Biblio

Development of malware protection tools requires a more advanced test environment comparing to safe software. This kind of development includes a safe execution of many malware samples in order to evaluate the protective power of the tool. The host machine needs to be protected from the harmful effects of malware samples and provide a realistic simulation of the execution environment. In this paper, a framework for automated malware analysis on Linux is presented. Different types of malware analysis methods are discussed, as well as the properties of a good framework for dynamic malware analysis.

Most machine learning-based malware detection systems use various supervised learning methods to classify different instances of software as benign or malicious. This approach provides no information regarding the behavioral characteristics of malware. It also requires a large amount of training data and is prone to labeling difficulties and can reduce accuracy due to redundant training data. Therefore, we propose a malware detection method based on deep learning, which uses malware images and a set of autoencoders to detect malware. The method is to design an autoencoder to learn the functional characteristics of malware, and then to observe the reconstruction error of autoencoder to realize the classification and detection of malware and benign software. The proposed approach achieves 93% accuracy and comparatively better F1-score values while detecting malware and needs little training data when compared with traditional malware detection systems.

Malware is a kind of software that, if installed on a malware victim's device, might carry malicious actions. The malicious actions might be data theft, system failure, or denial of service. Malware analysis is a process to identify whether a piece of software is a malware or not. However, with the advancement of malware technologies, there are several evasion techniques that could be implemented by malware developers to prevent analysis, such as polymorphic and oligomorphic. Therefore, this research proposes an automatic malware detection system. In the system, the malware characteristics data were obtained through both static and dynamic analysis processes. Data from the analysis process were classified using Naive Bayes algorithm to identify whether the software is a malware or not. The process of identifying malware and benign files using the Naive Bayes machine learning method has an accuracy value of 93 percent for the detection process using static characteristics and 85 percent for detection through dynamic characteristics.

In this era, where the volume and diversity of malware is rising exponentially, new techniques need to be employed for faster and accurate identification of the malwares. Manual heuristic inspection of malware analysis are neither effective in detecting new malware, nor efficient as they fail to keep up with the high spreading rate of malware. Machine learning approaches have therefore gained momentum. They have been used to automate static and dynamic analysis investigation where malware having similar behavior are clustered together, and based on the proximity unknown malwares get classified to their respective families. Although many such research efforts have been conducted where data-mining and machine-learning techniques have been applied, in this paper we show how the accuracy can further be improved using deep learning networks. As deep learning offers superior classification by constructing neural networks with a higher number of potentially diverse layers it leads to improvement in automatic detection and classification of the malware variants.In this research, we present a framework which extracts various feature-sets such as system calls, operational codes, sections, and byte codes from the malware files. In the experimental and result section, we compare the accuracy obtained from each of these features and demonstrate that feature vector for system calls yields the highest accuracy. The paper concludes by showing how deep learning approach performs better than the traditional shallow machine learning approaches.

Due to the steady growth of various sophisticated types of malware, different malware analysis systems are becoming more and more demanded. While there are various automatic approaches available to identify and detect malware, the malware analysis is still time-consuming process. The visualization-driven techniques may significantly increase the efficiency of the malware analysis process by involving human visual system which is a powerful pattern seeker. In this paper the authors reviewed different visualization methods, examined their features and tasks solved with their help. The paper presents the most commonly used approaches and discusses open challenges in malware visual analytics.

Signature-based malware detection is not always effective at detecting polymorphic variants of known malware. Malware signatures are devised to counter known threats, which also limits efficacy against new forms of malware. However, existing signatures do present the ability to classify malware based upon known malicious behavior which occurs on a victim computer. In this paper we present a method of classifying malware by family type through behavioral analysis, where the frequency of system function calls is used to fingerprint the actions of specific malware families. This in turn allows us to demonstrate a machine learning classifier which is capable of distinguishing malware by family affiliation with high accuracy.

In today's world, the word malware is synonymous with mysterious programs that spread havoc and sow destruction upon the computing system it infects. These malware are analyzed and understood by malware analysts who reverse engineer the program in an effort to understand it and provide appropriate identifications or signatures that enable anti-malware programs to effectively combat and resolve threats. Malware authors develop ways to circumvent or prevent this analysis of their code thus rendering preventive measures ineffective. This paper discusses existing analysis subverting techniques and how they are overcome by modern analysis techniques. Further, this paper proposes a new method to resist traditional malware analysis techniques by creating a split-personality malware variant that uses a technique known as shadow attack. The proposal is validated by creating a malware dropper and testing this dropper in controlled laboratory conditions as a part of the concept of proactive defense.

