Search

Malware is often hidden in illegitimately cloned software. Android, with over two billions active devices, is one of the most affected platforms because code cloning is quite simple and there are several not controlled markets. Obfuscation is both a cause and a solution to this scenario: a cause because obfuscated malware is harder to detect, a solution because obfuscation of legitimate applications makes code cloning more difficult. A deeper understanding of the obfuscation techniques would lead to more effective and aware use. In the literature, there are few methods of obfuscation detection with limited accuracy. Manual reverse engineering is too time-consuming to achieve this purpose, we need faster and automated techniques. In this work, we propose several deep learning models that can detect and classify the presence of obfuscation in Android applications. In addition to classical ML methods, we leverage natural language processing or image recognition approaches, then with a hybrid model, we exploit the best of each approach. Tests over a large dataset, made using different obfuscation tools, showed improvements compared to previous obfuscation detection methods. We target four obfuscation classes: identifier renaming, string encryption, reflection and class encryption, achieving an average F-measure of 0.985. [ABSTRACT FROM AUTHOR]

In recent years, the explosive growth of the Internet has led to an increment in the number of Distributed Denial of Service (DDoS) attacks. HTTP Flooding is a critical DDoS attack that targets HTTP servers to prohibit users from receiving HTTP services. Moreover, it saturates the link bandwidth and consumes network resources. Because the attack is launched at the application layer, it is difficult to defend against it using current countermeasures such as firewall or Intrusion Prevention System (IPS). In this paper, we propose SHFD , which leverages the Software-Defined Networking (SDN) paradigm to mitigate HTTP flooding attacks. We implement SHFD as a defender module on the SDN controller to detect and mitigate the attack in the first place. Experimental results gathered from Mininet confirm that SHFD brings a significant improvement of 13% in detection time and 29% in the number of blocked malicious flows compared to the state-of-the-art approaches. [Display omitted] • SHFD is proposed for mitigating slow and high rate HTTP flooding attacks in SDN-based networks. • Shannon's Entropy and Hellinger distance methods are used in SHFD to provide more accurate results. • Both slow/high rate HTTP flooding attack together with their side effects are explained in details. [ABSTRACT FROM AUTHOR]

The event prediction task learns the dynamic changes of past events and infers the upcoming ones. This task helps people to understand how events evolve in our real world and make rapid, accurate, and efficient reactions in emergencies. The complex relation of events and entities (events participants) changes dynamically over time. The current solutions of event prediction have not fully exploited such event temporal dependency and entity relation dependency. In addition, an event may relate to a considerable number of entities. Among such related entities, only a few of them are the key participants in driving the evolution of the event. Previous works fail to emphasize such key entities and limit the non-related entities. In this paper, we introduce a novel gating and attention mechanism and propose a novel T emporal sp A tial dy N amic G raph m O del (TANGO) that is composed of a graph model (based on Graph Convolutional Network with gated and attention mechanisms) and a sequential model (based on Temporal Convolutional Network). TANGO is able to model the event temporal dependency and entity relation dependency simultaneously; learn the representation of events relations; control the aggregation of relational information among entities with varying degrees of mutual influence; support long effective historical sizes. We demonstrate the validity and effectiveness of our approach on three different datasets (i.e., ICEWS18, GDELT, and ICEWS14). The result shows almost 6.2% MRR improvement and 3.9% Hits@10 improvement over the previous state-of-the-art. [ABSTRACT FROM AUTHOR]

