Malware Analysis and Static Call Graph Generation with Radare2

Large Language Models (LLMs) are increasingly used in cybersecurity, both as practical tools in real-world tasks like penetration testing and reverse engineering, and as educational aids for students learning complex analysis techniques. While recent research highlights their potential to automate code analysis, deobfuscation, and threat detection, less is known about how students actually use these models during malware analysis courses. To address this gap, we conducted a survey of 37 students enrolled in university-level malware analysis courses. Our findings show that all participants reported using LLMs, primarily for assignments and labs (70.2%) and to better understand course content (59.4%). Students primarily analyzed outputs from Interactive Disassembler Pro (IDA Pro) (83.7%), followed by OllyDbg and Wireshark (43.2%). They mainly used LLMs for advanced static analysis, especially for disassembled code interpretation (37.8%). While 59.4% of students reported no major issues when using LLMs, 27% encountered refusals to respond, primarily due to ethical safeguards built into the models, and others noted inaccurate or overly generic responses and token-size limits. In terms of satisfaction, 67.5% of students reported positive experiences with LLMs, and 81% indicated they were likely to continue using them for cybersecurity-related tasks in the future. These findings suggest the need for responsible integration of LLMs into cybersecurity education through lecturer guidance, ethical transparency, and effective assessment design. Overall, they highlight both the strengths and limitations of LLMs in supporting advanced technical learning.

Sandbox technique is widely used in automated malware analysis. However, it can only see one path during its analysis. This is fatal when meeting the targeted malware. The challenge is how to unleash the hidden behaviors of targeted malware. Many works have been done to mitigate this problem. However, these solutions either use limited and fixed sandbox environments or introduce time and space consuming multi-path exploration. To address this problem, this paper proposes a new hybrid dynamic analysis scheme by applying function summary based symbolic execution of malware. Specifically, by providing Windows APIs’ summary stub and using unicorn CPU emulator, we can effectively extract malware’s hidden behavior which are not shown in sandbox environment. Without the usage of full system emulation, our approach achieve much higher speed than existing schemes. We have implemented a prototype system, and evaluated it with typical real-world malware samples. The experiment results show that our system can effectively and efficiently extract malware’s hidden behavior.

To handle the growing flood of malware, security vendors and analysts rely on tools that automatically identify and analyze malicious code. Current systems for automated malware analysis typically follow a dynamic approach, executing an unknown program in a controlled environment (sandbox) and recording its runtime behavior. Since dynamic analysis platforms directly run malicious code, they are resilient to popular malware defense techniques such as packing and code obfuscation. Unfortunately, in many cases, only a small subset of all possible malicious behaviors is observed within the short time frame that a malware sample is executed. To mitigate this issue, previous work introduced techniques such as multipath or forced execution to increase the coverage of dynamic malware analysis. Unfortunately, using these techniques is potentially expensive, as the number of paths that require analysis can grow exponentially. In this paper, we propose REANIMATOR, a novel solution to determine the capabilities (malicious functionality) of malware programs. Our solution is based on the insight that we can leverage behavior observed while dynamically executing a specific malware sample to identify similar functionality in other programs. More precisely, when we observe malicious actions during dynamic analysis, we automatically extract and model the parts of the malware binary that are responsible for this behavior. We then leverage these models to check whether similar code is present in other samples. This allows us to statically identify dormant functionality (functionality that is not observed during dynamic analysis) in malicious programs. We evaluate our approach on thousands of realworld malware samples, and we show that our system is successful in identifying additional, malicious functionality. As a result, our approach can significantly improve the coverage of malware analysis results.

In recent years, the number and scale of malicious codes have grown exponentially, posing an increasing threat to cybersecurity. Hence, it is of great research value to quickly identify variants of malware and master their family information. Binary code similarity detection, as a key technique in reverse analysis, plays an indispensable role in malware analysis. However, most existing methods focus on similarity at the function or basic block level, ignoring the modular composition of malware. Implementing similarity detection among malware modules would greatly improve the efficiency and accuracy of homology detection. Inspired by the successful application of deep-learning techniques in program analysis, we propose a binary code module similarity detection method called ModDiff. It abstracts malware into attribute graphs, clusters functions using graph-embedded clustering algorithms to decompose malware into function-based modules, and calculates module similarity using graph-matching algorithms and natural language processing-based function similarity detection algorithms. The experimental results indicated that ModDiff improves the accuracy of module partitioning by 10.8% compared with previous work, and the highest F1 score of 89% is achieved in malware homologation detection. These results demonstrate the effectiveness of ModDiff in detecting and analyzing malware with important application value and development prospects.

