Remote Injected Code Behavior Analysis using Code Refactor

It is pretty well known that insecure code updating procedures for Android allow remote code injection attack. However, other than codes, there are many resources in Android that have to be updated, such as temporary files, images, databases, and configurations (XML and JSON). Security of update procedures for these resources is largely unknown. This paper investigates general conditions for remote code injection attacks on these resources. Using this, we design and implement a static detection tool that automatically identifies apps that meet these conditions. We apply the detection tool to a large dataset comprising 9,054 apps, from three different types of datasets: official market, third-party market, and preinstalled apps. As a result, 97 apps were found to be potentially vulnerable, with 53 confirmed as vulnerable to remote code injection attacks.

Recent cyberattacks targeting Supervisory Control and Data Acquisition (SCADA)/Industrial Control System(ICS) exploit weaknesses of host system software environment and take over the control of host processes in the host of the station network. We analyze the attack path of these attacks, which features how the attack hijacks the host in the network and compromises the operations of field device controllers. The paper proposes a host-based protection method, which can prevent malware penetration into the process memory by code injection attacks. The method consists of two protection schemes. One is to prevent file-based code injection such as DLL injection. The other is to prevent fileless code injection. The method traces changes in memory regions and determine whether the newly allocated memory is written with malicious codes. For this method, we show how a machine learning method can be adopted.

Program code in a computer system can be altered either by malicious security attacks or by various faults in microprocessors. At the instruction level, all code modifications are manifested as bit flips. In this paper, we present a generalized methodology for monitoring code integrity at run-time in application-specific instruction-set processors. We embed monitoring microoperations in machine instructions, so the processor is augmented with a hardware monitor automatically. The monitor observes the processor's execution trace at run-time, checks whether it aligns with the expected program behavior, and signals any mismatches. Since the monitor works at a level below the instructions, the monitoring mechanism cannot be bypassed by software or compromised by malicious users. We discuss the ability and limitation of such monitoring mechanism for detecting both soft errors and code injection attacks. We propose two different schemes for managing the monitor, the operating system (OS) managed and application controlled, and design the constituent components within the monitoring architecture. Experimental results show that with an effective hash function implementation, our microarchitectural support can detect program code integrity compromises at a high probability with small area overhead and little performance degradation.

To handle the growing flood of malware, security vendors and analysts rely on tools that automatically identify and analyze malicious code. Current systems for automated malware analysis typically follow a dynamic approach, executing an unknown program in a controlled environment (sandbox) and recording its runtime behavior. Since dynamic analysis platforms directly run malicious code, they are resilient to popular malware defense techniques such as packing and code obfuscation. Unfortunately, in many cases, only a small subset of all possible malicious behaviors is observed within the short time frame that a malware sample is executed. To mitigate this issue, previous work introduced techniques such as multipath or forced execution to increase the coverage of dynamic malware analysis. Unfortunately, using these techniques is potentially expensive, as the number of paths that require analysis can grow exponentially. In this paper, we propose REANIMATOR, a novel solution to determine the capabilities (malicious functionality) of malware programs. Our solution is based on the insight that we can leverage behavior observed while dynamically executing a specific malware sample to identify similar functionality in other programs. More precisely, when we observe malicious actions during dynamic analysis, we automatically extract and model the parts of the malware binary that are responsible for this behavior. We then leverage these models to check whether similar code is present in other samples. This allows us to statically identify dormant functionality (functionality that is not observed during dynamic analysis) in malicious programs. We evaluate our approach on thousands of realworld malware samples, and we show that our system is successful in identifying additional, malicious functionality. As a result, our approach can significantly improve the coverage of malware analysis results.

Mobile Cloud Computing is a combination of Mobile Computing, Cloud Computing and wireless networks to convey rich computational resources to mobile users, network operators, as well as cloud computing providers. Nowadays, the market of mobile devices and its applications are growing at an alarming speed. In general, single application for a specific purpose is not compatible to different operating systems. So the developer has to develop various versions of application which is compatible to different platforms. In order to overcome the drawback of compatibility and interoperability issues, HTML5-based mobile applications are built by using standard web technologies. HTML5-based mobile applications support same version of application in different platforms, but these applications are vulnerable to attacks because of the data and code being fused together. A new form of Code Injection Attack found in this type of mobile applications inherits the property of XSS attack and also uses many channels to inject malicious code such as Contact, SMS, WIFI, NFC, Barcode etc. This allows the attacker to inject malicious code to exhaust all the resources of the victim. Therefore, security is the major issue which impedes the development of Mobile Cloud Computing. This paper surveys the malicious code injection attacks in Mobile Cloud Computing environment and the possible solutions.

