Search

Our research empirically examines the relationship between tax avoidance and the likelihood of incurring a tax-related restatement, as well as the effects tax restatements have on future tax avoidance behavior. We predict and find that the association between tax avoidance and the likelihood of a tax-related restatement is nonlinear. Specifically, both relatively high levels and relatively low levels of tax avoidance compared to peer firms increase the likelihood of incurring a tax-related restatement. We consider whether the increased likelihood for high avoiders is attributable to obfuscation necessary to escape detection of tax avoidance or weak corporate governance. For high avoiders, we find evidence that both obfuscation and weak corporate governance may contribute to the likelihood of a tax-related restatement. As low avoiders should not need to obfuscate, we focus on corporate governance and find an increased likelihood when governance is weak. In response to a tax-related restatement announcement, we document a decline in tax avoidance for firms that have relatively high tax avoidance prior to the restatement announcement. We attribute this to the increased level of Internal Revenue Service (IRS) monitoring and strengthening of corporate governance that we observe post-restatement announcement. In contrast, we do not find evidence that low avoidance firms alter their tax avoidance after a tax-related restatement announcement, consistent with our finding that corporate governance does not improve post-restatement for low avoiders. [ABSTRACT FROM AUTHOR]

Copyright of Contemporary Accounting Research is the property of Canadian Academic Accounting Association and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

When people want to conduct a transaction, but doing so would be morally disreputable, they can obfuscate the fact that they are engaging in an exchange while still arranging for a set of transfers that are effectively equivalent to an exchange. Obfuscation through structures such as gift-giving and brokerage is pervasive across a wide range of disreputable exchanges, such as bribery and sex work. In this article, we develop a theoretical account that sheds light on when actors are more versus less likely to obfuscate. Specifically, we report a series of experiments addressing the effect of trust on the decision to engage in obfuscated disreputable exchange. We find that actors obfuscate more often with exchange partners high in loyalty-based trustworthiness, with expected reciprocity and moral discomfort mediating this effect. However, the effect is highly contingent on the type of trust; trust facilitates obfuscation when it is loyalty-based, but this effect flips when trust is ethics-based. Our findings not only offer insights into the important role of relational context in shaping moral understandings and choices about disreputable exchange, but they also contribute to scholarship on trust by demonstrating that distinct forms of trust can have diametrically opposed effects.

An applicant privately observes the value of an idea and files a patent application. After the examination, the patent examiner may not find conclusive evidence of the idea's value. In this case, granting a patent can be the right decision or a mistake. Moreover, it can prompt obfuscation—effort to disrupt communication—by the applicant, reducing allocative efficiency. We show there is more obfuscation when examiners are more lenient, and we provide an empirical exercise supporting this conclusion. We also show that more examination resources do not prevent and may lead to more obfuscation. This result continues to hold when applicants can invest in knowledge to increase their chances of having good ideas. We also show that there is less obfuscation when good ideas are harder to find. This paper was accepted by Ilia Tsetlin, behavioral economics and decision analysis. Funding: N. Figueroa gratefully acknowledges financial support from ANID PIA/APOYO AFB220003. Supplemental Material: The online appendix and data are available at https://doi.org/10.1287/mnsc.2023.00140. [ABSTRACT FROM AUTHOR]

