split into a training set and a test set,it was applied to the training and testing of the Random Forests classification algorithm.The multi-class classification metrics were good and all above 90%.Secondly,in a cross-evaluation experiment based on Support Vector Machine(SVM),Light Gradient Boosting Machine(LightGBM),and Long Short Term Memory networks(LSTM)classification algorithms,the training set and test set were derived from different datasets(MBB-IoT or IoT-23),and the test performance is better when MBB-IoT is used as the training set.

关键词： Intrusion detection IoT malware botnet DDoS dataset

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

JShellDetector: A Java FilelessWebshell Detector Based on Program Analysis

引用

Computers, Materials & Continua 2023年第4期75卷 2061-2078页

作者： Xuyan Song Yiting Qin Xinyao Liu Baojiang Cui Junsong Fu School of Cyber Security Beijing University of Posts and TelecommunicationsBeijing100876China

Fileless webshell attacks against Java web applications have becomemore frequent in recent years as Java has gained market share. Webshell is amalicious script that can remotely execute commands and invade servers. Itis widely used in attacks against web applications. In contrast to traditionalfile-based webshells, fileless webshells leave no traces on the hard drive, whichmeans they are invisible to most antivirus software. To make matters worse,although there are some studies on fileless webshells, almost all of themare aimed at web applications developed in the PHP language. The complexmechanism of Java makes researchers face more challenges. To mitigate thisattack, this paper proposes JShellDetector, a fileless webshell detector forJava web applications based on program analysis. JShellDetector uses methodprobes to capture dynamic characteristics of web applications in the JavaVirtual Machine (JVM). When a suspicious class tries to call a specificsensitive method, JShellDetector catches it and converts it from the JVMto a bytecode file. Then, JShellDetector builds a Jimple-based control flowgraph and processes it using taint analysis techniques. A suspicious classis considered malicious if there is a valid path from sources to sinks. Todemonstrate the effectiveness of the proposed approach, we manually collect35 test cases (all open source on GitHub) and test JShellDetector and onlytwo other Java fileless webshell detection tools. The experimental results showthat the detection rate of JShellDetector reaches 77.1%, which is about 11%higher than the other two tools.

关键词： Web security fileless webshell Java web application malware

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

欢迎您,

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

请选择保存的检索档案：

请选择收藏分类：

通借通还

欢迎您,

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：