Search

To evade security detection, hackers always add a deceptive packer outside of the original malicious codes. The coexistence of original unpacked samples and packed samples of same family needs special attention in malware detection. The features of packed malware are changed by the packer, which would disturb the prediction results of malware classifier. The state-of-the-art studies of malware detection mainly focus on whether the malware is packed, or which type of packer is used. However, the ability of detecting the family of packed malware is still insufficient. Motivated by the above challenges, a novel packed malware family classification framework called MaliCage is proposed. The goal of the framework is to classify packed malware accurately. MaliCage consists of three core modules: packer detector, malware classifier, and a packer generative adversarial network (GAN). The packer detector is used as the pre-step of the framework to identify whether malware is packed. After distinguishing the packed samples, the dynamic features extracted from the sandbox are fitted to the malware classifier based on deep neural networks (DNN). The malware classifier can classify unpacked and packed malware simultaneously. Furthermore, the packer GAN generates fake packed samples to alleviate the underfitting of the malware classifiers. We built a single-packer dataset and a multi-packer dataset to evaluate the framework. In the single-packer experiment, 10 classes of malware samples packed by UPX were examined objectively. The accuracy of the malware classifier when using only real packed samples was 91.66%. After introducing fake packed samples generated by packer GAN, the accuracy of the packed malware classifier could reach 97.8%. In the multi-packer scenario, our method can also accurately classify benign programs, unpacked malware and malware packed by several common packers. The validation results show that MaliCage can not only effectively solve the impacts of packed malware on machine learning model, but also improve the detection accuracy. [ABSTRACT FROM AUTHOR]

Unmanned aerial vehicles (UAVs) have become widespread, raising concerns about security and privacy, making real-time detection of "low, slow, and small" UAVs crucial. Traditional detection systems, such as those based on radio frequency and radar, have limitations. This paper addresses challenges like low detection accuracy, high false alarm rates, and susceptibility to interference by proposing a novel detection method combining background difference and the lightweight Fast-YOLOv7 network(F-YOLOv7). The method first identifies potential UAV targets through background difference preprocessing, then optimizes model parameters with the Faster module to enhance speed and accuracy. Experiments on the DUT Anti-UAV dataset achieved a detection accuracy of 98.8%, outperforming the original YOLOv7 model’s 86.71%. This approach meets the real-time and precise detection requirements for low-altitude UAVs. [ABSTRACT FROM AUTHOR]

Distributed ground stations are capable of realizing ubiquitous control of unmanned aerial vehicles (UAVs), breaking the restriction of limited network coverage of traditional central ground stations and improving the execution efficiency of complex tasks. However, with the increase of entities in the system architecture and the rapid changes in the authority of entities, the existing access control mechanism can no longer meet the needs of ubiquitous UAV tasks, and entities in the network and UAV tasks face identity spoofing, false data injection and other attacks. In this paper, we construct a blockchain-based entity access control scheme for ubiquitous UAV swarm tasks (BAC-UAV) to ensure data security and identity security during UAV task execution. Specifically, a blockchain-based UAV access control scheme is designed, in which the private cloud (PC) maintains a consortium blockchain to register and protect entities. The controller in the distributed control network and the UAV in the flight ad-hoc network (FANET) can mutually authenticate and confirm the legal identity of the entity based on the data in the blockchain. In addition, for the task, the dynamic task data group key and the dynamic identity group key are designed based on the homomorphic algorithm to secure the UAV task data and UAV identity respectively when the UAV members change in the task formation. The experimental results show that the computational costs and communication costs of BAC-UAV are reduced by approximately 21.7 % and 2.8 % , respectively, compared to the comparison methods. [ABSTRACT FROM AUTHOR]

Malware threats and privacy protection are two of the biggest challenges in the cloud computing environment. Many studies have focused on the accuracy of malware detection, but they did not sufficiently take into account the privacy protection of cloud tenants. This paper proposes a novel malware detection model, based on semi-supervised transfer learning (SSTL) for the cloud, that consists of detection, prediction, and transfer components. To protect the privacy of tenants in the public cloud, a byte classifier based on a recurrent neural network (RNN) for its detection component is designed to detect malware. However, because it is limited by the scarcity of training samples, the accuracy of the byte classifier is only 94.72% after supervised learning. An asm classifier is proposed for the prediction component, and it achieves 99.69% accuracy. The transfer component invokes the prediction component to classify an unlabeled dataset, and it combines the predicted labels and byte features of the unlabeled dataset into a new training dataset. Through the advantages of semi-supervised learning, the new dataset is transferred to the byte classifier for training again. The test results on the Kaggle malware datasets show that semi-supervised transfer learning improved the accuracy of the detection component from 94.72% to 96.9%. The improved malware detection method can not only do a better job of resolving the privacy concerns of tenants in the public cloud than other similar methods, but it can also detect malware more accurately. [ABSTRACT FROM AUTHOR]

With the development of Internet technology, cyberspace security has become a research hotspot. Network traffic classification is closely related to cyberspace security. In this paper, the problem of classification based on raw traffic data is investigated. This involves the granularity analysis of packets, separating packet headers from payloads, complementing and aligning packet headers, and converting them into structured data, including three representation types: bit, byte, and segmented protocol fields. Based on this, we propose the Rew-LSTM classification model for experiments on publicly available datasets of encrypted traffic, and the results show that excellent results can be obtained when using only the data in packet headers for multiple classification, especially when the data is represented using bit, which outperforms state-of-the-art methods. In addition, we propose a global normalization method, and experimental results show that it outperforms feature-specific normalization methods for both Tor traffic and regular encrypted traffic. [ABSTRACT FROM AUTHOR]