In recent years, smart grid has gradually become the common development trend of the world's power industry, and its security issues are increasingly valued by researchers. Smart grids have applied technologies such as physical control, data encryption, and authentication to improve their security, but there is still a lack of timely and effective detection methods to prevent the grid from being threatened by malicious intrusions. Aiming at this problem, a model based on machine learning to detect smart grid DoS attacks has been proposed. The model first collects network data, secondly selects features and uses PCA for data dimensionality reduction, and finally uses SVM algorithm for abnormality detection. By testing the SVM, Decision Tree and Naive Bayesian Network classification algorithms on the KDD99 dataset, it is found that the SVM model works best.

Cyber security is becoming a vital part of many information technologies and computing systems. Increasingly, High-Performance Computing systems are used in scientific research, academia and industry. High-Performance Computing applications are specifically designed to take advantage of the parallel nature of High-Performance Computing systems. Current research into High-Performance Computing systems focuses on the improvements in software development, parallel algorithms and computer systems architecture. However, there are no significant efforts in developing common High-Performance Computing security standards. Security of the High-Performance Computing resources is often an add-on to existing varied institutional policies that do not take into account additional requirements for High-Performance Computing security. Also, the users' terminals or portals used to access the High-Performance Computing resources are frequently insecure or they are being used in unprotected networks. In this paper we present Bearicade - a Data-driven Security Orchestration Automation and Response system. Bearicade collects data from the HPC systems and its users, enabling the use of Machine Learning based solutions to address current security issues in the High-Performance Computing systems. The system security is achieved through monitoring, analysis and interpretation of data such as users' activity, server requests, devices used and geographic locations. Any anomaly in users' behaviour is detected using machine learning algorithms, and would be visible to system administrators to help mediate the threats. The system was tested on a university campus grid system by administrators and users. Two case studies, Anomaly detection of user behaviour and Classification of Malicious Linux Terminal Command, have demonstrated machine learning approaches in identifying potential security threats. Bearicade's data was used in the experiments. The results demonstrated that detailed information is provided to the HPC administrators to detect possible security attacks and to act promptly.

In traditional virtual asset trading market, several risks, e.g. scams, cheating users, and market reach, have been pushed to users (sellers/buyers). Users need to decide who to trust; otherwise, no business. This fact impedes the growth of virtual asset trading market. In the past few years, several virtual asset marketplaces have embraced blockchain and smart contract technology to alleviate such risks, while trying to address privacy and scalability issues. To attain both speed and non-repudiation property for all transactions, existing blockchain-based exchange systems still cannot fully accomplish. In real-life trading, users use traditional contract to provide non-repudiation to achieve accountability in all committed transactions, so-called thorough non-repudiation. This is essential when dispute happens. To achieve similar thorough non-repudiation as well as privacy and scalability, we propose PEX, Privacy-preserved, multi-tier EXchange framework for cross platform virtual assets trading. PEX creates a smart contract for each virtual asset trading request. The key to address the challenges is to devise two-level distributed ledgers with two different types of quorums where one is for public knowledge in a global ledger and the other is for confidential information in a private ledger. A private quorum is formed to process individual smart contract and record the transactions in a private distributed ledger in order to maintain privacy. Smart contract execution checkpoints will be continuously written in a global ledger to strengthen thorough non-repudiation. PEX smart contract can be executed in parallel to promote scalability. PEX is also equipped with our reputation-based network to track contribution and discourage malicious behavior nodes or users, building healthy virtual asset ecosystem.

Ensuring security to IoT devices is important in order to provide privacy and quality of services. Proposing a security solution is considered an important step towards achieving protection, however, proving the soundness of the solution is also crucial. In this paper, we propose a methodology for the performance evaluation of lightweight IoT-based authentication protocols based on execution time. Then, a formal verification test is conducted on a lightweight protocol proposed in the literature. The formal verification test conducted with Scyther tool proofs that the model provides mutual authentication, authorization, integrity, confidentiality, non-repudiation, and accountability. The protocol also was proven to provide protection from various attacks.

