Mitigating Malicious Code

The increasing use of internet and technology today cannot be separated from cybercrime that can threaten its users. The cyber threat like malware attempts to infiltrate the computer or mobile device offline or the internet, chat (online) and anyone can be a potential target. Malware, also known as malicious software, is often used by cybercriminals to achieve their goals by tracking internet activity, capturing sensitive information or block computer access. In the past two years, the more malicious software has been created than in the previous ten years combined. Malware has its own defense system and it is possible to hide from antivirus or even infect the antivirus itself. Malware can be handled by knowing how to work when doing an attack into a computer system. This research aims to analyze malware by using malware sample to better understanding how they can infect computers and devices, the level of threats they pose, and how to protect devices against them.

As per ICH GCP, monitoring can be defined as “The act of overseeing the progress of a clinical trial, and of ensuring that it is conducted, recorded, and reported in accordance with the protocol, Standard Operating Procedures (SOPs), Good Clinical Practice (GCP), and the applicable regulatory requirement(s).” Clinical experiments are important for deeper understanding of how interventions work in humans. The aim of the monitoring of the clinical trial is to avoid errors that may compromise patient safety and results of the trial and enables more frequent monitoring of the integrity of the trial and could improve safety concerns by detecting errors earlier than expected. Risk-based monitoring in clinical trials is the process of identification, assessment, monitoring and mitigation of risks that could affect the quality or safety of a study. Centralized monitoring has a direct impact on the clinical trials. One of the most basic and fundamental need of centralized monitoring is to avoid the repetition in clinical trials, saving both time and Money. Central monitoring greatly influences the Patient safety, data integrity and monitoring costs in a clinical trial. This helps in increasing the effectiveness of the monitoring process reducing the burden on the sponsor. The basic and fundamental priority of a clinical trial is to ensure the safety and well-being of the subject. In this article, we will be focusing on how Centralized monitoring can increase the effectiveness and efficiency of the monitoring process and source data verification (SDV) in clinical trials with a special emphasis on Risk based monitoring (RBM).

Background: The supply chain risk management (SCRM) process is aimed at the implementation of strategies that assist in managing both daily and exceptional risks facing the supply chain through continuous risk assessment to reduce vulnerability and ensure continuity.Purpose: The purpose of the study was to determine whether the SCRM process enables supply chain resilience among grocery manufacturers in South Africa. The fast-moving consumer goods (FMCG)-manufacturing industry faces increased risk because of the nature of their products being perishable with a limited shelf life.Method: This study was conducted using a descriptive qualitative research design. Data were collected by means of 12 semi-structured interviews with senior supply chain practitioners within the South African grocery manufacturing industry.Findings: The study found that most firms informally implement SCRM processes of risk identification, assessment, mitigation and monitoring to mitigate disruptions. Furthermore, the findings indicate that the SCRM processes facilitate resilience among grocery manufacturers in South Africa.Conclusion: The managerial implications show that supply chain managers of grocery manufacturers should formalise the SCRM process and develop risk assessment scales to better prioritise risks in order to run a resilient supply chain. The research contributes to the supply chain management field by adding to the scarce literature relating to SCRM as an enabler of supply chain resilience in a South African context.

To handle the growing flood of malware, security vendors and analysts rely on tools that automatically identify and analyze malicious code. Current systems for automated malware analysis typically follow a dynamic approach, executing an unknown program in a controlled environment (sandbox) and recording its runtime behavior. Since dynamic analysis platforms directly run malicious code, they are resilient to popular malware defense techniques such as packing and code obfuscation. Unfortunately, in many cases, only a small subset of all possible malicious behaviors is observed within the short time frame that a malware sample is executed. To mitigate this issue, previous work introduced techniques such as multipath or forced execution to increase the coverage of dynamic malware analysis. Unfortunately, using these techniques is potentially expensive, as the number of paths that require analysis can grow exponentially. In this paper, we propose REANIMATOR, a novel solution to determine the capabilities (malicious functionality) of malware programs. Our solution is based on the insight that we can leverage behavior observed while dynamically executing a specific malware sample to identify similar functionality in other programs. More precisely, when we observe malicious actions during dynamic analysis, we automatically extract and model the parts of the malware binary that are responsible for this behavior. We then leverage these models to check whether similar code is present in other samples. This allows us to statically identify dormant functionality (functionality that is not observed during dynamic analysis) in malicious programs. We evaluate our approach on thousands of realworld malware samples, and we show that our system is successful in identifying additional, malicious functionality. As a result, our approach can significantly improve the coverage of malware analysis results.

