Search

Ransomware analysis creates crucial aspects for cybersecurity defense mechanisms. Recently, attackers are confusing the parts of ransomware attack code using steganography to carry malicious JavaScript and even deliver cryptominers. It can be used to understand a system, to leak sensitive information, and to run a command and control channel without being detected by any anti-malware agents. It means a cyberattack can operate without detection, bypassing all defenses that are based on detection or analysis. Many approaches have been used and most of them include the analysis of the portable executable (PE) file of the malware executable which are injected directly into the target system. However, all of these existing systems fail to detect the ransomware when they are obfuscated. In this article, a stegomalware detection system is proposed to find the presence of hidden payloads from input images, to extract the hidden payloads, and to verify whether the hidden payload is the subject of stegoransomware attack. The proposed system uses three phases such as hidden payload detection, hidden payload extraction, and classification to detect the stegoware. Ant colony optimization algorithm is used in the detection phase to find an optimal subset of features to detect obfuscation. Stegorepository images are decoded to extract the items hidden inside the input steganographically. A two-stage ensemble classifier is used to process the extracted payloads. Initially, a binary classifier is used to find whether the extracted payload is a benign or malignant file. If it is found as malignant, the exact percentage of its malicious activity that it can provide to the target host system is further calculated using a fuzzy C-means clustering algorithm. Simulation observations describe that the proposed system drastically reduces dimensionality and significantly improves classification accuracy.

Obfuscation techniques are used by malware authors to conceal malicious code and surpass the antivirus scanning. Machine Learning techniques especially deep learning techniques are strong enough to identify obfuscated malware samples. Performance of deep learning model on obfuscated malware detection is compared with conventional machine learning models like Random Forest (RF), Classification and Regression Trees (CART) and K Nearest Neighbour (KNN). Both Static (hardware and permission) and dynamic features (system calls) are considered for evaluating the performance. The models are evaluated using metrics which are precision, recall, F1-score and accuracy. Obfuscation transformation attribution is also addressed in this work using association rule mining. Random forest produced best outcome with F1-Score of 0.99 with benign samples, 0.95 with malware and 0.94 with obfuscated malware with system calls as features. Deep learning network with feed forward architecture is capable of identifying benign, malware, obfuscated malware samples with F1-Score of 0.99, 0.96 and 0.97 respectively.

The malicious software are still accounting up as a substantial threat to the cyber world. The most widely used vectors to infect different systems using malware are the document files. In this, the attacker tries to blend the malevolent code with the benign document files to carry out the attack. Portable document format (PDF) is the most commonly used document format to share the documents due to its portability and light weight. In this modern era, the attackers are implementing highly advance techniques to obfuscate the malware inside the document file. So, it becomes difficult for the malware detection classifiers to classify the document efficiently. These classifiers can be of two main type, namely, static and dynamic. In this paper, we surveyed various static and dynamic learning-based PDF malware classifiers to understand their architecture and working procedures. We also have presented the structure of the PDF files to understand the sections of PDF document where the malevolent code can be implanted. At the end, we performed a comparative study on the different surveyed classifiers by observing their true Positive percentages and F1 score.

In this digital age of mass surveillance and personal identity theft, data security and privacy is a major concern. Although sophisticated tools and software that guarantee privacy are easily available, users are increasingly becoming aware of their privacy concerns and look for solutions that enables them to secure data on their own, owing to its sensitivity and confidentiality. Anti-forensics has been at the forefront in data concealment by using novel data hiding and trail obfuscation techniques which promise great value when it comes to maintaining anonymity, privacy and confidentiality of data. This chapter takes a look at various anti-forensic techniques that promise value when it comes to data obscurity and discusses their potential in ensuring its security and privacy.

