Malware Detection

Malware is a software developed to compromise the privacy and confidentiality of a user. In this digital era, where everything is computerized and automated, if the data is compromised, then, it could easily incapacitate countries and organizations leaving them vulnerable and defenseless. Malware can be imposed through innumerable ways, and with the ever evolving technologies, it makes malware detection a complex process. Moreover, malware is highly adaptive and has several variants with its own distinctive mechanisms which are very difficult to track or trace. Hence, it is imperative to come up with efficient and effective methods to detect the malware. This paper delineates few efficient models for malware detection using diverse data mining techniques.

This paper presents Similo, an automated scalable framework for control logic forensics in industrial control systems. Similo is designed to investigate denial of engineering operations (DEO) attacks, recently demonstrated to hide malicious control logic in a programmable logic controller or PLC (at field sites) from an engineering software (at control center). The network traffic (if captured) contains substantial evidence to investigate DEO attacks including manipulation of control logic. Laddis a state-of-the-art forensic approach for DEO attacks, is a binary-logic decompiler for the Allen-Bradley’s RSLogix engineering software and MicroLogix 1400 PLC. It is developed with extensive manual reverse engineering effort of the underlying proprietary network protocol and the binary control logic. Unfortunately, Laddis is not scalable and requires similar efforts to extend on other engineering software/PLCs. The proposed solution, Similo, is based on the observation that engineering software of different vendors are equipped with decompilers. Similo is a virtual PLC framework that integrates the decompilers with their respective (previously-captured) ICS network traffic of control logic. It recovers the binary logic into a high-level source code (of the programming languages defined by IEC 61131-3 standard) automatically. Similo can work with both proprietary/open protocols without requiring protocol specifications and the binary formats of control logic. Thus, it is scalable to different ICS vendors. We evaluate Similo on three PLCs of two ICS vendors i.e., MicroLogix 1400, and 1100, and Modicon M221. These PLCs support proprietary protocols and the control logics written in two programming languages: Ladder Logic and Instruction List. The evaluation results show that Similo can accurately reconstruct a control logic from an ICS network traffic and can be used to investigate the DEO attacks effectively.

Nowadays, with portable computation equipment becoming extra commonly depended besides incorporated through extra sensitive structures such as infrastructure besides armed or regulation implementation. However, is being clearer when considering that malware and other types with cyberattacks attack such portable structures. Malware has always been an issue regarding any technological advances in the world of software. Smartphones and other mobile devices are thus to be expected to face the same problems. In this paper, mobile malware detection techniques presented in details. Furthermore, we have stated the recent techniques of mobile malware detection. Adding to that, these closest works to the paper objective are compared with respect to the based-portal, depended-approach, and significant system's description points.

Internet of Things (IoT) is being considered as the growth engine for industrial revolution 4.0. The combination of IoT, cloud computing and healthcare can contribute in ensuring well-being of people. One important challenge of IoT network is maintaining privacy and to overcome security threats. This paper provides a systematic review of the security aspects of IoT. Firstly, the application of IoT in industrial and medical service scenarios are described, and the security threats are discussed for the different layers of IoT healthcare architecture. Secondly, different types of existing malware including spyware, viruses, worms, keyloggers, and trojan horses are described in the context of IoT. Thirdly, some of the recent malware attacks such as Mirai, echobot and reaper are discussed. Next, a comparative discussion is presented on the effectiveness of different machine learning algorithms in mitigating the security threats. It is found that the k-nearest neighbor (kNN) machine learning algorithm exhibits excellent accuracy in detecting malware. This paper also reviews different tools for ransomware detection, classification and analysis. Finally, a discussion is presented on the existing security issues, open challenges and possible future scopes in ensuring IoT security.

Android, being the most widespread mobile operating systems is increasingly becoming a target for malware. Malicious apps designed to turn mobile devices into bots that may form part of a larger botnet have become quite common, thus posing a serious threat. This calls for more effective methods to detect botnets on the Android platform. Hence, in this paper, we present a deep learning approach for Android botnet detection based on Convolutional Neural Networks (CNN). Our proposed botnet detection system is implemented as a CNN-based model that is trained on 342 static app features to distinguish between botnet apps and normal apps. The trained botnet detection model was evaluated on a set of 6,802 real applications containing 1,929 botnets from the publicly available ISCX botnet dataset. The results show that our CNN-based approach had the highest overall prediction accuracy compared to other popular machine learning classifiers. Furthermore, the performance results observed from our model were better than those reported in previous studies on machine learning based Android botnet detection.

Malware has always been a threat to the computer world, but with fast growth in the use of the internet, malware severely affects the computer world. Malware predictors and detectors are critical tools in defense against malware. The existing malware detectors and predictors have been created, the effectiveness of these detectors and predictors depend upon the techniques being used. This study is specifically, addressed the following objectives: (1) propose a model to predict malware behavior using machine activity data; (2) apply the random forest algorithm in predicting malicious behavior. In this study, applied research is being used; this is the stage in the life cycle of the study in which we recognize how well we have used our knowledge to solve a pressing problem and to produce predictable results. In the proposed work of this research, a useful machine learning model using a random forest is developed and implemented with a malware data base. The proposed multi-layer machine learning model is used for training and predictive malware analysis on multiple parameters, including error factor, accuracy rate, and overall performance. The result of the model from the evaluation measures provides a high accuracy rate and a lesser mean absolute error value. There are very few parameters in the random forest as well, and these can be optimized using generalization theory without having to separate validation set during training.