Simulation and economic evaluation of a coupled thermal vapor compression desalination process for produced water management

The Android platform, with a large market share from its inclusive openness, faces a big problem with repackaging attacks, because reverse engineering is made easy due to the signature method that allows self-sign and also due to application structure. A repackaging attack is a method of attack, where an attacker with malicious intent alters an application distributed on the market to then redistribute it. The attacker injects into the original application illegal advertisement or malicious code that extracts personal information, and then redistributes the app. To protect against such repackaging attacks, obfuscation methods and tampering detection schemes to prevent application analysis are being developed and applied to Android applications. However, through dynamic analysis, protection methods at the managed code can be rendered ineffective, and there is a need for a protection method that will address this. In this paper, we show that, using Dalvik monitor, protection methods at the managed code level can be dynamically analyzed. In addition, to prevent a tampered application from running, we propose a tampering detection scheme that uses a dynamic attestation platform. It consist of two phases; (1) detection code injection: inject tamper detecting code into an application and (2) code attestation: attest the injected code on the platform. The proposed scheme first uses the tamper detection method at the platform level to inspect execution codes executed in real time and to fundamentally intercept repackaged applications.

Web applications make life more convenient. Many web applications have several kinds of user input (e.g. personal information, a user"s comment of commercial goods, etc.) for the activities. On the other hand, there are a range of vulnerabilities in the input functions of Web applications. Malicious actions can be attempted using the free accessibility of many web applications. Attacks by the exploitation of these input vulnerabilities can be achieved by injecting malicious web code; it enables one to perform a variety of illegal actions, such as SQL Injection Attacks (SQLIAs) and Cross Site Scripting (XSS). These actions come down to theft, replacing personal information, or phishing. The existing solutions use a parser for the code, are limited to fixed and very small patterns, and are difficult to adapt to variations. A machine learning method can give leverage to cover a far broader range of malicious web code and is easy to adapt to variations and changes. Therefore, this paper suggests the adaptable classification of malicious web code by machine learning approaches for detecting the exploitation user inputs. The approach usually identifies the “looks-like malicious” code for real malicious code. More detailed classification using sequence information is also introduced. The precision for the “looks-like malicious code” is 99% and for the precise classification with sequence is 90%.

The malicious code on the network is increasingly rampant that the traditional detection method of characteristic code has been difficult to deal with malicious code, with features of various variants, deformations and other problems. In this paper we present a new static analysis model based on software fingerprint to distinguish malicious codes. Through obtaining the software call graph by disassembling the binary file and mapping it as an image, shape moments can be obtained as the software fingerprint based on the retrieval theory of content image, combined with moment theory and the image's color, texture and shape features. The idea of pattern matching is used to measure the extracted software fingerprint similarity to determine whether it is malicious code or not. Then, we analyze the collected program samples. Test and verify whether the program has good performance in uniqueness, invariability and sensibility. With the rapid popularization of Internet and corporate information technology acceleration, the computer is a great convenience to people's lives, whether it is shopping, leisure or work and more obvious the importance of the Internet, but due to the openness of the Internet and flexible application and operating system vulnerability so that people can enjoy the benefits brought by the computer at the same time, also is experiencing distress and abuse of all kinds of malicious code threats to network security events increased year by year. Network security incidents, the most serious harm caused by malicious code, causing huge economic losses to the country as a whole, society and the individual, information security has become a major challenge facing. Domestic and foreign researchers turned to the semantics of malicious code, trying to judge the signatures of the two deformation malicious code through the instruction-level semantics rather than program syntax, further can determine whether the deformation of the malicious code. Trying to evade detection of malicious code, malicious codes are disassembled and for standardization or stack analysis system call for the use of fuzzy transformation technology to discriminate. In recent years, the researchers also uses malicious code detection technology engineering methodology, based on feature detection based on the application of malicious code detection technology based on data mining and machine learning. However, while foreign research scholars during the malicious code detection and anti-virus software R & D, the attacker malicious code using anti-debugging techniques, anti-Hook technology, to detect whether the code being debugged, the to find themselves debugger or analysis environment, malicious code using fuzzy transform technique and a series of anti-debugging measures show some non-anomalous behavior of the code, so as to protect their own purposes. In this process, we need manually assistive technology. Most automated virus analysis software only to capture some of the behavior, security experts need further analysis and screening of experimental results, and finally determine the extent of the harm of malicious behavior. In summary, the malicious code on the network more and more rampant code detection method for the traditional characteristics of difficult to deal with malicious code variants, deformation problem, solve the problem of the detection of unstable deformation caused due to malicious code upgrade has become a research focus and difficulty, but also of the issues that must be resolved key issues.

