Malware detection based on opcode frequency

Traditional malware detection methods cannot keep up with the massive amount of newly created malware quickly and effectively. Machine learning is a promising method for the detection and classification of large-scale newly created malware according to the features of samples. The current research trend is to use machine learning technology, such as the Gradient Boosting Decision Tree (GBDT) and deep neural network technology, to learn newly created malware rapidly and accurately. We propose Control-Flow Graph (CFG)- and Graph Isomorphism Network (GIN)-based malware classification, where we first extract the CFG from portable executable (PE) files and use the large-scale pre-training language model MiniLM to generate the node features of CFG. The extracted CFG is compressed to a feature vector with GIN and classified with Multi-Layer Perceptron. To evaluate our approach, we made a CFG-based malware detection dataset from PE files of the Dike Dataset, which we call the Malware Geometric Dataset (MGD), and collected the results. The evaluation results show that our proposal demonstrated 0.9977 in the Area Under Curve metric and achieved a 97.44 % detection rate when the False Positive Rate was 0.1 %.

This study investigates whether convolutional neural networks (CNNs) trained on visual representations of Portable Executable (PE) files can rival traditional machine learning classifiers trained on engineered features. A dataset of over 200,000 PE files [1] was used to derive two feature sets (Basic and Ember-Lite) [2] and to generate 256x256 greyscale and entropy images [3],[4]. Three CNNs (SimpleCNN, ResNet-18 [5], EfficientNet-B0 [6]) were trained and evaluated against five baselines (Random Forest, XGBoost [7], CatBoost [8], LightGBM, Logistic Regression). Tree-based models with enriched features achieved the highest scores, with CatBoost reaching a ROC-AUC of 0.990. The best CNN, EfficientNet-B0 on entropy images, obtained a ROC-AUC of 0.954. Although CNNs did not surpass feature-based models, they showed competitive results when feature engineering was constrained. These findings indicate that visual approaches offer a promising alternative for static malware detection, particularly when combined with entropy-based representations [9].

Android is the most popular mobile platform today, and it is also the mobile operating system that is most heavily targeted by malware. Existing static analyses are effective in detecting the presence of most malicious code and unwanted information flows. However, certain types of malice are very difficult to capture explicitly by modeling permission sets, suspicious API calls, or unwanted information flows. One important type of such malice is malicious application logic, where a program (often subtly) modifies its outputs or performs actions that violate the expectations of the user. Malicious application logic is very hard to identify without a specification of the normal, expected functionality of the application. We refer to malicious application logic that is executed, or triggered, only under certain (often narrow) circumstances as a logic bomb. This is a powerful mechanism that is commonly employed by targeted malware, often used as part of APTs and state-sponsored attacks: in fact, in this scenario, the malware is designed to target specific victims and to only activate under certain circumstances. In this paper, we make a first step towards detecting logic bombs. In particular, we propose trigger analysis, a new static analysis technique that seeks to automatically identify triggers in Android applications. Our analysis combines symbolic execution, path predicate reconstruction and minimization, and inter-procedural control-dependency analysis to enable the precise detection and characterization of triggers, and it overcomes several limitations of existing approaches. We implemented a prototype of our analysis, called TriggerScope, and we evaluated it over a large corpus of 9,582 benign apps from the Google Play Store and a set of trigger-based malware, including the recently-discovered HackingTeam's RCSAndroid advanced malware. Our system is capable of automatically identify several interesting time-, location-, and SMS-related triggers, is affected by a low false positive rate (0.38%), and it achieves 100% detection rate on the malware set. We also show how existing approaches, specifically when tasked to detect logic bombs, are affected by either a very high false positive rate or false negative rate. Finally, we discuss the logic bombs identified by our analysis, including two previously-unknown backdoors in benign apps.