Capacity sharing - the fair usage of the available capacity amongst a set of users - is relying solely on the end user/end hosts in today's Internet. This in principle allows malicious end users to consume disproportional amounts of capacity without obvious ways of stopping or charging them. Re-ECN is a resource sharing framework that enables such resource usage accountability by, amongst other things, employing enforcement points in the network. These are often described as packet droppers at or near the egress of an end-to-end path. This paper presents a packet dropper design that allows implementing the required congestion declaration enforcement efficiently. Our dropper design is based on a hybrid approach providing the effectiveness close to a complete stateful flow monitoring with the efficiency of a more stateless approach. We evaluate the effectiveness and the resource requirements through simulation.

With the rise in the underground Internet economy, automated malicious programs popularly known as malwares have become a major threat to computers and information systems connected to the internet. Properties such as self healing, self hiding and ability to deceive the security devices make these software hard to detect and mitigate. Therefore, the detection and the mitigation of such malicious software is a major challenge for researchers and security personals. The conventional systems for the detection and mitigation of such threats are mostly signature based systems. Major drawback of such systems are their inability to detect malware samples for which there is no signature available in their signature database. Such malwares are known as zero day malware. Moreover, more and more malware writers uses obfuscation technology such as polymorphic and metamorphic, packing, encryption, to avoid being detected by antivirus. Therefore, the traditional signature based detection system is neither effective nor efficient for the detection of zero-day malware. Hence to improve the effectiveness and efficiency of malware detection system we are using classification method based on structural information and behavioral specifications. In this paper we have used both static and dynamic analysis approaches. In static analysis we are extracting the features of an executable file followed by classification. In dynamic analysis we are taking the traces of executable files using NtTrace within controlled atmosphere. Experimental results obtained from our algorithm indicate that our proposed algorithm is effective in extracting malicious behavior of executables. Further it can also be used to detect malware variants.

현재 일반화되어 있는 침입탐지 시스템의 경우 중요한 서버의 보안에 유용한 호스트기반 IDS는 합법적인 사용자의 불법행위를 모니터링 가능하고 운영체계와 밀접히 결합하여 보다 정교한 모니터링, 네트워크 환경과 상관없이 사용가능 하다는 장점이 있지만 비용의 증가와 침입탐지를 위한 처리에 해당 시스템 자원소모, 네트워크 기반의 공격에 취약하며 IDS오류 시 해당 호스트의 기능이 마비될 수 있다. 네트워크기반 IDS는 네트워크 엑세스 지점에만 설치하여 비용점감 및 네트워크 자원에 대한 오버 헤드감소, 공격에 노출될 가능성이 낮으며 네트워크 환경에 관계없이 사용가능하지만 대용량의 트래픽 처리에 어려움과 제한된 탐지능력, 알려지지 않은 악성코드나 프로그램에 대처능력이 떨어지는 한계를 가지고 있다. 본 논문에서는 이러한 보안 솔루션들 중에서 개인용 방화벽을 활용하는 데스크톱 보안과 함께 적용하여 개인용 컴퓨터의 보안능력을 향상시키는 유출 트래픽 분석기반 침입탐지시스템의 설계 및 구현을 목적으로 한다. 침입이 발생하고 새로운 패턴의 악성 프로그램이 정보의 유출을 시도하는 행위를 탐지하여 차단함으로써 컴퓨터나 네트워크의 심각한 손실을 감소시킬 수 있다. An increasing variety of malware, such as worms, spyware and adware, threatens both personal and business computing. Remotely controlled bot networks of compromised systems are growing quickly. This paper proposes an intrusion detection system based outflow traffic analysis. Many research efforts and commercial products have focused on preventing intrusion by filtering known exploits or unknown ones exploiting known vulnerabilities. Complementary to these solutions, the proposed IDS can detect intrusion of unknown new mal ware before their signatures are widely distributed. The proposed IDS is consists of a outflow detector, user monitor, process monitor and network monitor. To infer user intent, the proposed IDS correlates outbound connections with user-driven input at the process level under the assumption that user intent is implied by user-driven input. As a complement to existing prevention system, proposed IDS decreases the danger of information leak and protects computers and networks from more severe damage.

