Using Capsule Networks for Android Malware Detection Through Orientation-Based Features

Mobile phones are an essential part of modern life.The two popular mobile phone platforms,Android and iPhone Operating System(iOS),have an immense impact on the lives of millions of people.Among these two,Android currently boasts more than 84%market share.Thus,any personal data put on it are at great risk if not properly protected.On the other hand,more than a million pieces of malware have been reported on Android in just 2021 till date.Detecting and mitigating all this malware is extremely difficult for any set of human experts.Due to this reason,machine learning-and specifically deep learning-has been utilized in the recent past to resolve this issue.However,deep learning models have primarily been designed for image analysis.While this line of research has shown promising results,it has been difficult to really understand what the features extracted by deep learning models are in the domain of malware.Moreover,due to the translation invariance property of popular models based on ConvolutionalNeural Network(CNN),the true potential of deep learning for malware analysis is yet to be realized.To resolve this issue,we envision the use of Capsule Networks(CapsNets),a state-of-the-art model in deep learning.We argue that since CapsNets are orientation-based in terms of images,they can potentially be used to capture spatial relationships between different features at different locations within a sequence of opcodes.We design a deep learning-based architecture that efficiently and effectively handles very large scale malware datasets to detect Androidmalware without resorting to very deep networks.This leads tomuch faster detection as well as increased accuracy.We achieve state-of-the-art F1 score of 0.987 with an FPR of just 0.002 for three very large,real-world malware datasets.Our code is made available as open source and can be used to further enhance our work with minimal effort.

Learning-Based Artificial Algae Algorithm with Optimal Machine Learning Enabled Malware Detection

Malware is a‘malicious software program that performs multiple cyberattacks on the Internet,involving fraud,scams,nation-state cyberwar,and cybercrime.Such malicious software programs come under different classifications,namely Trojans,viruses,spyware,worms,ransomware,Rootkit,botnet malware,etc.Ransomware is a kind of malware that holds the victim’s data hostage by encrypting the information on the user’s computer to make it inaccessible to users and only decrypting it;then,the user pays a ransom procedure of a sum of money.To prevent detection,various forms of ransomware utilize more than one mechanism in their attack flow in conjunction with Machine Learning(ML)algorithm.This study focuses on designing a Learning-Based Artificial Algae Algorithm with Optimal Machine Learning Enabled Malware Detection(LBAAA-OMLMD)approach in Computer Networks.The presented LBAAA-OMLMDmodelmainly aims to detect and classify the existence of ransomware and goodware in the network.To accomplish this,the LBAAA-OMLMD model initially derives a Learning-Based Artificial Algae Algorithm based Feature Selection(LBAAA-FS)model to reduce the curse of dimensionality problems.Besides,the Flower Pollination Algorithm(FPA)with Echo State Network(ESN)Classification model is applied.The FPA model helps to appropriately adjust the parameters related to the ESN model to accomplish enhanced classifier results.The experimental validation of the LBAAA-OMLMD model is tested using a benchmark dataset,and the outcomes are inspected in distinct measures.The comprehensive comparative examination demonstrated the betterment of the LBAAAOMLMD model over recent algorithms.

Detecting Hidden Malware Method Based on "In-VM" Model

Security tools are rapidly developed as network security threat is becoming more and more serious.To overcome the fundamental limitation of traditional host-based anti-malware system which is likely to be deceived and attacked by malicious codes,VMM-based anti-malware systems have recently become a hot research field.In this article,the existing malware hiding technique is analyzed,and a detecting model for hidden process based on "In-VM" idea is also proposed.Based on this detecting model,a hidden process detection technology which is based on HOOK SwapContext on the VMM platform is also implemented successfully.This technology can guarantee the detecting method not to be attacked by malwares and also resist all the current process hiding technologies.In order to detect the malwares which use remote injection method to hide themselves,a method by hijacking sysenter instruction is also proposed.Experiments show that the proposed methods guarantee the isolation of virtual machines,can detect all malware samples,and just bring little performance loss.

Malware安全可视化研究

由于传统的恶意程序分析过程往往复杂耗时,即使是经验丰富的安全分析人员也很难发现潜在的攻击模式。为减轻认知负担、提高交互性,将信息可视化技术引入恶意代码分析领域,即Malware安全可视化,正是近年来网络安全研究中的前沿热点。首先说明Malware安全可视化的紧迫性,接着分别从静态特征、动态主机特征和网络特征三个方面,详细分析了多项Malware安全可视化实例,最后讨论了该领域当前存在的问题及今后的研究方向。

Improving the Cybersecurity Framework for Future Consumer Networks

The framework Information Technology professionals and Network Organizations use is often seen as open and dynamic. This can create many different pathways for cybercriminals to launch an attack on an enterprise network to cause panic, this situation could be prevented. Using the proposed framework, network administrators and networked organizations can improve their cybersecurity framework for future consumer networks. Implementing a network security plan that is up to date and outlines responsibilities of team members, creating a government subsidy to implement and increase safeguards on US based networks, and the analyzing of past cyber-attacks metadata to further understand the attacks that are causing problems for consumer networks can improve the cybersecurity framework for consumer networks and increase potential security on US based networks. Research found that the implementation of security plans, creating a government subsidy, and analyzing past metadata all show signs of improving the framework of cybersecurity in consumer based networks.

