Behavioral Analysis of Modern Malware Traffic Using Statistical Network Features

This research aims to demonstrate the extent to which statistical analysis methods contribute to improving analytical review procedures in the Libyan environment. The descriptive analytical approach was used, and the research community was determined in the self-employed external audit offices affiliated with the Libyan Audit Bureau in the city of Tripoli. The research concluded that: the application of statistical analysis methods (time series, regression analysis) contributes to a high degree to improving analytical review procedures. The results also revealed the existence of obstacles that limit the use of statistical analysis methods in improving analytical review procedures in the Libyan environment. The researchers recommended: developing specialized training programs for auditors in the Libyan environment to enhance their knowledge and understanding of statistical analysis methods, providing software and technological tools to facilitate the application of statistical analysis methods at reasonable costs, developing clear professional standards governing the use of statistical analysis methods in analytical review, and conducting periodic qualification courses for auditors to raise their awareness about the importance and benefits of using statistical methods. Keywords: Statistical analysis methods, Analytical review, Libyan environment,

Nowadays, there are significant amounts of malware codes that are created every day. However, the majority of these samples (malware) are variations of other malware that have been already identified. Therefore, most of the analyzed malware have similar structure among them. In this investigation, we will present a technic to extract features throughout different abstraction levels in order to classify malware codes. This analysis is based on three factors: the position where the malware is detected, the functions' calls from each Dynamic Link Libraries (DLL) and the ten most frequently visited hexadecimals per each malware sample. Once those characteristics are obtained, a descriptive vector of each malware is built. This vector works as a training to different learning machines types (SVM, IBL, and Decision Tree) and as a classification of the variations of malware codes (Virus, Backdoor, Trojan, and Adware). The result in the precision of the classification was 78.38% average where 3 types of learning machines were combined. The classified type as virus and algorithm IB1 (Instance Based Learning, IBL) were considered more accurate. These results are a fundamental support to the management system in information security by combining traditional and new classification and detention techniques of malware codes.

This chapter will review the statistical methods used in RNA sequencing data analysis, including bulk RNA sequencing and single-cell RNA sequencing. RNA sequencing data analysis has been widely used in biomedical and biological research to identify genes associated with certain conditions or diseases. Many statistical methods have been proposed to analyze bulk and single-cell RNA sequencing data. Several studies have compared the performance of different statistical methods for RNA sequencing data analysis through simulation studies and real data evaluations. This chapter will summarize the statistical methods and the evaluation results for comparing different statistical analysis methods used for RNA sequencing data analysis. It will cover the statistical models, model assumptions, and challenges encountered in the RNA sequencing data analysis. It is hoped that this chapter will help researchers learn more about the statistical perspective of the RNA sequencing data analysis and enable them to choose appropriate statistical analysis methods for their own RNA sequencing data analysis.

BackgroundThe evaluation of physical qualities in talent identification and development systems is vital and commonplace in supporting youth athletes towards elite sport. However, the complex and dynamic development of physical qualities in addition to temporal challenges associated with the research design, such as unstructured data collection and missing data, requires appropriate statistical methods to be applied in research to optimise the understanding and knowledge of long-term physical development.AimTo collate and evaluate the application of methodological and statistical methods used in studies investigating the development of physical qualities within youth athletes.MethodsElectronic databases were systematically searched form the earliest record to June 2021 and reference lists were hand searched in accordance with the PRISMA guidelines. Studies were included if they tested physical qualities over a minimum of 3 timepoints, were observational in nature and used youth sporting populations.ResultsForty articles met the inclusion criteria. The statistical analysis methods applied were qualitatively assessed against the theoretical underpinnings (i.e. multidimensional development, non-linear change and between and within athlete change) and temporal challenges (i.e. time variant and invariant variables, missing data, treatment of time and repeated measures) encountered with longitudinal physical testing research. Multilevel models were implemented most frequently (50%) and the most appropriately used statistical analysis method when qualitatively compared against the longitudinal challenges. Independent groups ANOVA, MANOVA and X2 were also used, yet failed to address any of the challenges posed within longitudinal physical testing research.ConclusionsThis methodological review identified the statistical methods currently employed within longitudinal physical testing research and addressed the theoretical and temporal challenges faced in longitudinal physical testing research with varying success. The findings can be used to support the selection of statistical methods when evaluating the development of youth athletes through the consideration of the challenges presented.