Electronic health record (EHR) stores not only the patient’s health-related data but also the sensitive individual information. Consequently, data security and access privacy are the greatest concern of EHR applications while sharing the data through the cloud. Ciphertext policy attribute-based encryption (CP-ABE) is one of the popular one-to-many encryption schemes, which helps to attain fine-grained access control in cloud domain. In CP-ABE, since the access policy is attached to the ciphertext, anyone with the ciphertext can see the data owner’s policy that may cause privacy leakage. In this paper, we proposed a CP-ABE cryptosystem that supports access policy obfuscation and outsourced decryption enabling efficient and secure operations in cloud environment. Linear secret sharing (LSS) scheme is used for supporting any monotonic access structures, thereby improving the access policy’s expressiveness. We have incorporated prime-order bilinear group and matrix-based LSS scheme that increases the computational efficiency of the cryptosystem. Finally, we have evaluated the performance of our CP-ABE cryptosystem using practical implementation utilizing Charm framework.

Source code obfuscation is one of the techniques used by software developers to protect their software. Obfuscation techniques transform the original code to a new protected version which is harder for the attackers to understand but have the same function as the original one. Most of obfuscation techniques are not based on well-defined measurements to clarify their effectiveness in protecting the source code from reveres engineering attacks. This paper presents an experimental study to investigate the effectiveness of specific control flows obfuscation technique—A parameterized flattening—in software protection against human attacks. We conduct an experiment, where software developers participate to perform an attack task on two applications written in C sharp programming language where one of the applications is clear and the other one is obfuscated with control flow obfuscation technique. As a result of the statistical analysis used in this paper, it is shown that only the obfuscation treatment significantly affects the correctness of the attacker to perform a successful attack, where the obfuscation reduced the correctness of the attacker by 50%. The complexity of the application has no significant effect on the correctness of the understanding tasks. Also, neither obfuscation treatment nor the complexity of the application has any effect on the correctness of the modification attack tasks.

The developers of Android applications and malware use complex obfuscation and encryption tools and techniques to hinder the mobile applications that they develop from being repackaged and analysed. These tools and techniques obfuscate and encrypt the strings and classes, API calls and control flows in the Dalvik bytecode. The obfuscated and encrypted Android applications which are obtained from sources such as Koodous, Virus Total, etc. need to be analysed using DexMonitor and the countermeasures for packed or obfuscated malware have to be found. A decision support system is then constructed and the guidelines and countermeasures for packed malware are provided.

Number of smartphone users of android based devices is growing rapidly. Because of the popularity of the android market malware attackers are focusing in this area for their bad intentions. Therefore, android malware detection has become a demanding and rising area to research in information security. Researchers now can effortlessly detect the android malware whose patterns have formerly been recognized. At present, malware attackers commenced to use obfuscation techniques to make the malwares incomprehensible to malware detectors. For this motive, it is urgent to identify the pattern that is used by attackers to obfuscate the malwares. A large-scale investigation has been performed in this paper by developing python scripts to extract the pattern of app components from an obfuscated android malware dataset. Ultimately, the patterns in a matrix form has been established and stored in a Comma Separated Values (CSV) file which will conduct to the primary basis of detecting the obfuscated malwares.

Integrated circuits (ICs) are now built and developed in various environments susceptible to changes in malicious design. The worldwide design flow makes it easy for an opponent to pirate IC and manipulates functionality according to the requirements. The main challenge for a designer is to hide the functionality of an IC while passing through another unreliable environment of the design flow. To overcome the scenario, this work proposes a technique of obfuscation known as LUT-based dynamic obfuscation to prevent any malicious modification of the design. In this paper, the obfuscated signals change over time and the design is unpredictable by adding different coding schemes. The minimum cycles required to obtain the correct key bit are 17 cycles for a smaller circuit with six key bit and security in terms of hamming distance is improved to 15% by the optimal selection of the control signal.

This chapter considers two inter-related modes of exclusion of migrants from anti-trafficking protections: the use of discretion and of obfuscation. Discretion is most often visible at the point of victim identification—the initial stage where determination of claims and classifications of potential victims are made. But, it can operate in a number of stages, including during legal proceedings. Discretion, in a legal sense and where migrant subjects are concerned, is best described by Heyman [Canadian Journal of Law and Society, 24(3), 367–390 (2009)] as an unequal legal-bureaucratic sorting based on normative judgements concerning trust, suspicion, and risk. Obfuscation is a broader concept which refers to bureaucratic processes that cause delay, frustration, and, ultimately for many, self-exclusion from seeking support and remedial justice, in this case under a trafficking framework.