Today, the digital economy is pushing new business models, based on the creation of value chains for data processing, through the interconnection of processes, products, services, software, and things across different domains and organizations. Despite the growing availability of communication infrastructures, computing paradigms, and software architectures that already effectively support the implementation of distributed multi-domain value chains, a comprehensive architecture is still missing that effectively fulfills all related security issues: mutual trustworthiness of entities in partially unknown topologies, identification and mitigation of advanced multi-vector threats, identity management and access control, management and propagation of sensitive data. In order to fill this gap, this work proposes a new methodological approach to design and implement heterogeneous security services for distributed systems that combine together digital resources and components from multiple domains. The framework is designed to support both existing and new security services, and focuses on three novel aspects: (i) full automation of the processes that manage the whole system, i.e., threat detection, collection of information and reaction to attacks and system anomalies; (ii) dynamic adaptation of operations and security tasks to newest attack patterns, and (iii) real-time adjustment of the level of detail of inspection and monitoring processes. The overall architecture as well as the functions and relationships of its logical components are described in detail, presenting also a concrete use case as an example of application of the proposed framework.

There is a clear link between human developmental strides and biodiversity status on the African continent. The link exists in the form of drivers, outlooks, emergent properties and multiple feedback dimensions. To sustainably manage this relationship there is a need to identify priority and critical areas for investment and interventions, such as biodiversity and biome-level conservation area analysis that combines climate change and deforestation threats to ensure the preservation of high-value biodiversity and cultural heritage. The result will manifest in the form of a robust monitoring plan as well as adaptation to and mitigation of key stressors, threats and risks. Most of Africa’s biodiversity is found outside the limit of native and non-native protected areas and continue to face dynamic threats. Development is the main threat and unless it becomes sustainable will harbour generic issues related to limiting biodiversity potentials and increasing the threats to their use and conservation. This book is a collection of works on the potentials, threats and conservation of biodiversity in Africa and is divided into four sections - an introductory section and other sections on the values of biodiversity in Africa, drivers of biodiversity loss in Africa and trends, scenarios and governance in relation to biodiversity conservation in Africa. This introductory chapter presents an overview of perspectives presented in the book toward a common agenda. Many people only know Africa from the perspective of its unique biodiversity and the values of African biodiversity may be considered from two perspectives—either the whole value or the value of the components. The proximate driver of biodiversity loss in Africa may be biological but the ultimate cause is socio-ecological and economic processes. The major reason for this biodiversity loss is not only direct human overexploitation but also due to pollution, urbanization, habitat fragmentation, invasive species, novel diseases and human population growth. A key sustainability target would be to regularly organize public outreach programmes aimed at informing Africa’s populace about the ongoing biodiversity loss. Also, knowledge-based sustainable utilization, strategic monitoring and assessment of threats, and technology-driven innovative conservation practices should be the used to define all future developmental plan that pertains to Africa’s biological resources.KeywordsBiodiversity valueSustainable use of biodiversityBiodiversity conservationHuman developmentAfrica

This paper reports on the design, implementation and real-time operation of advanced process monitoring techniques for wastewater treatment plants. The paper presents the development of a software platform and its implementation in a full-scale wastewater treatment plant. The software platform allows the real-time execution of advanced process monitoring techniques that are used for fault and process upset detection and identification. The statistical methods are part of a supervisory control level that allows for integration of the different facets of process monitoring and control, including fault detection, knowledge extraction and controller action. Results obtained by the real-time execution of such algorithms are presented.