MoBShield:A Novel XML Approach for Securing Mobile Banking

Mobile banking security has witnessed significant R&D attention from both financial institutions and academia.This is due to the growing number of mobile baking applications and their reachability and usefulness to society.However,these applications are also attractive prey for cybercriminals,who use a variety of malware to steal personal banking information.Related literature in mobile banking security requiresmany permissions that are not necessary for the application’s intended security functionality.In this context,this paper presents a novel efficient permission identification approach for securing mobile banking(MoBShield)to detect and prevent malware.A permission-based dataset is generated for mobile banking malware detection that consists large number of malicious adware apps and benign apps to use as training datasets.The dataset is generated from 1650 malicious banking apps of the Canadian Institute of Cybersecurity,University of New Brunswick and benign apps from Google Play.A machine learning algorithm is used to determine whether amobile banking application ismalicious based on its permission requests.Further,an eXplainable machine learning(XML)approach is developed to improve trust by explaining the reasoning behind the algorithm’s behaviour.Performance evaluation tests that the approach can effectively and practically identify mobile banking malware with high precision and reduced false positives.Specifically,the adapted artificial neural networks(ANN),convolutional neural networks(CNN)and XML approaches achieve a higher accuracy of 99.7%and the adapted deep neural networks(DNN)approach achieves 99.6%accuracy in comparison with the state-of-the-art approaches.These promising results position the proposed approach as a potential tool for real-world scenarios,offering a robustmeans of identifying and thwarting malware inmobile-based banking applications.Consequently,MoBShield has the potential to significantly enhance the security and trustworthiness of mobile banking platforms,mitigating the risks posed by cyber threats and ensuring a safer user experience.

基于SIR模型的无线网络安全威胁态势量化评估算法

为确保网络安全,及时掌控安全状况,以易感者、感染者和免疫者(SIR:Susceptible Infected Recovered)模型为基础,面向无线网络提出安全威胁态势量化评估算法。选取资产价值性,系统脆弱性与威胁性作为量化评估指标,分别根据信息资产的安全属性与主机劣势的Agent检测值,得到价值性量化值与脆弱性量化值。基于病毒的传播特性,改进SIR模型,分析病毒传播特征,获得威胁性量化值。结合3个指标量化值,建立无线网络安全威胁态势的量化评估算法,用所得态势值评估网络安全状况。测试结果表明,该方法评估出的主机与整个无线网络的安全威胁态势值均与期望值高度拟合,且评估时间更短。所提算法具备良好的评估准确性与实时性,能为网络安全状况分析提供有效的数据依据,及时给予管理员可靠的决策支持。

VMScan: an out-of-VM malware scanner

The harm caused by malware in cloud computing environment is more and more serious. Traditional anti-virus software is in danger of being attacked when it is deployed in virtual machine on a large scale, and it tends not to be accepted by tenants in terms of performance. In this paper, a method of scanning malicious programs outside the virtual machine is proposed, and the prototype is implemented. This method transforms the memory of the virtual machine to the host machine so that the latter can access it. The user space and kernel space of virtual machine memory are analyzed via semantics, and suspicious processes are scanned by signature database. Experimental results show that malicious programs can be effectively scanned outside the virtual machine, and the performance impact on the virtual machine is low, meeting the needs of tenants.

面向小样本的恶意软件检测综述

恶意软件检测是网络空间安全研究中的热点问题,例如Windows恶意软件检测和安卓恶意软件检测等.随着机器学习和深度学习的发展,一些在图像识别、自然语言处理领域的杰出算法被应用到恶意软件检测,这些算法在大量数据下表现出了优异的学习性能.但是,恶意软件检测中有一些具有挑战性的问题仍然没有被有效解决,例如,基于少量新颖类型的恶意软件,常规的学习方法无法实现有效检测.因此,小样本学习(few-shot learning,FSL)被用于解决面向小样本的恶意软件检测(few-shot for malware detection, FSMD)问题.通过相关文献,提取出FSMD的问题定义和一般流程.根据方法原理,将FSMD方法分为:基于数据增强的方法、基于元学习的方法和多技术结合的混合方法,并讨论每类FSMD方法的特点.最后,提出对FSMD的背景、技术和应用的展望.