Di era serba digital saat ini, data menjadi sebuah aset yang sangat berharga. Berbagai macam teknik digunakan untuk mencuri data pribadi yang berpotensi disalahgunakan oleh pihak yang tidak bertanggung jawab. Objek yang digunakan pada penelitian ini adalah AQUVAPRN.exe yang memiliki jenis malware RAT (Remote Access Trojan) yang saat malware ini berjalan pembuat malware tersebut dapat mengambil data pribadi pengguna yang sistem operasinya terinfeksi. Cara kerja dari malware AQUVAPRN.exe dengan berjalan pada latar belakang saat aplikasi dijalankan atau dieksekusi lalu membuat beberapa proses seperti mengubah file registry, membuat file, membaca file, dan melakukan koneksi internet dengan IP Address tertentu secara terus menerus tanpa diketahui oleh pengguna dari komputer itu sendiri. Hasil yang diperoleh terhadap malware AQUVAPRN.exe berupa alamat IP Address 109.51.76.80, memiliki domain Kota Lisbon Negara Portugal, memiliki nilai hash MD5 55c2c12970cda52f58bfad7b8c7d37d5. Diketahui pula, malware AQUVAPRN.exe menggunakan teknik anti reverse engineering tepatnya obfuscation yang menghambat atau menghalangi malware untuk dibedah atau di reverse engineering agar mengetahui code penyusun dari malware. Didapatkan pula PID dari proses AQUVAPRN.exe adalah 8332 dengan alat virtual (Virtual Address) 0x8e0f57042080.

We examine the relation between political uncertainty and narrative disclosure complexity in conference calls. Using firm-level political uncertainty, we find that political uncertainty is positively associated with firms' disclosures complexity as measured by the Fog index. Decomposing complexity into two latent components—information and obfuscation—we show that political uncertainty significantly increases the obfuscation but has no impact on the information. Further analysis reveals that complex disclosure is motivated by expected poor future performance amid political uncertainty. We also show that, during periods of heightened political uncertainty, obfuscated disclosure is associated with reduced earnings informativeness, increased dispersion in analyst forecasts, and higher volatility in forecast revisions. These findings are robust to including and excluding sentences containing complex political bigrams when calculating Fog. Further evidence shows that, during periods of political uncertainty, managers tend to use a more ambiguous tone and provide scripted and shorter (longer) responses to analysts' questions (presentations). [ABSTRACT FROM AUTHOR]

Street-level image platforms (SLIPs) employ indiscriminate forms of data collection that include potentially privacy invasive images. Both the scale and the indiscriminate nature of data collection means that significant privacy management requirements are needed. Legal risk management is currently operated through obfuscation techniques involving certain image objects. Current SLIP object obfuscation solutions are an indiscriminate and a blunt solution to a similarly indiscriminate data collection concern. A new contextual approach to obfuscation is required that goes beyond object obfuscation. Contextually-dependent identification would seek to identify the contexts, including captured objects, which can give rise to privacy concerns. It is technically more challenging for automated solutions as it requires an assessment of the contextual situation to understand privacy risk. Context-sensitive privacy detection, combined with context-sensitive privacy-by-design processes, potentially offer a risk management solution that better situates and addresses the concerns arising from SLIP data collections. [ABSTRACT FROM AUTHOR]

To combat PCB design reverse engineering and protect intellectual property, a method of obfuscation is developed. Noise generating traces are placed alongside the true circuit, separated by false non-conductive vias visually indistinguishable from regular ones. If the false vias are copied as real conductive vias in illegitimate replications, signals will be distorted, leading to poor performance. The deliberate placement of the generators separated by false vias is tested using a machine learning algorithm (MLA) employing a signal integrity database to determine the most vulnerable traces in the PCB based on their physical properties and interconnections. [ABSTRACT FROM AUTHOR]

A wiretap coding scheme (Wyner in Bell Syst Tech J 54(8):1355–1387, 1975) enables Alice to reliably communicate a message m to an honest Bob by sending an encoding c over a noisy channel ChB , while at the same time hiding m from Eve who receives c over another noisy channel ChE . Wiretap coding is clearly impossible when ChB is a degraded version of ChE , in the sense that the output of ChB can be simulated using only the output of ChE . A classic work of Csiszár and Korner (IEEE Trans Inf Theory 24(3):339–348, 1978) shows that the converse does not hold. This follows from their full characterization of the channel pairs (ChB , ChE) that enable information-theoretic wiretap coding. In this work, we show that in fact the converse does hold when considering computational security; that is, wiretap coding against a computationally bounded Eve is possible if and only if ChB is not a degraded version of ChE . Our construction assumes the existence of virtual black-box obfuscation of specific classes of "evasive" functions that generalize fuzzy point functions and can be heuristically instantiated using indistinguishability obfuscation. Finally, our solution has the appealing feature of being universal in the sense that Alice's algorithm depends only on ChB and not on ChE . [ABSTRACT FROM AUTHOR]

