Analysis of Malware Impact on Network Traffic using Behavior-based Detection Technique

Web applications make life more convenient. Many web applications have several kinds of user input (e.g. personal information, a user"s comment of commercial goods, etc.) for the activities. On the other hand, there are a range of vulnerabilities in the input functions of Web applications. Malicious actions can be attempted using the free accessibility of many web applications. Attacks by the exploitation of these input vulnerabilities can be achieved by injecting malicious web code; it enables one to perform a variety of illegal actions, such as SQL Injection Attacks (SQLIAs) and Cross Site Scripting (XSS). These actions come down to theft, replacing personal information, or phishing. The existing solutions use a parser for the code, are limited to fixed and very small patterns, and are difficult to adapt to variations. A machine learning method can give leverage to cover a far broader range of malicious web code and is easy to adapt to variations and changes. Therefore, this paper suggests the adaptable classification of malicious web code by machine learning approaches for detecting the exploitation user inputs. The approach usually identifies the “looks-like malicious” code for real malicious code. More detailed classification using sequence information is also introduced. The precision for the “looks-like malicious code” is 99% and for the precise classification with sequence is 90%.

The Early Detection, Alert and Response (eDare) system is aimed at purifying Web traffic propagating via the premises of Network Service Providers (NSP) from malicious code. To achieve this goal, the system employs powerful network traffic scanners capable of cleaning traffic from known malicious code. The remaining traffic is monitored and Machine Learning (ML) algorithms are invoked in an attempt to pinpoint unknown malicious code exhibiting suspicious morphological patterns. Decision trees, Neural Networks and Bayesian Networks are used for static code analysis in order to determine whether a suspicious executable file actually inhabits malicious code. These algorithms are being evaluated and preliminary results are encouraging.

In an ecosystem where education is done through software interaction, the security of those systems is one key aspect which should not trouble the educators nor the children and students that interact with them. The article addresses a problem that is growing every day, new malware samples, which steal data [10], encrypt data and ask for a ransom [11], get remote access to a personal computer [12], use computer resources to mine cryptocurrencies [13]. There are presented malware analysis reports that meticulously describe malicious software's behaviour and help security professionals to mitigate the risk. The need for security brings to light new methods to protect people's devices, like using machine learning or artificial intelligence. Random forest and neural network algorithms are implemented and the results are very encouraging, the accuracy in both cases is over 95%. In the last few years, because of the increasing computer resources and the more frequent usage of cloud services, these machine learning algorithms perform better and have caught the attention of many researchers in this area. The objectives of the project include the study of malicious software in order to find mitigation strategies, important characteristics of malware families that are used to generalize the problem of ransomware and malware detection. Also, it's presented the usage of open source sandbox to capture malware's behaviour and to use the results as the input for machine learning algorithms, and the study of different algorithms which can be used in classification problems. The current work can be a strong baseline to develop more advanced and useful algorithms, using millions of samples as the input dataset.

Linux is considered to be less prone to malware compared to other operating systems, and as a result Linux users rarely run anti-malware. However, many popular software applications released on other platforms cannot run natively on Linux. Wine is a popular compatibility layer for running Windows programs on Linux. The level of security risk that Wine poses to Linux users is largely undocumented. This project was conducted to assess the security implications of using Wine, and to determine if any specific types of malware or malware behavior have a significant effect on the malware being successful in Wine. Dynamic analysis (both automated and manual) was applied to 30 malware samples both in a Windows environment and Linux environment running Wine. Behavior analyzed included file system, registry, and network access, and the spawning of processes, and services. The behavior was compared to determine malware success in Wine. The study results provide evidence that Wine can pose serious security implications when used to run Windows software in a Linux environment. Five samples of Windows malware were run successfully through Wine on a Linux system. No significant relationships were discovered between the success of the malware and its high-level behavior or malware type. However, certain API calls could not be recreated in a Linux environment, and led to failure of malware to execute via Wine. This suggests that particular malware samples that utilize these API calls will never run completely successfully in a Linux environment. As a consequence, the success of some samples can be determined from observing the API calls when run within a Windows environment.