基于深度学习的Linux系统DKOM攻击检测

直接内核对象操纵(DKOM)攻击通过直接访问和修改内核对象来隐藏内核对象,是主流操作系统长期存在的关键安全问题。对DKOM攻击进行基于行为的在线扫描适用的恶意程序类型有限且检测过程本身易受DKOM攻击影响。近年来,针对潜在受DKOM攻击的系统进行基于内存取证的静态分析成为一种有效和安全的检测方法。现有方法已能够针对Windows内核对象采用图神经网络模型进行内核对象识别,但不适用于Linux系统内核对象,且对于缺少指针字段的小内核对象的识别有效性有限。针对以上问题,设计并实现了一种基于深度学习的Linux系统DKOM攻击检测方案。首先提出了一种扩展内存图结构刻画内核对象的指针指向关系和常量字段特征,利用关系图卷积网络对扩展内存图的拓扑结构进行学习以实现内存图节点分类,使用基于投票的对象推测算法得出内核对象地址,并通过与现有分析框架Volatility的识别结果对比实现对Linux系统DKOM攻击的检测。提出的扩展内存图结构相比现有的内存图结构能更好地表示缺乏指针但具有常量字段的小内核数据结构的特征,实现更高的内核对象检测有效性。与现有基于行为的在线扫描工具chkrootkit相比,针对5种现实世界Rootkit的DKOM行为,所提方案实现了更高的检测有效性,精确度提高20.1%,召回率提高32.4%。

基于复杂网络的计算机病毒传播路由算法

信息安全就是国家安全,为降低计算机病毒在计算机网络中的传播速度,提高计算机网络的安全性,文章提出了基于复杂网络的计算机病毒传播路由算法。首先构建基于复杂网络的计算机网络模型,确定计算机病毒传播模型。其次改进静态路由协议和动态路由协议,在两种协议的基础上设置邻居节点阈值,提出基于复杂网络的计算机病毒传播路由算法,将该算法采用BA网络模型进行对比实验,验证其算法的可行性和有效性。实验结果表明,与改进之前的算法相比,文中提出的基于复杂网络的计算机病毒传播路由算法,极大地降低了病毒的传播速度,验证了算法的可行性和有效性。

保障疗养院网络安全的交换机集中管理平台设计研究

采用分布式三层交换机架构构建一个基于网络安全策略的交换机集中管理平台,通过统一接口、自动化分析、可视化管理,实现区域内网络设备的统一监控、维护、管理,有效提高网络安全性、可靠性及管理效率。该平台可自动识别并预测网络威胁和潜在的安全风险,进而自主采取相应的防护措施,有效提高网络安全防御的整体水平。

Enhancing Online Privacy Protection for Wireless Networks

The increasing popularity of wireless networks makes the protection of online privacy be a common concern of users and internet service providers.Because of the difference of wireless networks and wired networks,it is proved to be easier for hackers to steal information related to users' privacy in wireless networks than that of wired networks.The issue that whether online privacy protection is necessary or reasonable has given rise to much controversy.In this paper,the discussion of this issue includes what online protection of privacy is,current problems of online privacy protection in wireless networks,exploration of solutions and problems that may caused by the protection.No matter what extent the protection will be,it is proved to be essential for experts,users and IT staff to enhance the protection in wireless networks via new technologies,policy and law.It is also a way for improving the security of information management and business communication in wireless networks.

威胁DCS工业控制系统网络安全的病毒研究

DCS控制系统广泛应用在电力、冶金、石油、化工等工业现场,是工业自动化的重要控制系统。随着工业互联网技术的应用,远程控制、远程诊断、无人车间等一系列智慧工厂解决方案的实施,工业产业朝着数字化、网络化、智能化方向发展,越来越多的工业控制网络与互联网连接,成为网络攻击的重点目标。从IT(Information Technology)/OT(Operational Technology)两个层面出发,整理威胁工业控制DCS系统网络安全的病毒分类、研究DCS控制系统的安全漏洞,设计一种模拟攻击该系统漏洞的病毒程序验证、研究关键基础设施的生产工艺,设计一种篡改该关键基础设施工艺指令的方法、简要讨论如何防御工控DCS系统IT、OT层网络攻击的方法,为工业生产者提供防护DCS网络安全的运行规程参考,以及网络安全设备研发者提供设计思路。