Vehicular ad hoc networks (VANETs) ensure improvement in road safety and traffic management by allowing the vehicles and infrastructure that are connected to them to exchange safety messages. Due to the open wireless communication channels, security and privacy issues are a major concern in VANETs. A typical attack consists of a malicious third party intercepting, modifying and retransmitting messages. Heterogeneous vehicular communication in VANETs occurs when vehicles (only) or vehicles and other infrastructure communicate using different cryptographic techniques. To address the security and privacy issues in heterogeneous vehicular communication, some heterogeneous signcryption schemes have been proposed. These schemes simultaneously satisfy the confidentiality, authentication, integrity and non-repudiation security requirements. They however fail to properly address the efficiency with respect to the computational cost involved in unsigncrypting ciphertexts, which is often affected by the speeds at which vehicles travel in VANETs. In this paper, we propose an efficient conditional privacy-preserving hybrid signcryption (CPP-HSC) scheme that uses bilinear pairing to satisfy the security requirements of heterogeneous vehicular communication in a single logical step. Our scheme ensures the transmission of a message from a vehicle with a background of an identity-based cryptosystem (IBC) to a receiver with a background of a public-key infrastructure (PKI). Furthermore, it supports a batch unsigncryption method, which allows the receiver to speed up the process by processing multiple messages simultaneously. The security of our CPP-HSC scheme ensures the indistinguishability against adaptive chosen ciphertext attack (IND-CCA2) under the intractability assumption of q-bilinear Diffie-Hellman inversion (q-BDHI) problem and the existential unforgeability against adaptive chosen message attack (EUF-CMA) under the intractability assumption of q-strong Diffie-Hellman (q-SDH) problem in the random oracle model (ROM). The performance analysis indicates that our scheme has an improvement over the existing related schemes with respect to the computational cost without an increase in the communication cost.

The Controller Area Network (CAN), a broadcasting bus for intra-vehicle communication, does not provide any security mechanisms, although it is implemented in almost every vehicle. Attackers can exploit this issue, transmit malicious messages unnoticeably and cause severe harm. As the utilization of Message Authentication Codes (MACs) is only possible to a limited extent in resource-constrained systems, the focus is put on the development of Intrusion Detection Systems (IDSs). Due to their simple idea of operation, current developments are increasingly utilizing physical signal properties like voltages to realize these systems. Although the feasibility for CAN-based networks could be demonstrated, the least approaches consider the constrained resource-availability of vehicular hardware. To close this gap, we present Voltage-Based Lightweight Intrusion Detection (VALID), which provides physics-based intrusion detection with low resource requirements. By utilizing solely the individual voltage levels on the network during communication, the system detects unauthorized message transmissions without any sophisticated sampling approaches and feature calculations. Having performed evaluations on data from two real vehicles, we show that VALID is not only able to detect intrusions with an accuracy of 99.54 %, but additionally is capable of identifying the attack source reliably. These properties make VALID one of the most lightweight intrusion detection approaches that is ready-to-use, as it can be easily implemented on hardware already installed in vehicles and does not require any further components. Additionally, this allows existing platforms to be retrofitted and vehicular security systems to be improved and extended.

This paper presents the design and the verification of an efficient image protection method based on the QR code, which is a type of two-dimensional barcode widely used in various fields. For this purpose, we design a new image protection system consisting of a secure image generator and a secure image recognizer. One adds a new pre-processing block to the typical QR code generator and the other combines the existing QR code reader with a new post-processing block. The new architecture provides image de-identification. It is also flexible, allowing the use of text-based compression and encryption. We have implemented prototype applications for verifying the functions of the secure image generator and those of the secure image recognizer. As a result, it is shown that the proposed architecture can be used as a good solution for image privacy protection, especially in offline environments.

When users in various web and mobile applications enjoy the convenience of recommendation systems, they are vulnerable to attribute inference attacks. The accumulating online behaviors of users (e.g., clicks, searches, ratings) naturally brings out user preferences, and poses an inevitable threat of privacy that adversaries can infer one's private profiles (e.g., gender, sexual orientation, political view) with AI-based algorithms. Existing defense methods assume the existence of a trusted third party, rely on computationally intractable algorithms, or have impact on recommendation utility. These imperfections make them impractical for privacy preservation in real-life scenarios. In this work, we introduce BiasBooster, a practical proactive defense method based on behavior segmentation, to protect user privacy against attribute inference attacks from user behaviors, while retaining recommendation utility with a heuristic recommendation aggregation module. BiasBooster is a user-centric approach from client side, which proactively divides a user's behaviors into weakly related segments and perform them with several dummy identities, then aggregates real-time recommendations for user from different dummy identities. We estimate its effectiveness of preservation on both privacy and recommendation utility through extensive evaluations on two real-world datasets. A Chrome extension is conducted to demonstrate the feasibility of applying BiasBooster in real world. Experimental results show that compared to existing defenses, BiasBooster substantially reduces the averaged accuracy of attribute inference attacks, with minor utility loss of recommendations.