In this paper, I investigate how non-knowledge about border violence is maintained through secrecy. I do so by focusing on Frontex's maritime pushback scandal. The first argument I develop is that secrecy takes the form of hiding and obfuscation. Hiding is straightforward. It implies that information about pushback is withheld from oversight bodies and the public to avoid criticism and disciplinary measures. Obfuscation is more complex. It refers to the production of uncertainty, ambiguity and confusion about a policy or practice. Differently from hiding, obfuscation results from the disclosure of contradictory and misleading information about pushback, as well as from attempts to confuse the public debate by raising convoluted arguments that question the very understanding of pushbacks as illegal. The second argument I develop is that transparency can be implicated in the production of secrecy. While transparency and secrecy are typically seen as binary opposites, I will explain how mechanisms implemented to render Frontex's operation more transparent have been used to hide pushbacks and obscure the Agency's responsibility for violations of fundamental rights. [ABSTRACT FROM AUTHOR]

With the widespread use of mobile devices, Android has become the most popular operating system, and new applications being uploaded to the Android market every day. However, due to the ease of modifying and repackaging Android binaries, Android applications can easily be modified and imitated by other developers and released in third-party Android markets. Therefore, determining the original developers of Android applications is a challenging problem known as authorship attribution. This study explores the distinctive features of Android applications to identify their authors. Software developers generally leave a footprint that reflects their writing styles in their applications. Therefore, this footprint, which can be extracted from either the source code or the binary code, can help identify the authors of software applications. Since obtaining the source code of applications in the wild can be impractical, especially when dealing with malware, researchers prefer to focus on the binaries of applications. Therefore, this study proposes an approach that identifies Android developers by deriving a wide range of features from different parts of Android applications, such as smali files, libraries, manifest files, and metadata information. Moreover, other features such as configuration, dex code, resource-based, and string-related features are inherited from other studies in Android authorship attribution and fused with the proposed feature set. The proposed approach was evaluated on benign and malware datasets and compared with those of other studies. The results show that the proposed features increase the accuracy by showing 82.5% and 95.6% in the market and malware datasets, respectively. The results demonstrate the positive impact of the proposed features on Android authorship attribution.

Malware targeting user privacy has seen a surge in recent times, attributed to evolving global regulations and the boost of electronic commerce and online services. Moreover, recognizing privacy malware that employs obfuscation as evasion mechanism presents a major challenge due to its dynamics, resilience, and polymorphism at runtime, necessitating the application of forensic techniques such as memory dumping analysis in order to reveal suitable patterns and behaviors that enable its subsequent detection and classification. In this paper, we present three obfuscated privacy malware classifiers trained on the CIC-MalMem-2022 dataset. These solutions include a binary classifier to distinguish benign from malicious samples using logistic regression (LR), a multiclass classifier that further categorizes benign, spyware, ransomware, and trojan horse obfuscated privacy malware; and a more detailed multiclass classifier capable of discriminating benign samples from fifteen specific obfuscated privacy malware families. Multiclass classifiers were built using several traditional machine learning algorithms and a novel Deep Neural Network (DNN). We applied the Synthetic Minority Oversampling Technique (SMOTE) to address data imbalances. In particular, our results demonstrate that DNN outperforms traditional machine learning algorithms, yielding statistically significant improvements in key metrics. These achievements reach practical thresholds, suggesting the potential for enhanced malware protection systems. The dataset and all the coding files required for experiments reproducibility are publicly available at https://github.com/dcevallossalas/PrivacyMalwareClassifiers.