多样性病毒入侵环境下的网络空间安全态势智能估计方法

针对多样性病毒入侵环境,提出一种网络空间安全态势智能估计方法。基于卷积神经网络和双向长短时记忆网络提取网络空间信息的空间维度特征、时间维度特征,将提取的特征输入Softmax分类器,完成病毒入侵类型的识别;建立基于支持向量机的网络空间安全态势智能估计模型,改进鲸鱼优化算法训练支持向量机,智能估计所识别入侵环境中的网络空间信息安全态势值。实验结果表明,在多样性病毒入侵环境中,所提方法具备准确识别网络空间入侵行为的能力,并能准确估计多种入侵行为下的网络空间安全态势。

无线传感器网络变异病毒传播动力学分析

针对无线传感器网络病毒变异,异常节点检测技术不能实施对异常节点检测和定位的问题,提出一类SEIQRV-Type模型。通过对模型进行理论分析,得到网络病毒的传播阙值R 0,验证了平衡点的稳定性,研究节点感染率、E-I状态节点转移率、感染节点隔离率、节点免疫率、病毒查杀率、通信半径和节点上(下)线率等参数对无线传感器网络中病毒传播的影响。仿真结果验证了理论分析的正确性,通过动态调节参数可以有效控制病毒在无线传感器网络中的传播。

基于改进CNN的恶意软件分类方法

越来越多的恶意软件变种给网络安全带来了巨大的威胁,导致了现有基于CNN(Convolutional Neural Networks)的恶意软件分类方法的泛化能力弱和准确性不足.为了解决这些问题,本文提出了一种新的方法,即基于改进CNN的恶意软件RGB(Red Green Blue)可视化的分类方法,可以抵御变种和混淆性恶意软件.首先,提出了一种基于RGB图像的特征表示方法,该方法更加关注恶意软件的二进制和汇编信息、API信息间的语义关系,生成具有更丰富纹理信息的图像,可以挖掘恶意代码原始与变种之间更深层的依赖关系.其次,针对恶意软件的加密和混淆问题,使用坐标注意力模块(Coordinate Attention Module,CAM)获取更大范围的空间信息来强化特征.最后,结合空洞空间金字塔池化(Atrous Spatial Pyramid Pooling,ASPP)来改进CNN模型,解决因图像尺寸归一化导致的信息丢失和冗余.实验结果表明,上述方法在最近的先进方法中脱颖而出,对Kaggle数据集和DataCon数据集的准确率分别达到99.48%和97.78%.与其它方法相比,该方法对Kaggle数据集的准确率提高了0.22%,对DataCon数据集的准确率提高了0.80%.本文方法可以有效地分类恶意软件和恶意软件家族变种,具有良好的泛化能力和抗混淆能力.

基于薄弱点分析的物联网攻击主动防御仿真

物联网允许机器和设备之间互相连接,其应用程序不仅可以收集数据,还能够在任何时间、任何地点实现数据传输,因此物联网更易受到黑客攻击,数据的高噪声性也导致安全防御难度较高。为了提高物联网的主动防御能力,提出基于改进降噪算法的物联网攻击主动防御的方法。利用改进降噪算法优化物联网节点,从抗全局截获分析攻击能力、抗拒绝服务攻击能力和抗内部威胁能力三个方面分析物联网的薄弱点。采用基础防御信息和防御模式匹配算法,构建与物联网薄弱点相匹配的无线传感器网络病毒传播模型,实现物联网攻击的主动防御。实验结果显示,提出方法能够在1.6s内完成攻击防御,且对物联网数据的降噪效果显著,以上测试验证了说明研究方法的主动防御效率更高,应用性更优。

基于改进SIR模型的网络安全态势分析

为研究计算机病毒传播对网络系统安全态势的影响,分析了SIR流行病传播模型与计算机网络安全之间的联系,提出了一种用于网络安全态势预测的SIPM模型. SIPM模型中加入了节点对不同病毒传播的记忆功能,支持多种病毒同时在网络中独立进行传播,并在SIR模型基础上改进了动力学传播方程,允许单独设置病毒对不同设备节点的感染能力和设备节点对不同病毒的抵御能力,进而更加贴近真实网络环境.实验分析使用了典型校园网络架构进行模拟仿真,结果表明该模型可以从多个方面进行网络安全态势的分析与预测.

结合注意力与双线性网络的Android恶意软件检测

为解决基于字节码图像的Android恶意软件检测方法中存在多分类准确率不高、易被噪音数据干扰等问题,提出一种结合注意力与双线性网络的恶意软件检测方法。从软件样本中提取字节码文件并将其映射为彩色图像,将注意力机制加入双线性网络的一条分支中减小噪音数据的影响,使用结合注意力的双线性网络模型完成对字节码图像的分类。实验结果表明,该方法在恶意软件二分类与多分类中均具有良好的性能,总体检测性能优于其它同类方法与模型。