With the steady growth of Android malware, we suspect that, during the malware development phase, some Android malware writers use the popular public scanning services (e.g., VirusTotal) for testing the evasion capability of their malware samples, which we name Android malware development cases (AMDs). In this work, we design an AMD hunter in the context of VirusTotal to hunt for AMDs and reveal new threats for Android. First, the AMD hunter sifts through millions of file submissions on VirusTotal efficiently and alert more suspicious submission traces. Second, it performs package level analysis, static code and dynamic analyses on the APKs of the suspicious submissions to validate the AMDs. The implemented hunter has been used in a leading security company for 4 months, which processed 153 million of submissions on VirusTotal, and identified 1,623 AMDs with 13,855 samples from 83 countries. We also performed case studies on 890 malware samples selected from the identified AMDs, which revealed lots of new threats, including the development cases of fake system/banking phishing app, new rooting exploits, new JavaScript based threats, new evasions and AV probing malware. We wrote industry research articles about some AMDs and notified other security vendors to help patch their false negatives. Besides raising the awareness of the existence of AMDs, more importantly, our research provides the first systematic and efficient way to study the malware development phenomenon on VirusTotal. We will share all the samples of the identified AMDs with the research community.

The Portable executable file format is the format of executables, object code and DLL’s (Dynamic Link Library) in Microsoft Windows Operating system. It is the standard of how executable files are organized within file system in Microsoft Windows. The Portable executable file format was designed for Windows NT 3.1 that released in 1993. Many of its features are inherited from COFF (Common object file format) used in Unix Operating systems. It consists of header and sections; headers are rules that tell windows loader how the section should be mapped and loaded into memory. The section are nothing but the data or content. Different sections hold different kind of data for example code section contains executable code while bss (Block Started by Symbol) sections contains uninitialized data. Portable executable file could be used in a way to dent the security of computer, therefore great care should be taken while downloading and running Portable executable files. In our work we develop a static malware analysis tool called ‘Portable Executable File Analysis Framework (PEFAF)’ using data mining techniques. A collection of 8 thousand benign and 7 thousand malicious files were used in this work. We extracted 60 features, analyzed them and found that 34 of them are significant for the detection of malware threats. Based on these 34 indicators our tool classifies input file into malicious or non-malicious.

Functional magnetic resonance imaging (fMRI) has been a popular approach in brain research over the past 20 years. It offers a noninvasive method to probe the brain and uses blood oxygenation level dependent (BOLD) signal changes to access brain function. However, the BOLD signal only represents a small fraction of the total MR signal. System instability and various noise have a strong impact on the BOLD signal. Additionally, fMRI applies fast imaging technique to record brain cognitive process over time, requiring high temporal stability of MR scanners. Furthermore, data acquisition, image quality, processing, and statistical analysis methods also have a great effect on the results of fMRI studies. Quality assurance (QA) programs for fMRI can test the stability of MR scanners, evaluate the quality of fMRI and help to find errors during fMRI scanning, thereby greatly enhancing the success rate of fMRI. In this review, we focus on previous studies which developed QA programs and methods in SCI/SCIE citation peer-reviewed publications over the last 20 years, including topics on existing fMRI QA programs, QA phantoms, image QA metrics, quality evaluation of existing preprocessing pipelines and fMRI statistical analysis methods. The summarized studies were classified into four categories: QA of fMRI systems, QA of fMRI data, quality evaluation of data processing pipelines and statistical methods and QA of task-related fMRI. Summary tables and figures of QA programs and metrics have been developed based on the comprehensive review of the literature.

Objective To explore how to use Epidata and SPSS software in process of coding,entry and statistical analysis of multiple choice conveniently and quickly.Methods On the basis of the hospital demands for nursing graduates behavior questionnaire,Epidata and SPSS software was adopted to realize information coding,entry and statistical analysis of multiple choice,directional selection problem,sort multiple-choice questions.Results Through examples show,a combination of the two software carried on reasonable coding,entry and processing in the three different types of multiple-choice questions,involved in the hospital demands for nursing graduates behavior questionnaire,and gave registration interface of Epidata software,multiple choice encoding and SPSS data analysis process.Conclusions The combination of the two kinds of software can greatly improve the speed of data entry,especially when the data sample is large. Key words: Multiple choice; Epidata; SPSS; Data entry; Statistical analysis

Orchestration of APT malware evasive manoeuvers employed for eluding anti-virus and sandbox defense

Researchers who use the results of statistical analyses to draw conclusions about collected data must write a statistical analysis section in their manuscript. Describing statistical analyses in precise detail is as important as presenting the dosages of drugs and methodology of interventions. It is also essential for scientific accuracy and transparency in scientific research. We evaluated the quality of the statistical analysis sections of clinical research articles published in the Korean Journal of Anesthesiology between February 2020 and February 2021. Using a Likert scale where 1, 2, and 3 represented “not described at all,” “partially described,” and “fully described,” respectively, the following 6 items were assessed: 1) stating of the statistical analysis methods used, 2) rationale for and detailed description of the statistical analysis methods used, 3) parameters derived from the statistical analyses, 4) type and version of the statistical software package used, 5) significance level, and 6) sidedness of the test (one-sided vs. two-sided). The first 3 items evaluate issues directly related to the statistical analysis methods used and last 3 are indirectly related items. In all the included articles, the statistical analysis methods used were stated (score of 3). However, only 4 articles (12.9%) fully described the sidedness of the test (score of 3). Authors tend not to describe the sidedness of statistical analysis tests in the methodology section of clinical research articles. It is essential that the sidedness be described in research studies.