The recommender system is an important application in big data analytics because accurate recommendation items or high-valued suggestions can bring high profit to both commercial companies and customers. To make precise recommendations, a recommender system often needs large and fine-grained data for training. In the current big data era, data often exist in the form of isolated islands, and it is difficult to integrate the data scattered due to privacy security concerns. Moreover, privacy laws and regulations make it harder to share data. Therefore, designing a privacy-preserving recommender system is of paramount importance. Existing privacy-preserving recommender system models mainly adapt cryptography approaches to achieve privacy preservation. However, cryptography approaches have heavy overhead when performing encryption and decryption operations and they lack a good level of flexibility. In this paper, we propose a Locality Sensitive Hashing (LSH) based approach for federated recommender system. Our proposed efficient and scalable federated recommender system can make full use of multiple source data from different data owners while guaranteeing preservation of privacy of contributing parties. Extensive experiments on real-world benchmark datasets show that our approach can achieve both high time efficiency and accuracy under small privacy budgets.

The solution of using existing WiFi devices for measurement and maintenance, and establishing a WiFi fingerprint database for precise localization has become a popular method for indoor localization. The traditional WiFi fingerprint privacy protection scheme increases the calculation amount of the client, but cannot completely protect the security of the client and the fingerprint database. In this paper, we make use of WiFi devices to present a Practical Privacy Protection Scheme In WiFi Fingerprint-based Localization PPWFL. In PPWFL, the localization server establishes a pre-partition in the fingerprint database through the E-M clustering algorithm, we divide the entire fingerprint database into several partitions. The server uses WiFi fingerprint entries with partitions as training data and trains a machine learning model. This model can accurately predict the client's partition based on fingerprint entries. The client uses the trained machine learning model to obtain its partition location accurately, picks up WiFi fingerprint entries in its partition, and calculates its geographic location with the localization server through secure multi-party computing. Compared with the traditional solution, our solution only uses the WiFi fingerprint entries in the client's partition rather than the entire fingerprint database. PPWFL can reduce not only unnecessary calculations but also avoid accidental errors (Unexpected errors in fingerprint similarity between non-adjacent locations due to multipath effects of electromagnetic waves during the propagation of complex indoor environments) in fingerprint distance calculation. In particular, due to the use of Secure Multi-Party Computation, most of the calculations are performed in the local offline phase, the client only exchanges data with the localization server during the distance calculation phase. No additional equipment is needed; our solution uses only existing WiFi devices in the building to achieve fast localization based on privacy protection. We prove that PPWFL is secure under the honest but curious attacker. Experiments show that PPWFL achieves efficiency and accuracy than the traditional WiFi fingerprint localization scheme.

The position information leakage of under-water sensor networks has been widely concerned. However, the underwater environment has unique characteristics compared with the terrestrial environment, for example, the asynchronous clock, stratification compensation. Therefore, the privacy preserving localization algorithm for terrestrial is not suitable. At present, the proposed privacy preserving localization algorithm is at the cost of reducing the localization accuracy and increasing the complexity of the algorithm. In this paper, a privacy preserving localization algorithm for underwater sensor networks with ray compensation is proposed. Besides, the localization algorithm we designed hides the position information of anchor nodes, and eliminates the influence of asynchronous clock. More importantly, the positioning accuracy is improved. Finally, the simulation results show that the location algorithm with privacy preserving and without privacy preserving have the same location accuracy. In addition, the algorithm proposed in this paper greatly improves the positioning accuracy compared with the existing work.

Wireless sensor networks (WSNs) have been widely used in various applications for continuous event monitoring and detection. Dual to lack of a protected physical boundary, WSNs are vulnerable to trace-back attacks. The existing secure routing protocols are designed to protect source location privacy by increasing uncertainty of routing direction against statistic analysis on traffic flow. Nevertheless, the security has not been quantitatively measured and shown the direction of secure routing design. In this paper, we propose a theoretical security measurement scheme to define and analyze the quantitative amount of the information leakage from each eavesdropped message. Through the theoretical analysis, we identify vulnerabilities of existing routing algorithms and quantitatively compute the direction information leakage based on various routing strategy. The theoretical analysis results also indicate the direction for maximization of source location privacy.

Source location privacy (SLP) protection ensures security of assets in monitoring wireless sensor networks (WSNs). Also, low end-to-end delay (EED) and high packet delivery ratio (PDR) guarantee high packet delivery reliability. Therefore, it is important to ensure high levels of SLP protection, low EED, and high PDR in mission-critical monitoring applications. Thus, this study proposes a new angle-based agent node routing protocol (APr) which is capable of achieving high levels of SLP protection, low EED, and high PDR. The proposed APr protocol employs multiple routing strategies to enable a dynamic agent node selection process and creation of obfuscating routing paths. Analysis results reveal that the APr protocol achieves high packet delivery reliability to outperform existing intermediate node-based protocols such as the AdrR and tree-based protocols such as the TbR. Furthermore, the APr protocol achieves significantly high levels of SLP protection to outperform the AdrR protocol.