Anecdotally, not all investors are able to read and understand the financial report. I consider a strategic reporting game where investors are bounded rational and only pay attention to randomly sampled parts of the financial report and then extrapolate the value of the firm based on this. The manager can both obfuscate and bias the financial report. Obfuscation works by disaggregating the report into any number of line items, modeled as nonnegative signals, whose mean is constrained to be equal to the biased profitability of the firm. There can be synergies between biasing and obfuscation, causing financial statements to be both less transparent and more biased when investors are extrapolative. [ABSTRACT FROM AUTHOR]

We study the incentives for firms' obfuscation strategies and their impact on social welfare in a market with boundedly rational consumers. We assume that firms obfuscate product information, which can prevent consumers from acquiring type information. Some naive consumers in the markets exhibited limited comprehension and default bias toward higher-quality products. We show that firms chose obfuscation in all cases except those in which consumers have a strong degree of bounded rationality and more pessimistically evaluate themselves as the naive type. This means that for firms, the benefits from second-degree price discrimination are limited and obfuscation may be a more important strategy than informing. We also find that, under certain conditions, obfuscation may result in socially desirable product allocation. This result indicate that careful consideration needs to be given to policies that reduce the incentive for firms to obfuscate, such as increasing the proportion of sophisticated consumers. [ABSTRACT FROM AUTHOR]

We study the power of randomized complexity classes that are given oracle access to a natural property of Razborov and Rudich (JCSS, 1997) or its special case, the Minimal Circuit Size Problem (MCSP). We show that in a number of complexity-theoretic results that use the SAT oracle, one can use the MCSP oracle instead. For example, we show that ZPEXP MCSP ⊈ P / poly , which should be contrasted with the previously known circuit lower bound ZPEXP NP ⊈ P / poly . We also show that, assuming the existence of indistinguishability obfuscators (IOs), SAT and MCSP are equivalent in the sense that one has an efficient randomized (BPP) algorithm if and only if the other one does. We interpret our results as providing some evidence that MCSP may be NP-hard under randomized polynomial-time reductions. [ABSTRACT FROM AUTHOR]

Fingerprints have been widely used and accepted as an effective method of human identification. This biometric tool aids in criminal investigations for personal identity for over a century. Whilst the Automatic Fingerprint Identification System (AFIS) has bolstered security efforts, it has also opened doors to potential scams, affecting both civilian and law enforcement operations. Despite extensive research on fingerprint authentication issues, very little attention has been given to addressing the problem of fingerprint alteration or obfuscation. Fraudsters, with the guidance of experts, have developed new techniques to obscure their fingerprints intentionally. Fingerprint obfuscation is the deliberate alteration of fingerprint patterns with the aim of concealing their true identity, raising concerns amongst security and investigative organizations. The objective of the current communication is to highlight the numerous techniques used for obfuscation, forgery and alteration of fingerprints in humans. It further accentuates the need for identification and interpretation of these altered fingerprints and recommends notifying law enforcement agencies of potential threats. [ABSTRACT FROM AUTHOR]

Microsoft has implemented several measures to defend against macro viruses, including the use of the Antimalware Scan Interface (AMSI) and automatic macro blocking. Nevertheless, evidence shows that threat actors have found ways to bypass these mechanisms. As a result, phishing emails continue to utilize malicious macros as their primary attack method. In this paper, we analyze 77 obfuscation features from the attacker's perspective and extract 46 suspicious keywords in macros. We first combine the aforementioned two types of features to train machine learning models on a public dataset. Then, we conduct the same experiment on a self-constructed dataset consisting of newly discovered samples, in order to verify if our proposed method can identify previously unseen malicious macros. Experimental results demonstrate that, compared to existing methods, our proposed method has a higher detection rate and better consistency. Furthermore, ensemble multi-classifiers with distinct feature selection can further enhance the detection performance. [ABSTRACT FROM AUTHOR]