Malware is a man-made evil code, created for manipulative and destructive purpose. The increasing dependence on today's Internet and other communication network has caused a major malware threat to many computer users. The threat can infiltrate computers using a variety of methods, such as hidden functionality in regular programs, drive-by download from unsafe web sites, attack against known software vulnerabilities and more. In this paper, architecture of modern malware scanning engine is proposed and presented. A known packer detector and removal is proposed to build on top of the core engine. Prior begin malware scanning engine, the detection of known packer has to be performed. If any known packer is detected, a dedicated decryption routine will strip out the packer protection. Our malware detection core engine approach is based on the integration of static heuristic, emulator and disassembler. Static heuristic scanner detects malicious program via byte signature identification. It involves static extraction of an executable file and compares the destructive code with dedicated viral signatures. Emulator can execute the arbitrary code of an instance and trace the instance body's code inside the virtual environment. It can be used to combat any protection code, regardless of the complexity of the protection algorithm. Disassembler module will work simultaneously with emulator to analyze the execution code. Fragment of malicious code within the decrypted virus body could be detected via the execution. Through this study, we hope to help security researchers to understand our defense approach and give some directions for future research.

In today's Internet world where everything is interconnected, the misuse of the shared communication channels and the service providers by the malicious users requires all time monitoring. Amongst the various methods being adopted by network attackers, like Distributed Denial of Service (DDoS) attacks, spams, phishing attacks, etc. botnet threats are increasing day-by-day. Detecting botnet attacks is a challenging task. Firstly, botnets are difficult to detect because of stealthy nature of Command & Control protocol. Secondly, different types of bots have varied characteristics and combined with large size of the network traffic their detection becomes a very challenging task. Lastly, network traffic is unlabeled and classification techniques like decision trees cannot be used directly. Moreover with the success of distributed frameworks like Hadoop and Apache Spark it is feasible to handle very large data. In this paper we have used distributed framework to apply semi-supervised machine learning techniques of KMeans clustering for labeling a large dataset and decision trees as classifiers. High accuracy was achieved in prediction of the classes. Novelty of our work is labeling of unlabeled network traffic and classification using efficient distributed frameworks.

Tremendous advances in pervasive networking have enabled wide-area distributed systems to connect distributed resources or users such as corporate data centers and high-performance computing centers. These distributed pervasive systems take advantage of resources and enhance collaborations worldwide. However, due to lack of central management, they are severely threatened by a variety of malicious users in today's Internet. Current reputation- and anonymity-based technologies for node communication enhance system trustworthiness. However, most of these technologies gain trustworthiness at the cost of efficiency degradation. This paper presents a P2P-based infrastructure for trustworthy and efficient node communication in wide-area distributed systems. It jointly addresses trustworthiness and efficiency in its operation in order to meet the high-performance requirements of a diversified wealth of distributed pervasive applications. The infrastructure includes two policies: trust/efficiency-oriented request routing and trust-based adaptive anonymous response forwarding. This infrastructure not only offers a trustworthy environment with anonymous communication but also enhances overall system efficiency through harmonious trustworthiness and efficiency trade-offs. Experimental results from simulations and the real-world PlanetLab testbed show the superior performance of the P2P-based infrastructure in achieving both high trustworthiness and high efficiency in comparison to other related approaches.

Web applications have steadily increased, making them very important in areas, such as financial sectors, e-commerce, e-government, social media network, medical data, e-business, academic an activities, e-banking, e-shopping, e-mail. However, web application pages support users interacting with the data stored in their website to insert, delete and modify content by making a web site their own space. Unfortunately, these activities attracted writers of malicious software for financial gain, and to take advantage of such activities to perform their malicious objectives. This chapter focuses on severe threats to web applications specifically on Structure Query Language Injection Attack (SQLIA) and Zeus threats. These threats could adopt new obfuscation techniques to evade and thwart countermeasures Intrusion Detection Systems (IDS). Furthermore, this work explores and discusses the techniques to detect and prevent web application malware.

This chapter is intended to provide clear guidelines and suggestions for the processes of hazard identification, risk assessment and mitigation. A key priority is the duty of care for the participant or patient, along with the health and safety of the individuals involved in the data collection itself. Safe practices and procedures should underpin all laboratory and field-based activities for several vital reasons. The assessment of risk is the key component of health and safety practice and management. It is about taking reasonable and logical steps to prevent ill health. A full assessment of the first aid needs of specific locations and procedures should be part of a risk assessment. Many institutions that have physiology laboratories will also have a set of standard operating procedures, such as for the procurement of capillary and venous blood samples. Where such documents exist, they should also be used in the development and review of risk assessments.