Highlights • A mixed strategy game-based malicious nodes detection is proposed. • A data fusion method NetF is proposed to fuse data obtained from different networks. • An excellent performance is shown by NetF in experiments. • Our algorithm can plan the best defense strategy to nodes at different times. Abstract Advanced persistent threats (APTs) pose a grave threat in cyberspace because of their long latency and concealment. In this paper, we propose a hybrid strategy game-based dynamic defense model to optimally allocate constrained secure resources for the target network. In addition, values of profits of players in this game are computed by a novel data-fusion method called NetF. Based on network protocols and log documents, the NetF deciphers data packets collected from different networks to natural language to make them comparable. Using this algorithm, data observed from the Internet and wireless sensor networks (WSNs) can be fused to calculate the comprehensive payoff of every node precisely. The Nash equilibrium can be computed using the value to detect the possibility of a node being a malicious node. Using this method, the dynamic optimal defense strategy can be allocated to every node at different times, which enhances the security of the target network obviously. In experiments, we illustrate the obtained results via case studies of a cluster of heterogeneous networks. The results guide planning of optimal defense strategies for different kinds of nodes at different times. [ABSTRACT FROM AUTHOR]

With the popularity of the Internet of Things (IoT), massive amounts of data are generated every second. By analyzing this data, attackers can launch kinds of attacks for their own profits, such as data tampering, malicious data injection, identity deception etc. To solve these problems, in this paper, we propose a Trusted Execution Environment-and-Blockchain-based data protection architecture (TEDA). In TEDA, edge devices in different IoTs maintain a consortium blockchain to achieve the secure read/write operations and verification of data together with cloud. Besides, to secure the local data processing in edge devices and manage internal light-weight devices, an Intel SGX-based module is designed. Furthermore, a new transaction structure is introduced to protect user's access pattern. The experimental results show that the space occupancy rates of write and read of TEDA with SGX are 0.84 × and 1.07 × than that of TEDA without SGX, and the time occupancy rates of write and read of TEDA with SGX are 0.94 × and 0.90 × than that of TEDA without SGX, which indicate TEDA has a good performance. [ABSTRACT FROM AUTHOR]

Buffer overflow defenses have been comprehensively studied for many years. Different from previous solutions, we propose PHUKO, an on-the-fly buffer overflow prevention system which leverages virtualization technology. PHUKO offers the protected program a fully transparent environment and an easy deployment without the need to restart the program. Generally, the working process of PHUKO can be divided into two stages. First, we utilize static binary analysis to identify the instructions offline which are the entries of vulnerable functions. Second, by combining virtual machine introspection and online patching, PHUKO instruments the protected running program on-the-fly with memory safety enforcement. The experiments show that our system can defend against realistic buffer overflow attacks effectively with a moderate performance overhead. [ABSTRACT FROM AUTHOR]

Background: Blood pressure diseases have increasingly been identified as among the main factors threatening human health. How to accurately and conveniently measure blood pressure is the key to the implementation of effective prevention and control measures for blood pressure diseases. Traditional blood pressure measurement methods exhibit many inherent disadvantages, for example, the time needed for each measurement is difficult to determine, continuous measurement causes discomfort, and the measurement process is relatively cumbersome. Wearable devices that enable continuous measurement of blood pressure provide new opportunities and hopes. Although machine learning methods for blood pressure prediction have been studied, the accuracy of the results does not satisfy the needs of practical applications. Results: This paper proposes an efficient blood pressure prediction method based on the support vector machine regression (SVR) algorithm to solve the key gap between the need for continuous measurement for prophylaxis and the lack of an effective method for continuous measurement. The results of the algorithm were compared with those obtained from two classical machine learning algorithms, i.e., linear regression (LinearR), back propagation neural network (BP), with respect to six evaluation indexes (accuracy, pass rate, mean absolute percentage error (MAPE), mean absolute error (MAE), R-squared coefficient of determination (R2) and Spearman's rank correlation coefficient). The experimental results showed that the SVR model can accurately and effectively predict blood pressure. Conclusion: The multi-feature joint training and predicting techniques in machine learning can potentially complement and greatly improve the accuracy of traditional blood pressure measurement, resulting in better disease classification and more accurate clinical judgements. [ABSTRACT FROM AUTHOR]

• We propose a novel deep learning based solution for binary code similarity detection. • We use the instruction embedding model to vectorize the extracted instructions. • We apply a deep learning classification model to identify the types of functions to be compared. • We utilize the hybrid siamese neural network to measure the binary code similarity. • We conduct extensive experiments to evaluate the effectiveness of our approach. Binary code similarity detection (BCSD) plays an important role in malware analysis and vulnerability discovery. Existing methods mainly rely on the expert's knowledge for the BCSD, which may not be reliable in some cases. More importantly, the detection accuracy (or performance) of these methods are not so satisfied. To address these issues, we propose BinDeep, a deep learning approach for binary code similarity detection. This method firstly extracts the instruction sequence from the binary function and then uses the instruction embedding model to vectorize the instruction features. Next, BinDeep applies a Recurrent Neural Network (RNN) deep learning model to identify the specific types of two functions for later comparison. According to the type information, BinDeep selects the corresponding deep learning model for similarity comparison. Specifically, BinDeep uses the Siamese neural networks, which combine the LSTM and CNN to measure the similarities of two target functions. Different from the traditional deep learning model, our hybrid model takes advantage of the CNN spatial structure learning and the LSTM sequence learning. The evaluation shows that our approach can achieve good BCSD between cross-architecture, cross-compiler, cross-optimization, and cross-version binary code. [ABSTRACT FROM AUTHOR]