Fake source packet routing protocols can ensure Source Location Privacy (SLP) protection. However, the protocols have demonstrated some performance limitations including high energy consumption, low packet delivery ratio (PDR), and long end-to-end delay (EED). In this study, a 2-level phantom routing protocol is proposed to address some limitations of an existing fake source packet routing protocol. The proposed protocol supplants the fake source packets with a random second level phantom node to alleviate the limitations. Analysis results confirm that the proposed protocol is capable of achieving strong SLP protection with minimized communication overhead. By removing the fake packet traffic in the network, the protocol incurs minimized energy consumption, maximized PDR, and minimized EED.

Wireless Sensor Networks promises the wireless network tools that does not require any stable infrastructure. Routing is the most important effect of network operation for the extended data rates within the network. Route discovery and route search sent the required packets from the target node source. However, good data transmission is also a threatening task in networks that provide efficient and energy-efficient routing. Various research activities focus on the topology control, source location privacy optimization and effective routing improvement in WSN. Wherein the existing security solutions both routing protocols and source location solutions disrupt the self-organizing nature of wireless sensor networks. Therefore, large overhead signatures are displayed and digitally verified by the requesting node. The cloud-based and routing based schemes have provided efficient security but there are a lot of obstacles for source data and travel path information security in the WSN network. This study is dedicated to calculate the desired number of deployments for sensor nodes in a given area once the selected metric achieves a certain level of coverage, while maintaining wireless connectivity in the network. A trusted node authentication scheme in wireless sensor network reduces the communication between nodes in a secure data transmission network, where shared cryptography is established all adjacent to the sensor node. Route discovery and retransmission increases the network overhead and increases the average end-to-end delay of the network in the conventional systems. This results in higher time complexity, communication overhead and less security of constrained sensor network resources.

One of the most important information in Wireless Sensor Networks (WSNs) is the location of each sensor node. This kind of information is very attractive to attackers for real position exposure of nodes making the whole network vulnerable to different kinds of attacks. According to WSNs privacy, there are two types of threats affect the network: Contextual and Content privacy. In this work, we study contextual privacy, where an eavesdropper tries to find the location of the source or sink node. We propose a Multi-Sinks Cluster-Based Location Privacy Protection (MSCLP) scheme in WSNs that divides the WSN into clusters, each cluster managed by one cluster head (CH). Each CH sends random fake packets in a loop then sends the real packet to the neighbor's CHs using a dynamic routing method to confuse the attacker from tracing back the real packet to reveal the actual location of the source node, we are taking in our consideration two important metrics: the energy consumption, and the delay.

The usage of K-anonymity to preserve location privacy for wireless sensor network (WSN) monitoring systems, where sensor nodes operate together to notify a server with anonymous shared positions. That k-anonymous position is a coated region with at least k people. However, we identify an attack model to show that overlapping aggregate locations remain privacy-risk because the enemy can infer certain overlapping areas with persons under k who violate the privacy requirement for anonymity. Within this paper we suggest a mutual WSN privacy protocol (REAL). Actual needs sensor nodes to arrange their sensing areas separately into a variety of non-overlapping, extremely precise anonymous aggregate positions. We also developed a state transfer framework, a locking mechanism and a time delay mechanism to address the three main REAL challenges, namely self-organisation, shared assets and high precision. We equate REAL's output with current protocols through virtual experiments. The findings demonstrate that REAL preserves the privacy of sites, offers more precise question answers and decreases connectivity and device expense.

Nowadays, smartphones are everywhere. They play an indispensable role in our lives and makes people convenient to communicate, pay, socialize, etc. However, they also bring a lot of security and privacy risks. Keystroke operations of numeric keypad are often required when users input password to perform mobile payment or input other privacy-sensitive information. Different keystrokes may cause different finger movements that will bring different interference to WiFi signal, which may be reflected by channel state information (CSI). In this paper, we propose WiPass, a password-keystroke recognition system for numerical keypad input on smartphones, which especially occurs frequently in mobile payment APPs. Based on only a public WiFi hotspot deployed in the victim payment scenario, WiPass would extracts and analyzes the CSI data generated by the password-keystroke operation of the smartphone user, and infers the user's payment password by comparing the CSI waveforms of different keystrokes. We implemented the WiPass system by using COTS WiFi AP devices and smartphones. The average keystroke segmentation accuracy was 80.45%, and the average keystroke recognition accuracy was 74.24%.