Executable files such as .exe, .bat, .msi etc. are used to install the software in Windows-based machines. However, downloading these files from untrusted sources may have a chance of having maliciousness. Moreover, these executables are intelligently modified by the anomalous user to bypass antivirus definitions. In this paper, we propose a method to detect malicious executables by analyzing Portable Executable (PE) files extracted from executable files. We trained a supervised binary classifier using features extracted from the PE files of normal and malicious executables. We experimented our method on a large publicly available dataset and reported more than 95% of classification accuracy.

Differential Methylation Profile of Ovarian Cancer in Tissues and Plasma

Malware detection engines are required a high True Positive Rate (TPR) and low False Positive rate (FPR). For example, to obtain the VB100 certification conducted by Virus Bulletin in the U.K., the detector's TPR must be 99.5% or higher, and FPR less than 0.01%. However, it is difficult for signature-based malware detection engines to detect zero-day or new variants of malware. For such malware, an approach based on machine learning is considered effective because the features of specimens are analyzed in a complex manner. Therefore, we created a malware detection model from surface analysis logs, and PE header dumps by machine learning using the FFRI Dataset 2018. Furthermore, we verified the accuracy under the constraint that the FPR is less than a certain value. As a result, we succeeded in creating a new model with high accuracy: when FPR is set to be less than 1%, TPR is 99.7%, when FPR is set to be less than 0.1%, TPR is 98.7%, and when FPR is set to be less than 0.01% and TPR is 94.5%. In addition, we revealed features with high contribution to malware detection in this model.

Accurate oestrus detection is important in order to perform AI and embryo transfer procedures at appropriate times. Pedometers and accelerometers have been utilised in the livestock industry to detect oestrus. However, the efficacy of these devices in beef cattle production systems remains unclear. In this preliminary study, we evaluated the efficacy of a commercially available accelerometer device for oestrus detection in nonlactating Holstein×Japanese Black crossbred cows (n=14). Accelerometer devices (Farmnote Color, Farmnote Inc., Hokkaido, Japan) were placed on the neck of each animal and remained in place for 3 months. Cows were kept in a pen during the day (8-9 cows/pen) and a pasture during the night. Cows were visually monitored for oestrus activity twice daily in the morning and evening for 30min. The activity of cows detected by the sensor was recorded every hour. Oestrus occurrence and duration were automatically detected and calculated by the device. Alerts generated by the device were categorized as either true positives (TP), false positives (FP) or false negatives (FN). True positives were defined as the observation of oestrus in conjunction with a device-generated oestrus alert or confirmation of the presence of a corpus luteum (CL) by ovarian ultrasonography 5 days following an oestrus alert. False positives were defined as events in which an oestrus alert was generated by the device, but no corresponding visual observation of oestrus occurred or a CL was not present 5 days following the alert. False negatives were cases where oestrus was observed visually but there was no corresponding device-generated oestrus alert. Reasons for FP were categorized into 1 of 3 categories defined as (1) other cows in oestrus in the same pen, (2) cows that were moved from other herds, (3) ovarian disorder such as follicular cyst, and (4) unknown. Statistical analyses were conducted using Student’s t-test. Results were considered significant at P<0.05. A total of 58 alerts were generated by the accelerometer devices. The percentage of TP and FP were 46.6 and 53.4%, respectively. Of the FP, 46.7% (14/31) were generated due to other cows in the same pen being in oestrus. During the study, there were 33 visually observed estruses for which there was also a corresponding device alert. Of these, 81.8% were TP and 18.2% were FN. Oestrus duration was significantly longer for TP than for FP (15.5±5.2v. 11.5±3.8 h; P<0.01). In addition, the change in activity at 2-9h after device-generated alerts was greater for TP than for FP (P<0.05). Oestrus duration (15.5h) for TP in the present study was similar to that observed previously by pedometer (16.8h) or temperature measurement (16.3h) in beef cattle (Sakatani et al. 2016 J. Reprod. Dev. 62, 201-207, DOI: 10.1262/jrd.2015-095). These results indicate that accelerometry could be effective for detecting oestrus in beef cattle. However, FP rate was quite high. The FP rate could be decreased by improving the alert detection threshold because the duration and change in activity were lower in FP cows. Further research with a greater number of animals is necessary to confirm these preliminary observations. This study was supported by the Project of the NARO Bio-oriented Technology Research Advancement Institution (AI-Project, The Special Scheme to Create Dynamism in Agriculture, Forestry and Fisheries through Deploying Highly Advanced Technology).