Subject. This article examines and discusses analytical procedures, including statistical analysis methods, used by auditors when conducting activities related to the auditing of accounting records. Objectives. The article aims to explore theoretical aspects and determine practical recommendations regarding the selection and application of analytical procedures (methods of statistical analysis) in the audit of fixed asset utilization. Methods. For the study, we used the abstract and logical, analytical, and case study methods. The conceptual provisions of the Russian auditing system and the activities of AO MILKOM, operating in the dairy production sector, served as the study object. Results. The article identifies the issues reflecting the relevance and significance of applying analytical procedures, including statistical analysis methods, during audits (including the use of fixed assets), and provides recommendations on their practical use to enhance their effectiveness. Conclusions and Relevance. The active use of statistical analysis methods in the audit of fixed assets enhances the informativeness, quality, reliability, and value of audit evidence, contributes to the reduction of labor intensity of the activities carried out, and ensures the objectivity of auditors' conclusions and recommendations. The materials of the article are relevant and significant both in the practical activities of auditors and for use in the educational process aimed at developing the students' advanced knowledge.

During the last years the worldwide trend in viticulture research is to restore the local varieties due to the importance of obtaining quality products, typical, authentic, and so, their research has become a fundamental one. The research was conducted in Silagiu-Buzias viticultural area among 2008-2012, and the aim was to identify and enhance the productive potential and quality of local varieties and biotypes, cultivated in the Banat region, particular in the viticultural area Buziaș-Silagiu compared with control varieties. For the estimation and interpretation of genotype x environment interaction and stability of different studied traits, various models of linear regression analysis were used. This method is based on the finding that different components of genotype x environment interaction effects are linearly correlated with environmental conditions shown by the average performance of all genotypes for studied traits. Regression significance and genotypes drift from linear regression was performed using variance analysis by the Hardwick -Wood model . Another method used for assessing the stability was ecovalence method or ecological valence . Considering estimation for the six models used, on the rank sum differences is noted that the highest stability of this trait had varieties: Ochiul boului, CoarnAƒ neagrAƒ, Alb crocant de Buziaș, Roșu crocant de Silagiu. A high influence of genotype x environment interaction on the achievement of this trait - high values ​​of the sum of ranking differences according to statistical models used respectively - were observed in the varieties: RAƒșchiratAƒ albAƒ, CoarnAƒ vA¢nAƒtAƒ and Conic auriu.

Over the last four decades, the bootstrap method has been considered so as to define data‐driven bandwidth selectors for nonparametric curve estimation. An extensive and updated review of bootstrap methods used to select the smoothing parameter for the nonparametric estimation of several curves has been carried out. Different data generating processes have been profoundly reviewed, such as the classical independent and identically distributed setup as well as dependent, censored, length‐biased, grouped, missing or directional data, among others. Several curves have also been considered, such as the density, regression, hazard rate, intensity, latency, incidence, or distribution functions, among many others. It is worth mentioning that there exist situations where Monte Carlo methods are not needed when using the bootstrap for bandwidth selections. This idea has also been exploited to find closed expressions for the bootstrap version of criterion functions for some proxy of the real curve estimator.This article is categorized under: Statistical and Graphical Methods of Data Analysis > Bootstrap and Resampling Statistical and Graphical Methods of Data Analysis > Nonparametric Methods Statistical and Graphical Methods of Data Analysis > Density Estimation

In the never-ending battle against rising malware threats, cybersecurity professionals were constantly challenged by malware researchers. Businesses and institutions that have fallen prey to these threats that have suffered significant financial losses and enormous disruption to countless lives. As a result, security approaches have evolved to include preemptive measures such as the widespread use of HoneyPots. However, data-driven decision-making was required to improve the effectiveness of such approaches. Therefore, this paper describes a quantitative analysis that assesses various malware samples using system metrics and network log data. The goal is to properly visualise this information and analyse if it can aid in decision-making processes, ultimately leading to the construction of more robust and secure networks. To help with this research, a dashboard application was created that allows the installation of virtual machines, the configuration of virtual networks, and the collection of system metric data from outside sources. The findings of this paper can help greatly improve network security and stay ahead of threats in the cat-and-mouse game.

This article aims at the empirical study of fuzzy evaluating approach applied for banking operating performance in Taiwan. According to the available literature, evaluations of bank operating performance are commonly obtained through questionnaires with sampling, processed by statistical analysis methods. However, the vagueness of linguistic terms used by decision maker, such as important etc., is not considered when assessment of relative weight results. Therefore, In order to obtain more precise aggregate evaluation results, a fuzzy evaluating approach is proposed, in which the linguistic terms are replaced by fuzzy numbers, followed by a computational process. The proposed approach is more effective than the traditional statistical methods and will increase the applicability of banks' performance evaluation in practice. An empirical study is conducted to demonstrate the advantages of the fuzzy evaluating approach over the statistical methods.