In cooperative spectrum sensing, malicious user (MU) sends tampered sensing result in spectrum sensing to pose threats to cognitive radio networks, which is called spectrum sensing data falsification (SSDF) attack. Many existing MU detection schemes are designed for the narrow-band environment. However, Research on MU detection schemes for compressive sensing (CS), which has some huge advantages in sensing wide-band spectrum, is just beginning. Because of the high complex of reconstruction algorithms, it's necessary to identify potential MU and then exclude the MU before reconstructing the original signal in CS. In this paper, we consider attack and defense behavior in CS and propose a density-based MU detection (DBMUD) with a trusted user to distinguish MU precisely. DBMUD maintains reliability even if MUs are a majority. Simulation results demonstrate that DBMUD performs well in fighting against SSDF attack.

Due to the portability advantage, HTML5-based mobile apps are getting more and more popular.Unfortunately, the web technology used by HTML5-based mobile apps has a dangerous feature, which allows data and code to be mixed together, making code injection attacks possible. In this paper, we have conducted a systematic study on this risk in HTML5-based mobile apps. We found a new form of code injection attack, which inherits the fundamental cause of Cross-Site Scripting attack~(XSS), but it uses many more channels to inject code than XSS. These channels, unique to mobile devices, include Contact, SMS, Barcode, MP3, etc. To assess the prevalence of the code injection vulnerability in HTML5-based mobile apps, we have developed a vulnerability detection tool to analyze 15,510 PhoneGap apps collected from Google Play. 478 apps are flagged as vulnerable, with only 2.30\% false-positive rate. We have also implemented a prototype called NoInjection as a Patch to PhoneGap in Android to defend against the attack.

This paper proposes a methodology to develop countermeasures against code injection attacks, and validates the methodology by working out a specific countermeasure. This methodology is based on modeling the execution environment of a program. Such a model is then used to build countermeasures. The paper justifies the need for a more structured approach to protect programs against code injection attacks: we examine advanced techniques for injecting code into C and C++ programs and we discuss state-of-the-art (often ad hoc) approaches that typically protect singular memory locations. We validate our methodology by building countermeasures that prevent attacks by protecting a broad variety of memory locations that may be used by attackers to perform code injections. The paper evaluates our approach and discusses ongoing and future work.

Code injection is one of the top cyber security attack vectors in the modern world. To overcome the limitations of conventional signature-based detection techniques, and to complement them when appropriate, multiple machine learning approaches have been proposed. While analysing these approaches, the surveys focus predominantly on the general intrusion detection, which can be further applied to specific vulnerabilities. In addition, among the machine learning steps, data preprocessing, being highly critical in the data analysis process, appears to be the least researched in the context of Network Intrusion Detection, namely in code injection. The goal of this survey is to fill in the gap through analysing and classifying the existing machine learning techniques applied to the code injection attack detection, with special attention to Deep Learning. Our analysis reveals that the way the input data is preprocessed considerably impacts the performance and attack detection rate. The proposed full preprocessing cycle demonstrates how various machine-learning-based approaches for detection of code injection attacks take advantage of different input data preprocessing techniques. The most used machine learning methods and preprocessing stages have been also identified.

Device-to-device (D2D) communications can effectively offload the traffic of cellular system in a distributed way. However, during the data forwarding process, malicious D2D users can intermittently discard data of other users, which seriously affects the data forwarding efficiency. Therefore, a malicious-forwarding-behavior-aware link selection mechanism (MBLS) is proposed in this paper to alleviate the influence of malicious attacks. User behaviors are analyzed according to the correlation between the social relationship and forwarding behavior of users, and the identification of malicious behavior is obtained by Elman neural network. Thus, malicious users can be detected, and then the optimal link can be selected. The simulation results show that the proposed mechanism can effectively detect the malicious behaviors of D2D users, notably improve the reliability of data transmission and significantly enhance the network performance.

The proliferation of malicious users on social platforms poses significant financial and psychological threats, with activities ranging from scams to the dissemination of illicit content. Existing malicious user prediction comprises supervised and self-supervised learning methods. However, the former relies on extensive labeled malicious users for training, while the latter typically focuses on one form of malicious activity and depends heavily on manually crafted rules and features during pre-training. Moreover, existing pre-training methods fail to effectively capture the crucial repetitive and sporadic behavior patterns of malicious users. To address these limitations, we propose a Malicious User Behavior Pre-training framework (MaP) to build pre-trained behavior models. MaP integrates malicious pattern recognition with behavior consistency augmentation and local disruption augmentation strategies for contrastive learning to capture repetitive and sporadic malicious patterns, respectively. We instantiate MaP on a billion-level behavior pre-training scenario within an industry context. Both online and offline evaluations validate the superior performance of MaP in malicious user detection and classification.