Ontology Based APT Attack Behavior Analysis in Cloud Computing

At present, APT attack detection has become the focus of the network security protection field. APT attacks are one of the most difficult attacks in cyber attacks. The complexity and variability of APT attack behavior greatly increases the difficulty of attack detection. In order to cope with APT attack, some well-known network security companies at home and abroad have developed a commercial APT intrusion detection system. This highly targeted attack can not be identified by the traditional intrusion detection system. Therefore, in order to deal with this new type of cyber attack. The paper proposes a new method to detect APT attack from different organizations. Data mining algorithm is used to analyze every organization’s APT network attack behavior and obtain association rules, so as to customize the design of the Snort rules and apply them to intrusion detection system. Experiments have shown that the evaluation index of the intrusion detection system using the extended Snort rule is significantly better than the traditional Snort intrusion detection system when detecting the same test data. The precision of the extended Snort intrusion detection system is as high as 98.3%, and the false alarm rate is almost 0, which ultimately achieves the purpose of APT detection.

The relevance of countering the leakage of confidential information in connection with the active digitalization of management processes, the digital economy, and the expansion of remote work has been identified. The emergence and expansion of a new type of rent - confidential information is indicated. Tendencies in the field of leakage of confidential information have been established. The concept of information leakage is given and leakage schemes are modeled. The change in the structure of the impact on information resources is analyzed. The factors of intentional leaks of confidential information are systematized. The classification of losses from leaks of confidential information is carried out. The Dark web forum for selling confidential information is described. The branches and divisions of confidential information leakage are analyzed. A chronological analysis of state structures exposed to the leakage of confidential information was carried out. The international experience in countering the leakage of confidential information is presented. A comparative analysis of the leakage of confidential information in Russia and in the countries of the world by industry, size of organizations, and the nature of information has been carried out.

In the cybersecurity attack and defense space, the “attacker” and the “defender” form a dynamic and symmetrical adversarial pair. Their strategy iterations and capability evolutions have long been in a symmetrical game of mutual restraint. We will introduce modern Intrusion Detection Systems (IDSs) from the defender’s side to counter the techniques designed by the attacker (APT attack). One major challenge faced by IDS is to identify complex attack paths from a vast provenance graph. By constructing an attack behavior tracking graph, the interactions between system entities can be recorded, but the malicious activities of attackers are often hidden among a large number of normal system operations. Although traditional methods can identify attack behaviors, they only focus on the surface association relationships between entities and ignore the deep causal relationships, which limits the accuracy and interpretability of detection. Existing graph anomaly detection methods usually assign the same weight to all interactions, while we propose a Causal Autoencoder for Graph Explanation (CAGE) based on reinforcement learning. This method extracts feature representations from the traceability graph through a graph attention network(GAT), uses Q-learning to dynamically evaluate the causal importance of edges, and highlights key causal paths through a weight layering strategy. In the DARPA TC project, the experimental results conducted on the selected three datasets indicate that the precision of this method in the anomaly detection task remains above 97% on average, demonstrating excellent accuracy. Moreover, the recall values all exceed 99.5%, which fully proves its extremely low rate of missed detections.

Cloud computing creates exciting opportunities like reduced costs and flexibility to the users. It also comprises of some risks like data security within the cloud. Several common security threats like data leakage, insecure API's, and malicious inside users are applicable to cloud computing environment as well. In this paper, the authors consider a cloud computing service where multiple Virtual Machines (VM's) are co-located on the same physical server. In such systems, physical resources are transparently shared by the VMs belonging to multiple users. In systems like these, a malicious user having control of a VM can try to gain control over other VM's resources or utilize all system resources leading to denial of resource attack over other VM users. A malicious user can also try to steal the data of other users located on the same server by compromising hypervisor file system (logical volumes). In this paper, security threats associated with cloud computing environment are evaluated. Authors also explore how such co-existent of VM's can be exploited to gain access over other user's data or deny service and propose constructive security measures that can be deployed to avoid such attacks.

For remote malicious code injection attacks, the analysis of injected code behavior has always been the difficulty of malicious code dynamic analysis. In this paper, a remote code injection behavior analysis method based on code refactoring was proposed. By analyzing the behavior of remote code injection attack, extracting the injection behavior pattern rules, analyzing the malicious code by using the dynamic binary analysis platform, identifying the remote injection behavior in the execution process, obtaining the remote injected malicious data, then refactoring and executing the injected code, and finally triggering the hidden behavior of injected code, this method improves the integrity of malicious code behavior analysis. A series of malicious code samples were also used for experimental analysis. And the results showed that this method can obtain more comprehensive behavior information for malicious code with remote injection, and effectively improve the integrity of malicious code analysis.

In cooperative spectrum sensing, malicious user (MU) sends tampered sensing result in spectrum sensing to pose threats to cognitive radio networks, which is called spectrum sensing data falsification (SSDF) attack. Many existing MU detection schemes are designed for the narrow-band environment. However, Research on MU detection schemes for compressive sensing (CS), which has some huge advantages in sensing wide-band spectrum, is just beginning. Because of the high complex of reconstruction algorithms, it's necessary to identify potential MU and then exclude the MU before reconstructing the original signal in CS. In this paper, we consider attack and defense behavior in CS and propose a density-based MU detection (DBMUD) with a trusted user to distinguish MU precisely. DBMUD maintains reliability even if MUs are a majority. Simulation results demonstrate that DBMUD performs well in fighting against SSDF attack.

