The continuous development of cyberattacks is threatening digital transformation endeavors worldwide and leadsto wide losses for various organizations. These dangers have proven that signature-based approaches are ins...The continuous development of cyberattacks is threatening digital transformation endeavors worldwide and leadsto wide losses for various organizations. These dangers have proven that signature-based approaches are insufficientto prevent emerging and polymorphic attacks. Therefore, this paper is proposing a Robust Malicious ExecutableDetection (RMED) using Host-based Machine Learning Classifier to discover malicious Portable Executable (PE)files in hosts using Windows operating systems through collecting PE headers and applying machine learningmechanisms to detect unknown infected files. The authors have collected a novel reliable dataset containing 116,031benign files and 179,071 malware samples from diverse sources to ensure the efficiency of RMED approach.The most effective PE headers that can highly differentiate between benign and malware files were selected totrain the model on 15 PE features to speed up the classification process and achieve real-time detection formalicious executables. The evaluation results showed that RMED succeeded in shrinking the classification timeto 91 milliseconds for each file while reaching an accuracy of 98.42% with a false positive rate equal to 1.58. Inconclusion, this paper contributes to the field of cybersecurity by presenting a comprehensive framework thatleverages Artificial Intelligence (AI) methods to proactively detect and prevent cyber-attacks.展开更多
Android devices are popularly available in the commercial market at different price levels for various levels of customers.The Android stack is more vulnerable compared to other platforms because of its open-source na...Android devices are popularly available in the commercial market at different price levels for various levels of customers.The Android stack is more vulnerable compared to other platforms because of its open-source nature.There are many android malware detection techniques available to exploit the source code andfind associated components during execution time.To obtain a better result we create a hybrid technique merging static and dynamic processes.In this paper,in thefirst part,we have proposed a technique to check for correlation between features and classify using a supervised learning approach to avoid Mul-ticollinearity problem is one of the drawbacks in the existing system.In the proposed work,a novel PCA(Principal Component Analysis)based feature reduction technique is implemented with conditional dependency features by gathering the functionalities of the application which adds novelty for the given approach.The Android Sensitive Permission is one major key point to be considered while detecting malware.We select vulnerable columns based on features like sensitive permissions,application program interface calls,services requested through the kernel,and the relationship between the variables henceforth build the model using machine learning classifiers and identify whether the given application is malicious or benign.Thefinal goal of this paper is to check benchmarking datasets collected from various repositories like virus share,Github,and the Canadian Institute of cyber security,compare with models ensuring zero-day exploits can be monitored and detected with better accuracy rate.展开更多
This article presents an asset-based security system where security practitioners build their systems based on information they own and not solicited by observing attackers’behavior.Current security solutions rely on...This article presents an asset-based security system where security practitioners build their systems based on information they own and not solicited by observing attackers’behavior.Current security solutions rely on information coming from attackers.Examples are current monitoring and detection security solutions such as intrusion prevention/detection systems and firewalls.This article envisions creating an imbalance between attackers and defenders in favor of defenders.As such,we are proposing to flip the security game such that it will be led by defenders and not attackers.We are proposing a security system that does not observe the behavior of the attack.On the contrary,we draw,plan,and follow up our own protection strategy regardless of the attack behavior.The objective of our security system is to protect assets rather than protect against attacks.Virtual machine introspection is used to intercept,inspect,and analyze system calls.The system callbased approach is utilized to detect zero-day ransomware attacks.The core idea is to take advantage of Xen and DRAKVUF for system call interception,and leverage system calls to detect illegal operations towards identified critical assets.We utilize our vision by proposing an asset-based approach to mitigate zero-day ransomware attacks.The obtained results are promising and indicate that our prototype will achieve its goals.展开更多
文摘The continuous development of cyberattacks is threatening digital transformation endeavors worldwide and leadsto wide losses for various organizations. These dangers have proven that signature-based approaches are insufficientto prevent emerging and polymorphic attacks. Therefore, this paper is proposing a Robust Malicious ExecutableDetection (RMED) using Host-based Machine Learning Classifier to discover malicious Portable Executable (PE)files in hosts using Windows operating systems through collecting PE headers and applying machine learningmechanisms to detect unknown infected files. The authors have collected a novel reliable dataset containing 116,031benign files and 179,071 malware samples from diverse sources to ensure the efficiency of RMED approach.The most effective PE headers that can highly differentiate between benign and malware files were selected totrain the model on 15 PE features to speed up the classification process and achieve real-time detection formalicious executables. The evaluation results showed that RMED succeeded in shrinking the classification timeto 91 milliseconds for each file while reaching an accuracy of 98.42% with a false positive rate equal to 1.58. Inconclusion, this paper contributes to the field of cybersecurity by presenting a comprehensive framework thatleverages Artificial Intelligence (AI) methods to proactively detect and prevent cyber-attacks.
文摘Android devices are popularly available in the commercial market at different price levels for various levels of customers.The Android stack is more vulnerable compared to other platforms because of its open-source nature.There are many android malware detection techniques available to exploit the source code andfind associated components during execution time.To obtain a better result we create a hybrid technique merging static and dynamic processes.In this paper,in thefirst part,we have proposed a technique to check for correlation between features and classify using a supervised learning approach to avoid Mul-ticollinearity problem is one of the drawbacks in the existing system.In the proposed work,a novel PCA(Principal Component Analysis)based feature reduction technique is implemented with conditional dependency features by gathering the functionalities of the application which adds novelty for the given approach.The Android Sensitive Permission is one major key point to be considered while detecting malware.We select vulnerable columns based on features like sensitive permissions,application program interface calls,services requested through the kernel,and the relationship between the variables henceforth build the model using machine learning classifiers and identify whether the given application is malicious or benign.Thefinal goal of this paper is to check benchmarking datasets collected from various repositories like virus share,Github,and the Canadian Institute of cyber security,compare with models ensuring zero-day exploits can be monitored and detected with better accuracy rate.
基金This project is funded by King Abdulaziz City for Science and Technology(KACST)under the National Science,Technology,and Innovation Plan(Project Number 11-INF1657-04).
文摘This article presents an asset-based security system where security practitioners build their systems based on information they own and not solicited by observing attackers’behavior.Current security solutions rely on information coming from attackers.Examples are current monitoring and detection security solutions such as intrusion prevention/detection systems and firewalls.This article envisions creating an imbalance between attackers and defenders in favor of defenders.As such,we are proposing to flip the security game such that it will be led by defenders and not attackers.We are proposing a security system that does not observe the behavior of the attack.On the contrary,we draw,plan,and follow up our own protection strategy regardless of the attack behavior.The objective of our security system is to protect assets rather than protect against attacks.Virtual machine introspection is used to intercept,inspect,and analyze system calls.The system callbased approach is utilized to detect zero-day ransomware attacks.The core idea is to take advantage of Xen and DRAKVUF for system call interception,and leverage system calls to detect illegal operations towards identified critical assets.We utilize our vision by proposing an asset-based approach to mitigate zero-day ransomware attacks.The obtained results are promising and indicate that our prototype will achieve its goals.