Outlier-aware cooperative spectrum sensing in cognitive radio networks

In a high-speed network traffic environment, it is essential to deeply analyze network protocols and extract key fields from network traffic for network mapping and traffic attribute labeling. However, we find that there are anomalous characters in the key fields from various network protocols. In order to study this phenomenon more specifically, we conducted a study on user agent(UA) field in Hypertext transfer protocol (HTTP) to illustrate it. It is well known that UA contains a lot of information about clients. Therefore, we study the anomaly in UA strings from a unique perspective of clients. In this paper, we present the results of the first large-scale measurement study proposing the method to detect anomalous UA strings and investigating the causes of the anomaly in UA strings. In our program, we collected more than 150 billion UA strings, containing nearly 22 million UA strings with anomalous characters. The ratio of UA strings with anomalous characters to these without anomalous characters is nearly 0.1485%. Simultaneously, approximately 91 thousand clients which distribute all over the world contain anomalous UA strings. We pay attention to the top 20 clients with huge anomalous UA strings. The main reason for anomalous characters in UA strings would be caused by some clients themselves, as we find some clients with malicious activities in the network. Ultimately, we conducted a comprehensive analysis of anomalous and normal UA strings from these clients we are focused on.

To handle the growing flood of malware, security vendors and analysts rely on tools that automatically identify and analyze malicious code. Current systems for automated malware analysis typically follow a dynamic approach, executing an unknown program in a controlled environment (sandbox) and recording its runtime behavior. Since dynamic analysis platforms directly run malicious code, they are resilient to popular malware defense techniques such as packing and code obfuscation. Unfortunately, in many cases, only a small subset of all possible malicious behaviors is observed within the short time frame that a malware sample is executed. To mitigate this issue, previous work introduced techniques such as multipath or forced execution to increase the coverage of dynamic malware analysis. Unfortunately, using these techniques is potentially expensive, as the number of paths that require analysis can grow exponentially. In this paper, we propose REANIMATOR, a novel solution to determine the capabilities (malicious functionality) of malware programs. Our solution is based on the insight that we can leverage behavior observed while dynamically executing a specific malware sample to identify similar functionality in other programs. More precisely, when we observe malicious actions during dynamic analysis, we automatically extract and model the parts of the malware binary that are responsible for this behavior. We then leverage these models to check whether similar code is present in other samples. This allows us to statically identify dormant functionality (functionality that is not observed during dynamic analysis) in malicious programs. We evaluate our approach on thousands of realworld malware samples, and we show that our system is successful in identifying additional, malicious functionality. As a result, our approach can significantly improve the coverage of malware analysis results.

Abstract—The rapid expansion of interconnected smart devices has enabled widespread automation and connectivity across smart homes, healthcare, manufacturing, and industrial control systems. However, this large-scale connectivity has significantly increased vulnerabilities, leading to a sharp rise in IoT botnet attacks. Compromised devices are remotely controlled and used to perform cyber-crimes such as Distributed Denial of Ser- vice (DDoS), unauthorized data access, and aggressive network flooding. Traditional signature-based detection methods fail to identify evolving botnet families due to rapid mutation of attack patterns. This paper introduces a machine learning-based intelligent detection framework capable of identifying IoT botnet behavior through traffic flow analysis. The proposed system preprocesses collected network traffic, extracts relevant features, classifies flows as benign (0) or malicious (1), and triggers an automated alert notification when malicious activity is detected. Experimental evaluation demonstrates highly reliable perfor- mance and strong prediction accuracy, proving the suitability of machine learning methods for real-time IoT botnet detection and prevention. Additional discussions include feature selection techniques, model optimization, and deployment considerations for scalable and robust IoT security solutions. Index Terms—IoT Security, Botnet Detection, Machine Learn- ing, Network Traffic Analysis, Intrusion Detection System, Real- Time Alerting, Flow-Based Detection.

Introduction: Anomaly detection in network traffic is a critical component in multiple domains like IoT, Cloud Computing, cybersecurity and other field, focusing on the identification of malicious activities to preserve the integrity of network systems. Objectives: This research investigates the performance of both parametric and non-parametric machine learning algorithms in detecting anomalies within network traffic datasets. Parametric models such as Logistic Regression and Support Vector Machines (SVM) were evaluated alongside non-parametric methods, including Random Forest and K-Nearest Neighbors (KNN). Methods: The dataset underwent an extensive preprocessing pipeline to address issues such as missing data, feature normalization, and categorical encoding to improve model accuracy. Results: Among the different algorithms assessed, Random Forest demonstrated the highest efficacy, achieving an accuracy rate of 98.68%. This notable performance highlights the advantages of ensemble techniques in capturing complex, non-linear patterns inherent in network traffic. The results underscore the significant contribution of machine learning, particularly non-parametric methods, in enhancing anomaly detection systems within cybersecurity. Conclusions: Furthermore, this study provides valuable insights into algorithm selection for network traffic analysis, facilitating the development of more robust and efficient intrusion detection systems.