While encryption can prevent unauthorized access to a secret message, it does not provide undetectability of covert communications over the public network. Implementing a highly latent data exchange, especially with low eavesdropping/discovery probability, is challenging for practical scenarios, such as social and political movements in authoritarian regimes, military operations, and privacy preservation. Moreover, the current literature suffers from a low embedding capacity and monolingual applicability, limiting the amount of hiding secret data within short text messages using state-of-the-art algorithms, e.g., linguistic-based, structural-based, or coverless-based solutions. In this paper, we present a systematic covert communication technique called CovertSYS that enables a multilingual secure end-to-end conversation via messaging or social network platforms. The CovertSYS functions by encrypting a confidential message using a multi-factor authentication scheme and converting the encoded binary data into hidden Unicode symbols to be transmitted under cover of short text messages. We then conduct extensive experiments to confirm the security and validity of the proposed technique against state-of-the-art approaches. Our experimental results show that the CovertSYS provides a superior mean performance of 91.53% by improving the criteria scores: embedding capacity rate of 100%, imperceptibility rate of 76.4%, and distortion robustness rate of 98.2%. Finally, we discuss the practical implications of the proposed technique compared to the existing text steganography methods. [Display omitted] • Various evaluation criteria based on literature and practical scenario have been discussed. • Possible cyberattacks on covert communication systems have been described. • The CovertSYS has been implemented in an Android prototype software. • Experimental results show superior performance compared to existing related works. [ABSTRACT FROM AUTHOR]

In this paper, we show a deep learning model for bot detection, named as DeBot, for industrial network traffic. DeBot uses a novel Cascade Forward Back Propagation Neural Network (CFBPNN) model with a subset of features using the Correlation-based Feature Selection (CFS) technique. A time series-based Nonlinear Auto-regressive Network with eXogenous inputs (NARX) technique analyzes the factors having a higher impact on the target variable and predict the behavioral pattern. To the best of our knowledge, we pioneer the use of optimal feature selection and integration with the cascading model of deep learning in bot detection of IIoTs. We conduct a thorough set of experiments on five popular bot datasets: NF-UNSW-NB15, NF-ToN-IoT, NF-BoT-IoT, NF-CSE-CIC-IDS2018, and ToN-IoT-Windows. We compare CFBPNN with other existing neural network models. We observe that CFBPNN in DeBot shows 100% accuracy in all the datasets with subset evaluation and obtains optimum F1-score and zero precision. [Display omitted] • We address the multi-layered network model with IIoT features to enable bot attack detection. • Our DeBot model evaluates the subset with optimal features with high impact on attack class and predict the risk factor. • We pioneer the implementation of time series-based Nonlinear Auto-Regressive eXogenous (NARX) model to predict the risk in the specified time gap. • We introduce a new cascading model with recurrent feature to preserve the relationship between input and output variables. [ABSTRACT FROM AUTHOR]

Blockchain is an emerging decentralized and distributed technology. Along with the beneficial features of decentralization, transparency, and security the consensus algorithms of blockchains form key building blocks for this technology. Consensus protocol/algorithm helps to provide a decentralized decision making process. An efficient consensus algorithm is inclusive that engages all the participants to make their decision based on the conflicts of the blockchain networks. These consensus decisions lead to better quality outcomes of the blockchains and help to obtain the finality. Rigorous research is in process to upgrade or optimize the existing consensus protocols. The optimized or enhanced consensus protocols objectify to be suitable for Internet-of-Thing (IoT) as the current versions of the protocols are not suitable for the resource-constrained environments due their complexity, hard configurations, mining techniques, high resource consumption, and explicit security loophole. In this paper, we present a survey of consensus protocols with a purpose to identify and discuss the existence of various consensus protocols available in literature. We emphasize on the genesis of the consensus protocols, particularly for Proof-of-X, byzantine fault tolerance, Paxos, and RAFT; we also include Directed Acyclic Graph (DAG) orientation of some contemporary algorithms. We discuss the variants of these genesis protocols. Our survey analyzes the advantages, disadvantages, and their applicability in IoTs. We enlist the categorical use of consensus algorithms in blockchains and other applications. Finally, we present several research trends and open issues emphasizing for consensus protocols emphasizing on IoTs. Compared to the other surveys in the field, our present survey objectifies to provide a more thorough summary of the most relevant protocols and application issues; this survey helps the researchers and the application developers to obtain an insight on the current status of the consensus protocols' suitability to deliver the desired functionalities in IoTs. The notified disadvantages of each of the protocol provide future scope for the industries and academia. To the best of our knowledge, such a comprehensive and summarized survey of consensus protocols including DAG-based protocols is unavailable in the literature and thus, our contribution claims are significant. [ABSTRACT FROM AUTHOR]