Time-interval temporal patterns can beat and explain the malware

<p>Accessing and retrieving users’ browser and network information is a common practice used by advertisers and many online services to deliver targeted ads and explicit improved services to users belonging to a particular group. They provide a great deal of information about a user’s geographical location, ethnicity, language, culture and general interests. However, in the same way these techniques have proven effective in advertising services, they can be used by attackers to launch targeted attacks against specific user groups. Targeted attacks have been proven more effective against user groups than their blind untargeted counterparts (e.g.spam, phishing). Their detection is more challenging as the detection tools need to be located within the targeted user group. This is one of the challenges faced by security researchers and organisations involved in the detection of new malware and exploits, using client honeypots. Client honeypots are detection systems used in the identification of malicious web sites. The client honeypot needs to mimic users in a pre-defined location, system, network and personality for which the malware is intended. The case is amplified by the use of Browser Exploit Packs/kits (BEPs), supporting these features. BEPs provide simplicity in deployment of targeted malicious web sites. They allow attackers to utilise specific geographical locations, network information, visit patterns or browser header information obtained from a visiting user to determine if a user should be subjected to an attack. Malicious web sites that operate based on targeted techniques can disguise themselves as legitimate web sites and bypass detection. Benign content is delivered to attacker-specified users while avoiding delivery to suspicious systems such as well-known or possible subnets that may host client honeypots. A client honeypot deployed in a single location with a single IP address will fail to detect an attack targeted at users in different demographic and network subnets. Failure in detection of such attacks results in high rates of false negatives which affect all honeypots regardless of detection technique or interaction level. BEPs are hugely popular and most include tracking features. The number of malicious web sites that utilise these features is currently unknown. There are very few studies that have addressed identifying the rate and number of malicious web sites utilising these techniques and no available client honeypot system is currently able to detect them. Any failure to detect these web sites will result in unknown numbers of users being exploited and infected with malware. The false negatives resulting from failing to detect these web sites can incorrectly be interpreted as a decline in the number of attacks. In this work, a study of information that can potentially expose users to targeted attack through a browser is examined through experimental analysis. Concrete approaches by attackers to obtain user-specific information in the deployment of targeted attacks through browsers are discussed and analysed. We propose a framework for designing a client honeypot capable of detecting geolocation attacks. Our framework relies on HAZard and OPerability (HAZOP) studies to identify components of the client honeypot, its processes and attributes of the experimental setup which could potentially introduce bias into our study. Any potential bias neglected, would affect the results of our real-world experiments and undermine our analysis through deviation from the intent of the study. To facilitate in our experiments, we developed a low interaction client honeypoy (YALIH) and performed real-world experiments on large selection of web sites. We determined the popularity of targeted malicious attacks based on likely attributes of a visiting user’s system. Our approach relies on previous research performed in the area of online spam detection which has similar attributes to malicious web sites. Our experiments show that referer, via, X-Forwarded-For and browser language attributes of HTTP protocol header, retrieval behaviour (i.e. IP tracking) and geographical location of a visitor identified by an IP address can be used in a targeted attack. These attributes can have significant effect on the number of detected malicious web sites in a study and should therefore be reliably controlled in an experimental setup. This findings in this research can potentially reduce false negative rates in all types of client honeypots, measurement studies of malicious malicious web sites and help researchers and malware analysts capture and analyse new malware and exploit samples from malicious web sites.</p>

Machine learning based survival prediction of DLBCL: Using multimodal data.