Recently, there has been renewed interest in conjunction obfuscations. A conjunction, which is called pattern matching with wildcards sometimes, is associated with a pattern |$\mathsf{pat}\in \{0,1,*\}^n$| where * is a wildcard. It accepts if and only if the input bits are the same as the pattern at all non-wildcard positions. The conjunction obfuscation starts to get noticed because it provides the ability to protect these sensitive patterns while preserving its functionality. It is meaningful when the conjunction obfuscation is applied in the pattern matching, biological recognition, resisting SQL injection attacks and so on. In this work, we propose a new candidate of conjunction obfuscation. It not only retains the simplicity of the intuitive scheme in BKM18, but also adds wildcards to the pattern. Besides, we also propose a conjunction obfuscation with multi-bit output. The second obfuscation has the same size of the obfuscated program as the first obfuscation. Both obfuscations provide the distributional virtual black-box security. [ABSTRACT FROM AUTHOR]

Software obfuscation is a powerful tool to protect the intellectual property or secret keys inside programs. Strong software obfuscation is crucial in the context of untrusted execution environments (e.g., subject to malware infection) or to face potentially malicious users trying to reverse-engineer a sensitive program. Unfortunately, the state-of-the-art of pure software-based obfuscation (including white-box cryptography) is either insecure or infeasible in practice. This work introduces OBSCURE, a versatile framework for practical and cryptographically strong software obfuscation relying on a simple stateless secure element (to be embedded, for example, in a protected hardware chip or a token). Based on the foundational result by Goyal et al. from TCC 2010, our scheme enjoys provable security guarantees, and further focuses on practical aspects, such as efficient execution of the obfuscated programs, while maintaining simplicity of the secure element. In particular, we propose a new rectangular universalization technique, which is also of independent interest. We provide an implementation of OBSCURE taking as input a program source code written in a subset of the C programming language. This ensures usability and a broad range of applications of our framework. We benchmark the obfuscation on simple software programs as well as on cryptographic primitives, hence highlighting the possible use cases of the framework as an alternative to pure software-based white-box implementations.

Abstract Clone detection has received much attention in many fields such as malicious code detection, vulnerability hunting, and code copyright infringement detection. However, cyber criminals may obfuscate code to impede violation detection. To date, few studies have investigated the robustness of clone detectors, especially in-fashion deep learning-based ones, against obfuscation. Meanwhile, most of these studies only measure the difference between one code snippet and its obfuscation version. However, in reality, the attackers may modify the original code before obfuscating it. Then what we should evaluate is the detection of obfuscated code from cloned code, not the original code. For this, we conduct a comprehensive study evaluating 3 popular deep-learning based clone detectors and 6 commonly used traditional ones. Regarding the data, we collect 6512 clone pairs of five types from the dataset BigCloneBench and obfuscate one program of each pair via 64 strategies of 6 state-of-art commercial obfuscators. We also collect 1424 non-clone pairs to evaluate the false positives. In sum, a benchmark of 524,148 code pairs (either clone or not) are generated, which are passed to clone detectors for evaluation. To automate the evaluation, we develop one uniform evaluation framework, integrating the clone detectors and obfuscators. The results bring us interesting findings on how obfuscation affects the performance of clone detection and what is the difference between traditional and deep learning-based clone detectors. In addition, we conduct manual code reviews to uncover the root cause of the phenomenon and give suggestions to users from different perspectives.

This article explains why regulators should be guiding local governments (LGs) to use easy-to-understand language in their reports to truthfully communicate information about anti-corruption risks. Managers should avoid obfuscation of information that hides bad practices at LGs in terms of fighting corruption and pay closer attention to the readability of their text. This article will benefit policy-makers interested in overcoming previously neglected concerns for readability as a means of enhancing the effectiveness of the anti-corruption plans (ACPs) published by LGs. This article examines certain variables that can affect the readability of the anti-corruption plans (ACPs) published by Italian local governments (LGs). A readability index was created and an ordinary least squares model was applied to a sample of 108 LG three-year ACPs. The findings reveal that the number of corruption crimes and a large level of financial debt negatively affected the level of ACP readability. The size and political orientation of the city board also impacted the level of ACP readability. This evidence should convince politicians, managers and consultants of the need to insist on more readable documents to ensure greater accountability. [ABSTRACT FROM AUTHOR]

