Search

Due to their open nature and popularity, Android-based devices represent one of the main targets for malware attacks that may adversely affect the privacy of their users. Considering the huge Android market share, it is necessary to build effective tools able to reliably detect zero-day malware on these platforms. Therefore, several static and dynamic analysis methods based on Neural Networks and Deep Learning have been proposed in the literature. Despite machine learning can be considered the most promising approach for classifying applications into malware or legitimate ones, its success strongly depends on the choice of the right features used for building the detection model. This is definitely not an easy task that requires a systematic solution. Accordingly, this work represents the sequences of API calls invoked by apps during their execution as sparse matrices looking like images (API-images), which can be used as fingerprints of the apps' behavior over time. We also used autoencoders to autonomously extract the most representative and discriminating features from these matrices, that, once provided to an artificial neural network-based classifier have shown to be effective in detecting malware, also when the network is trained on a reduced number of samples. Experimental results show that the resulting framework is able to outperform more complex and sophisticated machine learning approaches in malware classification. • Using Neural Networks and Deep Learning to timely detect zero-day malware on Android platforms. • Building applications' classification model needed for flagging privacy/security breaches. • Modeling application behavior through sparse matrices representing API calls' sequences (API-Images). • Using autoencoders to autonomously extract the most representative and discriminating features. • Performing classification and detection based on softmax multi-class regressors. [ABSTRACT FROM AUTHOR]

Internet of Things (IoT) is a promising technology for improving our lives and society by integrating smart devices in our environment and paving the way for novel ICT application, spanning from smart cities to energy efficiency and home automation. However, such a vision encompasses the availability of thousands of smart devices, or even more, that continuously exchange a huge volume of data among each other and with cloud-based services, raising a big data problem. Such a problem can be approached by properly applying data fusion practices within an IoT infrastructure. Due to the characteristics and peculiarities of the communications among smart devices within the IoT, an event-based data fusion is needed, where devices exchange notifications of events among each others. Such data fusion should be focused on special devices where notification heterogeneity, and data source trust issues have to be faced with. Accordingly, the contribution of this work is proposing (i) a novel broker-less event-based communication protocol specifically tailored to sensors with constrained resources, (ii) a solution for flexible event-based communications among heterogeneous data sources, and (iii) an approach based on the theory of evidence for data fusion processes that depend on the matching and trust degree of the data to be fused. [ABSTRACT FROM AUTHOR]

The ever-increasing number of IoT applications and cyber–physical services is introducing significant challenges associated to their cyber-security. Due to the constrained nature of the involved devices, some heavier computational tasks, such as deep traffic inspection and classification, essential for implementing automatic attack detection systems, are moved on specialized “edge” devices, in order to distribute the processing intelligence near to the data sources. These edge devices are mainly capable of effectively running pre-built classification models but have not enough storage and processing capabilities to build and upgrade such models from huge volumes of field training data, imposing a serious barrier to the deployment of such solutions. This work leverages the flexibility of cloud-based architectures, together with the recent advancements in the area of large-scale machine learning for shifting the more computationally-expensive and storage-demanding operations to the cloud in order to benefit of edge computing capabilities only for effectively performing traffic classification based on sophisticated Extreme Learning Machines models that are pre-built over the cloud. [ABSTRACT FROM AUTHOR]