Wavelet decomposition of software entropy reveals symptoms of malicious code

Extra-axillary nodal metastases in breast cancer: comparison of ultrasound, MRI, PET/CT, and CT

The aim of this study was to estimate the incremental budget impact (IBI) of a rapid diagnostic test to detect G6PDd in male patients infected with Plasmodium vivax in the Brazilian Amazon, as compared with the routine protocol recommended in Brazil which does not include G6PDd testing. The budget impact analysis was performed from the perspective of the Brazilian health system, in the Brazilian Amazon for the years 2013, 2014 and 2015. The analysis used a decision model to compare two scenarios: the first consisting of the routine recommended in Brazil which does not include prior diagnosis of dG6PD, and the second based on the use of RDT CareStart™ G6PD (CS-G6PD) in all male subjects diagnosed with vivax malaria. The expected implementation of the diagnostic test was 30% in the first year, 70% the second year and 100% in the third year. The analysis identified negative IBIs which were progressively smaller in the 3 years evaluated. The sensitivity analysis showed that the uncertainties associated with the analytical model did not significantly affect the results. A strategy based on the use of CS-G6PD would result in better use of public resources in the Brazilian Amazon.

Several different types of detectors, software, and hardware designs are employed in instruments used to monitor radioactive content of freight shipments in order to detect illicit trafficking of nuclear materials. The instruments can be container monitors, hand-held radiation detectors, mobile analysis systems, or fixed radiation portal monitors. However, within the various groupings (e.g., portal monitors), all instruments are expected to solve the same problem, that is, to detect and identify any radioactive material present according to the prescribed investigative procedure or CONOPS. The best way to compare the performance of different instruments is with a numerical score or Figure of Merit (FOM). The FOM must quantify the performance of the instrument with respect to true positives (TP), false positives (FP), and false negatives (FN). The minimization of FN for certain radionuclides (e.g., uranium and plutonium or other Special Nuclear Material (SNM)) is more important than the minimization of FN for non-threat nuclides (e.g., low level NORM). In a similar way, the minimization of FP for SNM is more important than falsely reporting the common NORM nuclides which represent no threat. System performance depends on the measurement detail (e.g., transit speed through a portal, measurement time in general, amount and distribution of NORM), therefore the test conditions should also be included in the statement of the FOM. The FOM is expected to vary significantly with the above measurement details. A FOM has been developed based on the number of true positives (TP), the number of false important positives (FIP), the number of FP, the number of true positives for SNM (TPSNM), and the number of false positives for SNM (FPSNM). This formula rates the overall performance with extra weight given to FP and FN for SNM. Examples will be shown for testing of portal monitors.

Malicious software also known as "Malware" is software that uses legitimate instructions or code to perform malicious actions. Malware poses a major threat for computer security and information security in general. Over the years, malware has evolved to the point that a single malware specimen can have hundreds or maybe thousands of variants using polymorphic and metamorphic transformation to change the signature of the malware variant in propagation. The common signature-based malware detection methods are no longer robust to detect these variants due to the alteration of code. Static analysis is required to obtain these signatures and anti-virus companies are required to propagate these signature updates to their software. A faster detection method is needed to compensate the exponentially increasing number of malware variants. Machine learning is a trending approach for malware detection. This removes the need to use signature-based detection and is also faster. Software companies do not need to propagate signatures as often. Machine learning algorithms using opcode sequences can recognise patterns in the malicious code that are not present in common signatures and classify them more efficiently. Therefore, a machine learning approach for malware detection should be adopted for faster and more efficient detection. Most research in malware detection using machine learning used static attributes such as network connections, processes spawned, hashes, etc., that were not that robust to changes. In this paper we introduced our novel approach in using trigrams and PE file attributes as features for malware detection. We took a text mining approach to make our detection method more robust to polymorphism and metamorphism. The instruction sequence for critical code in malware on the assembly level is basically the same across malware families. We used opcode trigram sequences as the main feature for our machine learning algorithm. We used Support Vector Machine(SVM) as our classifying algorithm which is a discriminative classifier model that gives a definite decision whether the predicted outcome belongs to the learned class or not. The above shows our novel approach that enabled us to get higher detection rates with less features.