The safeguarding of sensitive information has always been the mission of researchers and cryptographers since time immemorial. People all around the world have always felt the dire need to establish and ensure information security, i.e., to ascertain that crucial and confidential information is kept secure from any unwanted access and/or attack. Moreover, it is also necessary to provide access to confidential data to legitimate and authentic users after confirming login credentials. Cryptography is a well-known technique for maintaining confidentiality, integrity, authentication, and non-repudiation of messages, whereby the sender encrypts the plain text to generate ciphertext, sends it across a communication medium which on the receipt is decrypted by the authentic receiver. This paper proposes a novel cross-media encryption-cum-obfuscation technique where the encryption technique will obfuscate itself by changing its media. To simulate the proposed obfuscation technique in the real world, a specific hardware setup is requisite at both the terminals. So, the transmitter and receiver hardware circuitry is smartly designed to dynamically change the signatures and achieve enhanced security. Thus, it can be said that the proposed technique is robust against the traditional cryptanalysis methods and can ensure information security by obfuscating the data.

Data protection is no longer a luxury. With so much of sensitive, personal, financial transaction events which involves money or online payment for buying or selling of goods, data gets transmitted online. Hence, security and privacy have become the need of everyone who participates in those events. Blockchain is our use case for securing the data from any major data breaches and keeping data safe enough. Thus, blockchain data obfuscation or data masking refers to the process in which essential data is masked and stored in the form of the blocks, where each block is connected to preceding blocks in the form of a chain. The blockchain application allows greater transparency, as the blockchain is a type of distributed book and it also provides enhanced security and traceability of data, for example, when the items\goods are recorded on a blockchain, we can backtrack items to their point of origin. Once the data is recorded on the blockchain then a customer can trust the accuracy of blockchain data, as the data cannot be manipulated. The advantage of blockchain is that it will reduce the cost of business, by removing middlemen or third parties.

Hardware security is a matter of increasing importance in the modern world. With increasing threats of piracy and theft, it is needed to devise methodologies to mitigate these concerns. Obfuscating the design netlist is a popular method to achieve this to a significant extent. However, full security guarantee is not provided with the encryption approach. Under this scenario, a watermarking method complements the security guarantee by providing claims of IP authorship. In this paper, we present a unified methodology for circuit encryption and watermarking to enhance hardware security. Experiments on several ISCAS’85 benchmark circuits show that the proposed methodology has average 8.2% area overhead and 11.3% power overhead.

The technological advancements of mobile networks, devices, global position technology and sensors, have lead to a plethora of location-based services (LBSs) which is being offered to user. In the modern digital age, most of the automobiles use location sensing technologies and the mobile devices are equipped with GPS location tracking. In spite of the numerous potential benefits of location-based services, location awareness poses some foreseeable threats, the most important of which is location privacy. A single piece of information about location can reveal a lot about user, such as ‘who’, ‘what’, ‘when’ and ‘where’ someone is. This paper presents a comprehensive review of various aspects related to location privacy. An attempt has been made to introduce a framework to balance the trade-offs between privacy and security. The proposed framework uses privacy mechanism to protect individual’s sensitive data, and a role-based access control technique to provide security of collected data through authorized user.

Malicious programs like the viruses, worms, Trojan horses, and backdoors infect host computers by taking advantage of flaws of the software and thereby introducing some kind of secret functionalities. The authors of these malicious programs attempt to find new methods to get avoided from detection engines. They use different obfuscation techniques such as dead code insertion, instruction substitution to make the malicious programs more complex. Initially, obfuscation techniques those are used by software developers to protect their software from piracy are now misused by these malware authors. This paper intends to detect such obfuscated programs or malware using control flow graph (CFG) matching technique, using VF2 algorithm. If the original CFG of the executable is found to be isomorphic to subgraph of obfuscated CFG (under examination), then it can be classified as an obfuscated one.