Cloud computing and edge computing brought more software, which also brought a new danger of malicious software attacks. Data synchronization mechanisms of software can further help reverse data modifications. Based on the mechanisms, attackers can cover themselves behind the network and modify data undetected. Related knowledge of software reverse engineering can be organized as rules to accelerate the attacks, when attackers intrude cloud server to access the source or binary codes. Therefore, we proposed a novel method to resist this kind of reverse engineering by breaking these rules. Our method is based on software obfuscations and encryptions to enhance the security of distributed software and cloud services in the 5G era. Our method is capable of (1) replacing the original assembly codes of the protected programwith equivalent assembly instructions in an iteration way, (2) obfuscating the control flow of the protected program to confuse attackers meanwhile keeps the program producing the same outputs, (3) encrypting data to confuse attackers. In addition, the approach can periodically and automatically modify the protected software binary codes, and the binary codes of the protected software are encrypted to resist static analysis and dynamic analysis. Furthermore, a simplified virtual machine is implemented to make the protected codes unreadable to attackers. Cloud game is one of the specific scenarios which needs low latency and strong data consistency. Cheat engine, Ollydbg, and Interactive Disassembler Professional (IDA) are used prevalently for games. Our improved methods can protect the software from the most vulnerable aspects. The improved dynamic code swapping and the simplified virtual machine technologies for cloud games are the main innovations. We inductively learned that our methods have been working well according to the security mechanisms and time complexity analysis. Experiments show that hidden dangers can be eliminated with efficient methods: Execution time and file sizes of the target codes can be multiple times than that of the original program codes which depend on specific program functions. [ABSTRACT FROM AUTHOR]

Modern System-on-Chip designs typically use Network-on-Chip (NoC) fabrics to implement coordination among integrated hardware blocks. An important class of security vulnerabilities involves a rogue foundry reverse-engineering the NoC topology and routing logic. In this paper, we develop an infrastructure, ObNoCs, for protecting NoC fabrics against such attacks. ObNoCs systematically replaces router connections with switches that can be programmed after fabrication to induce the desired topology. Our approach provides provable redaction of NoC functionality: switch configurations induce a large number of legal topologies, only one of which corresponds to the intended topology. We implement the ObNoCs methodology on Intel Quartus™ Platform, and experimental results on realistic SoC designs show that the architecture incurs minimal overhead in power, resource utilization, and system latency. [ABSTRACT FROM AUTHOR]

In modern computing, which relies on the interconnection of networks used in many/multi-core systems, any system can be critically subverted if the interconnection is compromised. This can be done in a multitude of ways, but the threat of a hardware Trojan (HT) being injected into a system is particularly prevalent due to the increase in third-party manufacturers for system-on-chip (SoC) designs. With a local injection of an HT in an SoC, an adversary can gain access to information about applications running on the system by revealing specific communications of the SoC, and the network-on-chip (NoC) as a whole. This heavily compromises the system and gives information to the attacker, which can lead to more tailored, compromising attacks. In this paper, we demonstrate an HT that exploits communication patterns inside an SoC to reveal applications that are running on an NoC with multi/many-core processors. This is performed by leaking packet counts, after which the attacker then uses machine learning techniques to identify applications running on processors, and the SoC as a whole. We also propose a LUT-based obfuscation technique to limit the information available to the hardware Trojan. Our results indicate that this obfuscation method can reduce the accuracy of this attack from 99% to <8% in multi/many-core systems. [ABSTRACT FROM AUTHOR]