- Performance and Secuity analysis is essential in the communication systems in the digital world we live in today. This paper discusses the creation of a Network Traffic Tracer, a network system written in Python with integrated Wireshark for capturing packets and performing automated traffic analysis. It employs Scapy and PyShark libraries to capture, f ilter, and process network packets to analyze crucial data about the traffic patterns, unusual activities, and possible security threats. Furthermore, it uses GeoLiteCity IP address geolocation database to enable visual mapping of suspicious network activities all over the world. Such visualization is plenty in identifying strange patterns such as unauthorized invasion or flooding the network which is known as Distributed Denial of Service (DDoS). Furthermore, the system supports real-time monitoring along with statistical report generation for traffic anomaly detection to increase the level of secuity and optimize performance of the network. In this paper, we show how effective the combination of automation in Python and traditional network analysis methods is in addressing issues pertaining to security and monitoring of networks.Keywords: Network Traffic Analysis, Python, Wireshark, Cybersecurity, Scapy, PyShark, Anomaly Detection. Keywords: Network Traffic Analysis, Packet Capture, Python, Wireshark, Scapy, PyShark, Cybersecurity, GeoIP, Anomaly Detection

Malware is a program that has a negative influence on computer systems that do not have user permission. The purpose of malware by hackers is to gain profit in an illegal way. Therefore we need a malware analysis that aims to find out the specifics of malware so that security can be built to protect computer devices. One method for analyzing malware is heuristic detection. Heuristic detection is an analytical method that allows to find new types of malware in a file or application. A lot of malware is created to attack through the internet because of technological advances. Under these conditions, a malware analysis is performed using the call network API with the heuristic detection method. This aims to identify the behavior of malware that attacks the network. The results of the analysis carried out is that most malware is spyware, which is lurking for user activity and retrieving user data without the user's knowledge. In addition, there is also malware that is as adware, which displays advertisements through pop-up windows on computer devices that interfere with user activity. So with these results, it can also be identified actions that can be taken by users to protect their computer devices, such as by installing antivirus or antimalware, not downloading unauthorized applications and not accessing insecure websites.

Currently, the number of network devices and communications is growing rapidly. At the same time, the number and quality of attacks against them is also constantly increasing. To protect devices from malicious activity, various threat detection tools are constantly being developed and improved. This article presents the development of an application for traffic classification based on ensemble machine learning methods. When implementing the application, two algorithms were used - Random Forest and AdaBoost. The accuracy of these algorithms when testing the application was 99.99% and 99.97%, respectively.

Due to the rapid development of Internet the size of computer network are continue to grow in size. Thus the network traffic are increasing drastically. To keep the data transfer smooth and faster in the network the monitoring, and management of network traffic is an important factor in field of computer network. The data, information are communicated via TCP or UDP Internet protocol between nodes in the network. These transport layer protocol carry the packet or datagram from source-to-destination site. The packet analysis or packet sniffing is process of capturing the packet and analyze the log traffic passes over the network or a part of network. Packet sniffer is used for wired or wireless network. A tool is developed to accomplish the monitoring task that removes deficiency of existing tool. The packet sniffer is used to capture the traffic and analyzed those captured traffic. The report is generated based on analyzed captured traffic. Various transport layer protocol like TCP, UDP, etc., can be implemented for analysis and filtering can be done based on protocol used. A new approach of packet sniffing and network traffic analysis over TCP connection oriented network using Wireshark software has been discussed in this paper.

Sober: Explores for invasive behaviour of malware

A major vector of computer infection is through exploiting vulnerable software or design flaws in networked applications such as the browser. Malicious code can be fetched and executed on a victim's machine without the user's permission, as in drive-by download (DBD) attacks. In this paper, we describe a new tool called DeWare (standing for Detection of Malware) for detecting the onset of infection delivered through vulnerable applications. DeWare enforces the dependencies between user actions and system events, such as file-system access and process execution. Our tool can be used to provide real time protection of a personal computer, as well as for diagnosing and evaluating untrusted websites for forensic purposes. Our solution demonstrates a usable host-based framework for controlling and enforcing the access of system resources. We perform extensive experimental evaluation, including a user study with 21 participants, thousands of legitimate websites (for testing false alarms), 84 malicious websites in the wild, as well as lab reproduced exploits. Our results show that DeWare is able to correctly distinguish legitimate download events from unauthorized system events with a low false positive rate (< 1%).