SoC FPGA are shrinking is size with advancement in the technologies. Miniaturization alone may not be sufficient to meet user requirements and hence security challenges remain unsolved. Existing approaches have their own limitations in terms of area and power. A model for two factor authentication is proposed with low- power, area and highly automative. It consists of a hybrid Physical unclonable functions (PUFs), which is used to abstract the unique ID of a chip and finite state machine (FSM) to verify that the Intellectual property (IP) is authentic or not. Recent hardware security applications such as IP protection, IC metering, hardware signature and obfuscation are mostly using PUF. Though most of these applications require a database to store the random outputs and complex security algorithms. This in turn increases the area, power, cost and energy consumption. A lightweight hybrid PUF model consisting of arbitrary and butterfly PUF along with the two-level FSM is projected for such security breaches which can be used for many IOT applications. Experimental results show that the area and power consumed is 5% and 9% respectively, for authenticating 26 IP in 13.25 s which is less than that of the conventional design.

Cloud computing is now a day’s become most attracted phenomena to use for a large-scale organization or for individual who need various network services with least cost. Normally, individual’s information is stored on public Cloud which is available to everyone for access. This fundamental raise some issue opposite to flexible services provided by Cloud providers, like Confidentiality, Integrity, Availability, Authorization and many more. To protect the data, lots of options available now a days and most preferable way is to use encryption. Encryption only cannot provide enough protection while considering user’s sensitive information, as well as it consumes more time to process encryption and decryption. To remove the burden of Cloud server, as well as to keep adequate security to user’s information in Cloud environment, in this paper, we propose a methodology for combining both techniques, viz. obfuscation and encryption. The user data may be encrypted if it requires security for its files or document, and the DaaS service of Cloud must be secured using obfuscation techniques. Using this two-way approach, we can say that the proposed scheme offers enough security towards anonymous access and preserve privacy even of the information available on Cloud Servers. We also aim to provide proper integrity checking mechanism, better access control mechanism which lessens the burden of Client as well as service provider.

Now a day’s a user of internet wants a freedom to access their valuable data from anywhere any time. Here, Cloud computing comes with its numerous services where user can have get anything like system power, Storage, applications and many more with just less charges. Users of Cloud mainly use it for various purpose and currently storing the data on Cloud is the very important scenario to be consider. With lots of advantage to store data on cloud and free self from burden of maintain record other side, it is very important for user that the data must be secure even it is on rest or in transition. The researcher of Cloud working on their own to deal with this issue but in most of the research proposal consider client side security related issues i.e. Integrity checking, Authentication, Versioning etc. At other side some Research model gives more importance to security data related issue of Cloud service provider i.e. Database encryption, Security based on Metadata, Data Obfuscation etc. But both of above fundamental not make strong impact for Cloud users and Service providers. To have achieve best of them here in this paper we presented a model with two techniques that’s Data Obfuscation for server side to secure database details from outsiders and Encryption, authentication at client side. In this paper we have discussed implemented and testing of model towards performance and security. The proposed model ensures both users and service providers to bind trust on each other.

Spammers collect email addresses from internet using automated programs known as bots and send bulk SPAMS to them. Making the email address difficult to recognize for the bots (obfuscate) but easily understandable for human users is one of the effective way to prevent spams. In this paper, we focus on evaluating the effectiveness of different techniques to obfuscate an email address and analyze the frequency at which spam mails arrive for each obfuscation technique. For this we employed multiple web crawlers to harvest both obfuscated and non-obfuscated email addresses. We find that majority of the email addresses are non-obfuscated and only handful are obfuscated. This renders majority of email users fall prey to SPAMS. Based on our findings, we propose a natural language processing (NLP)-based obfuscation technique which we believe to be stronger than the currently used obfuscation techniques. To analyze the frequency of arrival of spam mails in an obfuscated mail, we posted obfuscated email addresses on popular websites (social networking and ecommerce sites) to analyze the number of spams received for each obfuscation technique. We observe that even simple obfuscation techniques prevent spams and obfuscated mails receive less spam mails than the non-obfuscated ones.