In this study, the methodology of cyber-resilience in small and medium-sized organizations (SMEs) is investigated, and a comprehensive solution utilizing prescriptive malware analysis, detection and response using open-source solutions is proposed for detecting new emerging threats. By leveraging open-source solutions and software, a system specifically designed for SMEs with up to 250 employees is developed, focusing on the detection of new threats. Through extensive testing and validation, as well as efficient algorithms and techniques for anomaly detection, safety, and security, the effectiveness of the approach in enhancing SMEs' cyber-defense capabilities and bolstering their overall cyber-resilience is demonstrated. The findings highlight the practicality and scalability of utilizing open-source resources to address the unique cybersecurity challenges faced by SMEs. The proposed system combines advanced malware analysis techniques with real-time threat intelligence feeds to identify and analyze malicious activities within SME networks. By employing machine-learning algorithms and behavior-based analysis, the system can effectively detect and classify sophisticated malware strains, including those previously unseen. To evaluate the system's effectiveness, extensive testing and validation were conducted using real-world datasets and scenarios. The results demonstrate significant improvements in malware detection rates, with the system successfully identifying emerging threats that traditional security measures often miss. The proposed system represents a practical and scalable solution using containerized applications that can be readily deployed by SMEs seeking to enhance their cyber-defense capabilities. [ABSTRACT FROM AUTHOR]

In recent years, with the technological evolution that the world of IT has known, there are billions of devices connected via the internet and exchange immense amount of data. This development has stimulated senior criminals or even Script kiddies—who can exploit a malware, that is already developed and widespreaded—to develop attacks such as ransomware or DOS attacks. This situation has forced the security experts to develop new technologies to face these threats. Despite this, these new technologies remain incapable in front of zero-day malware, or new types of obfuscation, polymorphism or metamorphism. This complicated situation calls for Deep Learning, which is commonly used to solve these computer security issues. Our study will focus on Deep Learning for malware classification by implementing CNN models and transfer learning (TL) in order to overcome common problem in DL-based models for malware detection including overfitting, high-resources consumption and failure to detect obfuscated malware. Then we will make a comparative study, in order to analyze the impact of the improvements made in our study, compared to the results by D. Noever and Samantha E. Miller Noever. In this work, we used 3 models, an implemented CNN model, and 2 transfer learning models: MobileNetV2 and ResNet-50 models which are pre-trained models. We used also a dataset that contains 51880 samples, 10 different families of samples, 9 classes of malware images, and one class of benign files images. The results show that our model classifies malware families with an accuracy of 99%. To test the robustness of our models, we implement them on MalImg dataset to test their performances on obfuscated malware detection; we find out that our models detect obfuscation with an accuracy of 100%. [ABSTRACT FROM AUTHOR]

A discussion on using a range of solutions to subvert corporate control of our experience in understanding and relating to our urban environment.

We propose a new approach to construct general-purpose indistinguishability obfuscation (iO). Our construction is obtained via a new intermediate primitive that we call split fully homomorphic encryption (split FHE), which we show to be sufficient for constructing iO. Specifically, split FHE is FHE where decryption takes the following two-step syntactic form: (i) a secret decryption step that uses the secret key and produces a hint which is (asymptotically) shorter than the length of the encrypted message, and (ii) a public decryption step that only requires the ciphertext and the previously generated hint (and not the entire secret key) and recovers the encrypted message. In terms of security, the hints for a set of ciphertexts should not allow one to violate semantic security for any other ciphertexts. Next, we show a generic candidate construction of split FHE based on three building blocks: (i) A standard FHE scheme with linear decrypt-and-multiply (which can be instantiated with essentially all LWE-based constructions), (ii) a linearly homomorphic encryption scheme with short decryption hints (such as the Damgård-Jurik encryption scheme, based on the DCR problem), and (iii) a cryptographic hash function (which can be based on a variety of standard assumptions). Our approach is heuristic in the sense that our construction is not provably secure and makes implicit assumptions about the interplay between these underlying primitives. We show evidence that this construction is secure by providing an argument in an appropriately defined oracle model. We view our construction as a big departure from the state-of-the-art constructions, and it is in fact quite simple. [ABSTRACT FROM AUTHOR]