Virtual machine introspection (VMI) is a technique for the external monitoring of virtual machines. Through previous work, it became apparent that VMI can contribute to the security of distributed systems and cloud architectures by facilitating stealthy intrusion detection, malware analysis, and digital forensics. The main shortcomings of active VMI-based approaches such as program tracing or process injection in production environments result from the side effects of writing to virtual address spaces and the parallel execution of shared main memory on multiple processor cores. In this paper, we present RapidVMI, a framework for active virtual machine introspection that enables fine-grained, multi-core aware VMI-based memory access on virtual address spaces. It was built to overcome the outlined shortcomings of existing VMI solutions and facilitate the development of introspection applications as if they run in the monitored virtual machine itself. Furthermore, we demonstrate that hypervisor support for this concept improves introspection performance in prevalent virtual machine tracing applications considerably up to 98 times.

In this short paper, an automatic malware analysis framework is introduced to facilitate the security community to keep the pace of rapidly changing malwares. In our framework, the honeynet technology and Taiwan Malware Analysis Net (TWMAN) can simultaneously collect and analyze the latest malicious software. The well-organized malware database and sharing platform can assist security experts in searching malware patterns. Owing to the prevalence of Bonnet, the number of malware increases quickly. Our automatic malware analysis framework is an excellent solution to deal with the Bonnet problem.

The South-East Asian Journal of Medical Education (SEAJME) is the culmination of the SEARAME's vision to bring together medical educationists in the region to promote collaborative efforts toward uplifting the standards of medical education in the region and beyond through dissemination of knowledge. This journal will be the ideal platform to disseminate research findings and stimulate discussion among experts in the field. Open access policy of the journal will facilitate this ideal.From November 2019, The South-East Asian Journal of Medical Education (SEAJME) is indexed in EuroPub

The rapid growth of Android malware has posed severe security threats to smartphone users. On the basis of the familial trait of Android malware observed by previous work, the familial analysis is a promising way to help analysts better focus on the commonalities of malware samples within the same families, thus reducing the analytical workload and accelerating malware analysis. The majority of existing approaches rely on supervised learning and face three main challenges, i.e., low accuracy, low efficiency, and the lack of labeled dataset. To address these challenges, we first construct a fine-grained behavior model by abstracting the program semantics into a set of subgraphs. Then, we propose SRA, a novel feature that depicts the similarity relationships between the Structural Roles of sensitive API call nodes in subgraphs. An SRA is obtained based on graph embedding techniques and represented as a vector, thus we can effectively reduce the high complexity of graph matching. After that, instead of training a classifier with labeled samples, we construct malware link network based on SRAs and apply community detection algorithms on it to group the unlabeled samples into groups. We implement these ideas in a system called GefDroid that performs Graph embedding based familial analysis of AnDroid malware using unsupervised learning. Moreover, we conduct extensive experiments to evaluate GefDroid on three datasets with ground truth. The results show that GefDroid can achieve high agreements (0.707--0.883 in term of NMI) between the clustering results and the ground truth. Furthermore, GefDroid requires only linear run-time overhead and takes around 8.6s to analyze a sample on average, which is considerably faster than the previous work.

This paper presents a unified framework to learn to quantify perceptual attributes (e.g., safety, attractiveness) of physical urban environments using crowd-sourced street-view photos without human annotations. The efforts of this work include two folds. First, we collect a large-scale urban image dataset in multiple major cities in U.S.A., which consists of multiple street-view photos for every place. Instead of using subjective annotations as in previous works, which are neither accurate nor consistent, we collect for every place the safety score from government's crime event records as objective safety indicators. Second, we observe that the place-centric perception task is by nature a multi-instance regression problem since the labels are only available for places (bags), rather than images or image regions (instances). We thus introduce a deep convolutional neural network (CNN) to parameterize the instance-level scoring function, and develop an EM algorithm to alternatively estimate the primary instances (images or image regions) which affect the safety scores and train the proposed network. Our method is capable of localizing interesting images and image regions for each place. We evaluate the proposed method on a newly created dataset and a public dataset. Results with comparisons showed that our method can clearly outperform the alternative perception methods and more importantly, is capable of generating region-level safety scores to facilitate interpretations of the perception process.