The effect of security of health information on patients as well as the society at large cannot be overemphasized. If information gets to the wrong hands, it can lead to various disaster ranging from blackmail, financial loss, stigmatization, medio-legal issues and ultimately death. This research work addresses the problems associated with existing records management system in Federal Teaching Hospital, Ekiti State Nigeria (FETHI), which is manual based. At present, approach to file handling involves junior cadre staff moving files between departments and this is often subject to various degree of mishandling which could lead to loss of important documents, leakage of confidential information among others.The model proposed and implemented in this research addresses the issue of security and privacy in health information system and proffer advantages such as easy storage and retrieval, easy transfer of patients ‘records and it also guarantee confidentiality of information at all stages. The user-friendly web-based system was developed using Hypertext Preprocessor (PHP) as the front –end and MySQL as the backend.

Leakage of confidential information from an organization's networks has become a big threat to its information security. Egress monitoring and filtering have thus become popular for detecting such security breaches. Egress monitoring tools scan outgoing packets for keywords or their combinations present in the confidential documents. These content filtering techniques however fail when the data is encrypted. The solution proposed in this thesis is simple yet an effective approach to prevent information leakage when the data is encrypted. We assume that a policy is in place which disallows encrypted content from specific hosts, ports and applications and wish to detect any violations to this policy. This work aims at analyzing encrypted and unencrypted traffic flows across a gateway and detecting unauthorized encrypted traffic flows. The work discusses a low level approach to detect encryption, based on entropy calculation and packet analysis. The technique is based on the fact that encrypted data consists of a random distribution of symbols whose entropy is expected to be quite high as compared to an unencrypted file. Techniques to differentiate between encrypted and high entropy compressed traffic are also discussed. This thesis implements and compares statistical methods for a fast online detection of encrypted traffic from all the other unencrypted traffic flowing across a network.

An Efficient Android Malware Prediction Using Ensemble machine learning algorithms

Adversarial learning for Mirai botnet detection based on long short-term memory and XGBoost

Currently, there is an active growth in malicious activity in the field of communications. Leakage of confidential information, disruption of various network devices, and a number of other network security issues are issues that need to be actively addressed. At the same time, the means of counteracting malicious activity must comply with modern technologies. Solving the problem of classifying network traffic is one of the ways to protect network devices and communications. This article describes the process of creating an LSTM (Long Short-term Memory) - based application and how to solve the indicated problem.

With the rapid development and widespread use of technology, business processes are being transformed. One of the consequences of the implementation of technologies into the business is the partial transition to remote work, which made it necessary to reflect the corresponding changes in the internal control system (IC). The article is devoted to the analysis of the main shortcomings identified during the transition to the remote mode, in response to which measures are proposed to adapt the IC to the conditions of remote work. The following areas for improvement of the internal control system are identified: communication and comtrol during remote work, fraud and leakage of confidential information, failure of information systems. In response to the identified areas successful practical examples are analyzed and potential measures are proposed in the context of the elements identified in the COSO conceptual framework and methodological documents of the Ministry of Finance of the Russian Federation: control environment, risk assessment, internal control procedures, information and communication, internal control assessment.

: Misinformation, in most cases, is the reconfigured content using basic tools. Fake information related to casualties, infections, contacts, lockdowns, investments, exam schedules, and immigration, leads to confusion, fears, phobophobia, discrimination, harassment, physical injuries, deaths, financial damages, reputational losses, and many more long-lasting side effects. Objective: The aim of this article is to provide an overview of the many ways in which misinformation and information leakage related to COVID-19 can influence the stakeholders, such that it gives policymakers and citizens a greater understanding of both direct and indirect risks and harms when assessing the challenges their countries are facing. Methods: An extensive literature review was done on the prevalence of the COVID-19 related misinformation and its associated significant psychological, reputational, physical, and societal implications on Indians. The novel and possible approaches to fight against the misinformation are described.

Device-to-device (D2D) communications can effectively offload the traffic of cellular system in a distributed way. However, during the data forwarding process, malicious D2D users can intermittently discard data of other users, which seriously affects the data forwarding efficiency. Therefore, a malicious-forwarding-behavior-aware link selection mechanism (MBLS) is proposed in this paper to alleviate the influence of malicious attacks. User behaviors are analyzed according to the correlation between the social relationship and forwarding behavior of users, and the identification of malicious behavior is obtained by Elman neural network. Thus, malicious users can be detected, and then the optimal link can be selected. The simulation results show that the proposed mechanism can effectively detect the malicious behaviors of D2D users, notably improve the reliability of data transmission and significantly enhance the network performance.

Facing the surge in malicious behaviors in the network environment, the existing cybersecurity knowledge graph suffers from fragmented security knowledge and limited application scenarios, making it challenging to collaborative malicious behavior analysis. To address this, we propose a cybersecurity behavior knowledge base (CSBKB) framework for comprehensive malicious behavior analysis. Based on knowledge of user behavior, attack traffic, and attack paths, we construct six types of knowledge graphs to characterize malicious behavior, including user behavior perception, user behavior mapping, malicious behavior association, malicious behavior category, domain attack, and malicious behavior path traceability graph. These graphs characterize malicious behaviors and form a comprehensive security behavior knowledge base. To fully utilize the graph structure information, we design a reasoning module based on the graph neural network further to explore the relationship between entities in the graph. Using DDoS attacks as a case study, we demonstrate this framework's construction and knowledge-reasoning capabilities. Experimental results demonstrate that the proposed CSBKB framework effectively realizes a comprehensive malicious behavior analysis mechanism encompassing "malicious user behavior monitoring, malicious behavior type detection, and malicious behavior path tracing." It can effectively analyze malicious behaviors, with an accuracy of more than 0.97 in detecting abnormal users, more than 0.97 in inferring DDoS attack types, and an identification rate of more than 0.92 for malicious behavior paths.