Clone detection has received much attention in many fields such as malicious code detection, vulnerability hunting, and code copyright infringement detection. However, cyber criminals may obfuscate code to impede violation detection. To date, few studies have investigated the robustness of clone detectors, especially in-fashion deep learning-based ones, against obfuscation. Meanwhile, most of these studies only measure the difference between one code snippet and its obfuscation version. However, in reality, the attackers may modify the original code before obfuscating it. Then what we should evaluate is the detection of obfuscated code from cloned code, not the original code. For this, we conduct a comprehensive study evaluating 3 popular deep-learning based clone detectors and 6 commonly used traditional ones. Regarding the data, we collect 6512 clone pairs of five types from the dataset BigCloneBench and obfuscate one program of each pair via 64 strategies of 6 state-of-art commercial obfuscators. We also collect 1424 non-clone pairs to evaluate the false positives. In sum, a benchmark of 524,148 code pairs (either clone or not) are generated, which are passed to clone detectors for evaluation. To automate the evaluation, we develop one uniform evaluation framework, integrating the clone detectors and obfuscators. The results bring us interesting findings on how obfuscation affects the performance of clone detection and what is the difference between traditional and deep learning-based clone detectors. In addition, we conduct manual code reviews to uncover the root cause of the phenomenon and give suggestions to users from different perspectives. [ABSTRACT FROM AUTHOR]

The methods proposed in this paper are leveraging Challenge–Response–Pair (CRP) mechanisms that are directly using each digital file as a source of randomness. Two use cases are considered: the protection and verification of authenticity of the information distributed in storage nodes and the protection of the files kept in terminal devices operating in contested zero-trust environments comprised of weak signals in the presence of obfuscating electromagnetic noise. With the use of nonces, the message digests of hashed digital files can be unique and unclonable; they can act as Physical Unclonable Functions (PUF)s in challenge–response mechanisms. During enrollment, randomly selected "challenges" result in unique output data known as the "responses" which enable the generation and distribution of cryptographic keys. During verification cycles, the CRP mechanisms are repeated for proof of authenticity and deciphering. One of the main contributions of the paper is the development of mechanisms accommodating the injection of obfuscating noises to mitigate several vectors of attacks, disturbing the side channel analysis of the terminal devices. The method can distribute error-free cryptographic keys in noisy networks with light computing elements without relying on heavy Error Correcting Codes (ECC), fuzzy extractors, or data helpers. [ABSTRACT FROM AUTHOR]

Analyzing Android applications is essential to review proprietary code and to understand malware behaviors. However, Android applications use obfuscation techniques to slow down this process. These obfuscation techniques are increasingly based on native code. In this article, we propose OATs'inside, a new analysis tool that focuses on high-level behaviors to circumvent native obfuscation techniques transparently. The targeted high-level behaviors are object-level behaviors, i.e., actions performed on Java objects (e.g., field accesses, method calls), regardless of whether these actions are performed using Java or native code. Our system uses a hybrid approach based on dynamic monitoring and trace-based symbolic execution to output control flow graphs (CFGs), 27 pages. for each method of the analyzed application. CFGs are composed of Java-like actions enriched with condition expressions and dataflows between actions, giving an understandable representation of any code, even those fully native. OATs'inside spares users the need to dive into low-level instructions, which are difficult to reverse engineer. We extensively compare OATs'inside functionalities against state-of-the-art tools to highlight the benefit when observing native operations. Our experiments are conducted on a real smartphone: We discuss the performance impact of OATs'inside, and we demonstrate its practical use on applications containing anti-debugging techniques provided by the OWASP foundation. We also evaluate the robustness of OATs'inside using obfuscated unit tests using the Tigress obfuscator. [ABSTRACT FROM AUTHOR]