Utilizing NLP methods in malware classification or clustering applications is a hotspot in malware analysis. Binary malware embedding has become an important direction and basis for malware analysis. Existing binary malware vectorizing methods cannot extract semantic and functional information simultaneously, which may affect the performance of family clustering. In this paper, a novel feature fusion representation method is proposed based on PV -DM (Paragraph Vector-Distributed Memory) model, and the K-Means algorithm is adopted for family clustering. The method combines the features of program-level API call sequence and function-level instruction sequences by means of PV -DM. The functional and semantic representation capabilities of binary malwares can be improved. Malware public dataset VXHeavon is taken as the dataset. A series of experiments are conducted, using the existing family labels as the clustering accuracy evaluation standard. The results demonstrate that our feature fusion representation method outperforms the baseline method by 4.96% in terms of accuracy.

Open Source Software (OSS) community has attracted a large number of distributed developers to work together, e.g. reporting and discussing issues as well as submitting and reviewing code. OSS developers create links among development units (e.g. issues and pull requests in GitHub), share their opinions and promote the resolution of development units. Although previous work has examined the role of links in recommending high-priority tasks and reducing resource waste, the understanding of the actual usage of links in practice is still limited. To address the research gap, we conduct an empirical study based on the 5W1H model and data mining from five popular OSS projects on GitHub. We find that links originating from a PR are more common than the other three types of links, and links are more frequently created in Documentation. We also find that average duration between development units’ create time in a link is half a year. We observed that link behaviors are very complex and the duration of link increases with the complexity of link structure. We also observe that the reasons of link are very different, especially in P–P and I–I. Finally, future works are discussed in conclusion.

The goal of this paper is to analyze the behavior and intent of recent types of privacy-invasive Android adware. There are two recent trends in this area: more financial (rather than ego) motives, and the development of more dynamic analysis tools. This paper starts with a review of Android mobile operating system security, and also addresses the pros and cons of open source operating system security. Static analysis of malware provides high quality results and leads to a good understanding as shown in this paper. However, as malware grows in number and complexity, there have been recent efforts to automate the detection mechanisms and many of the static tasks. As Android’s market share is rapidly growing around the world, Android security will be a crucial area of research for IT security professionals and their academic counterparts. The upside of the current situation is that malware is being quickly exposed, thanks to open-source software development tools. This cooperation is important in curbing the widespread theft of personal information with monetary value. KeywordsSecurity for Mobile Computing; Privacy Protection; Malware Analysis

Map matching is a widely used technology for mapping tracks to road networks. Typically, tracks are recorded using publicly available Global Navigation Satellite Systems, and road networks are derived from the publicly available OpenStreetMap project. The challenge lies in resolving the discrepancies between the spatial location of the tracks and the underlying road network of the map. Map matching is a combination of defined models, algorithms, and metrics for resolving these differences that result from measurement and map errors. The goal is to find routes within the road network that best represent the given tracks. These matches allow further analysis since they are freed from the noise of the original track, they accurately overlap with the road network, and they are corrected for impossible detours and gaps that were present in the original track. Given the ongoing need for map matching in mobility research, in this work, we present a novel map matching method based on Markov decision processes with Reinforcement Learning algorithms. We introduce the new Candidate Adoption feature, which allows our model to dynamically resolve outliers and noise clusters. We also incorporate an improved Trajectory Simplification preprocessing algorithm for further improving our performance. In addition, we introduce a new map matching metric that evaluates direction changes in the routes, which effectively reduces detours and round trips in the results. We provide our map matching implementation as Open Source Software (OSS) and compare our new approach with multiple existing OSS solutions on several public data sets. Our novel method is more robust to noise and outliers than existing methods and it outperforms them in terms of accuracy and computational speed.

Social Network Analysis (SNA) is a process of investigating the structure of a network. With the contribution of graph theory, it studies the relationships (links) that are established between different units, such as individuals, groups, or organizations (nodes), which are taken as interdependent rather than as autonomous. A social network can be compared to a web, which records the relationships or interactions of people. These networks include the social or professional interactions between units through which information and services are exchanged or contacts are recorded on a systematic basis. In this paper we attempt to introduce SNA in Economic and Regional Development, i.e. to examine the correlation of a regional education statistic indicator between certain regions. Specifically, we study the share of citizens who have completed higher education for the age group 25-64 years by gender and NUTS 2 regions. We present the visualisation of several networks, which are generated based on the degree of correlation of the data, and compute measures of centrality to compare the level of higher education by gender. The aim is to determine whether the application of Social Network Analysis could be an alternative research method in the study of Economic and Regional Development.

An Analysis of the Adoption of Open Source Software by Local Public Administrations: Evidence from the Emilia-Romagna Region of Italy