Understanding Evasion Techniques that Abuse Differences Among JavaScript Implementations

Malware variants exhibit polymorphic attacks due to the tremendous growth of the present technologies. For instance, ransomware, an astonishingly growing set of monetary-gain threats in the recent years, is peculiarized as one of the most treacherous cyberthreats against innocent individuals and businesses by locking their devices and/or encrypting their files. Many proposed attempts have been introduced by cybersecurity researchers aiming at mitigating the epidemic of the ransomware attacks. However, this type of malware is kept refined by utilizing new evasion techniques, such as sophisticated codes, dynamic payloads, and anti-emulation techniques, in order to survive against detection systems. This paper introduces RanDetector, a new automated and lightweight system for detecting ransomware applications in Android platform based on their behavior. In particular, this detection system investigates the appearance of some information that is related to ransomware operations in an inspected application before integrating some supervised machine learning models to classify the application. RanDetector is evaluated and tested on a dataset of more 450 applications, including benign and ransomware. Hence, RanDetector has successfully achieved more that 97.62% detection rate with nearly zero false positive.

With the continuous increase in the economic value of new digital currencies represented by Bitcoin, more and more cybercriminals use malicious code to occupy victims system resources and network resources for mining without the victims permission, thereby obtaining cryptocurrency. This type of malicious code named malicious mining code has brought considerable influence and harm to society, enterprises and users. The mining code always conceals the fact that it consumes computer resources in a way that is difficult for ordinary people to discover. This paper proposes a malicious mining code detection method based on feature fusion and machine learning. First, we analyze from static analysis methods and statistical analysis methods to extract multi-dimensional features. Then for multi-dimensional text features, feature vectors are extracted through the n-gram model and TF-IDF, and best feature vectors are selected through the classifier and we fuse these best feature vectors with other statistic features to train our detection model. Finally, automatic detection is performed based on the machine learning framework. The experimental results show that the recognition accuracy of our method can reach 98.0%, its f1 score reach 0.969, and the ROCs AUC reach 0.973.

To expose more users to threats of drive-by download attacks, attackers compromise vulnerable websites discovered by search engines and redirect clients to malicious websites created with exploit kits. Security researchers and vendors have tried to prevent the attacks by detecting malicious data, i.e., malicious URLs, web content, and redirections. However, attackers conceal a part of malicious data with evasion techniques to circumvent detection systems. In this paper, we propose a system for detecting malicious websites without collecting all malicious data. Even if we cannot observe a part of malicious data, we can always observe compromised websites. Since vulnerable websites are discovered by search engines, compromised websites have similar traits. Therefore, we built a classifier by leveraging not only malicious websites but also compromised websites. More precisely, we convert all websites observed at the time of access into a redirection graph and classify it by integrating similarities between its subgraphs and redirection subgraphs shared across malicious, benign, and compromised websites. As a result of evaluating our system with crawling data of 455,860 websites, we found that the system achieved a 91.7% true positive rate for malicious websites containing exploit URLs at a low false positive rate of 0.1%. Moreover, it detected 143 more evasive malicious websites than conventional systems.

By repackaging a malicious code into reverse compiled legitimate mobile code, malware authors can bypass detection step on existing mobile vaccine software using inserting AES-encrypted root exploits to loading some payload from a malicious remote server dynamically. In this case, malicious codes are constantly changing to evade detection steps by continuing its evolution by operating a metamorphic code by adding new propagation vectors, functionality, and stealth techniques to hide its presence and evade the detection of antivirus software. Those metamorphic features are aimed at changing the form of each instance of the malware by using encryption or appended/pre-pended dummy code into internal code of mobile apps. Therefore, we propose a new system to determine and detect metamorphic malicious mobile code by extracting dynamic features activated from Android platform using extended dynamic analysis technique.

By repackaging a malicious code into reverse compiled legitimate mobile code, malware authors can bypass detection step on existing mobile vaccine software using inserting AES-encrypted root exploits to loading some payload from a malicious remote server dynamically. In this case, malicious codes are constantly changing to evade detection steps by continuing its evolution by operating a metamorphic code by adding new propagation vectors, functionality, and stealth techniques to hide its presence and evade the detection of antivirus software. Those metamorphic features are aimed at changing the form of each instance of the malware by using encryption or appended/pre-pended dummy code into internal code of mobile apps. Therefore, we propose a new system to determine and detect metamorphic malicious mobile code by extracting dynamic features activated from Android platform using extended dynamic analysis technique.

The malicious websites used by drive-by download attacks change their behavior for web client environments. To analyze the behavior of malicious websites, the singleenvironment analysis cannot obtain sufficient information. Hence, it is difficult to analyze the whole aspect of malicious websites. Also, the code obfuscation and cloaking are used in malicious websites to avoid to be analyzed their behavior. In this paper, we propose an analyzing method that combines decoding of the obfuscation code with dynamic analysis using multi-environment analysis system in order to analyze the behavior of the malicious websites in detail. Furthermore, we present two approaches to improve the multi-environment analysis. The first one is automation of traffic log analysis to reduce the cost of analyzing huge traffic logs between the environments and malicious websites. The second one is multimodal analysis for finding the URL of malicious websites.

In a centralized cooperative spectrum sensing (CSS) system, it is vulnerable to malicious users (MUs) sending fraudulent sensing data, which can severely degrade the performance of CSS system. To solve this problem, we propose sensing data fusion schemes based on K-medoids and Mean-shift clustering algorithms to resist the MUs sending fraudulent sensing data in this paper. The cognitive users (CUs) send their local energy vector (EVs) to the fusion center which fuses these EVs as an EV with robustness by the proposed data fusion method. Specifically, this method takes a Medoids of all EVs as an initial value and searches for a high-density EV by iteratively as a representative statistical feature which is robust to malicious EVs from MUs. It does not need to distinguish MUs from CUs in the whole CSS process and considers constraints imposed by the CSS system such as the lack of information of PU and the number of MUs. Furthermore, we propose a global decision framework based on fast K-medoids or Mean-shift clustering algorithm, which is unaware of the distributions of primary user (PU) signal and environment noise. It is worth noting that this framework can avoid the derivation of threshold. The simulation results reflect the robustness of our proposed CSS scheme.

One of the major threats on the Internet is Malware — malicious software which intends to harm IT infrastructures and systems. In the context of Internet-of-Things (IoT), the public attention has been particularly drawn to the growing number of malware programs targeting IoT devices and related security in the recent years. Increasingly the malware, being polymorphic or metamorphic, changes behavior or remains inactive until a specific environment changes. These behaviors are the malware's detection evasion techniques to avoid detection and capture. Such highly evasive malicious programs are on the rise, resulting in extensive research efforts needed on evasion countermeasures. However, there is still a lack of a comprehensive and useful taxonomy to classify the existing countermeasures. This work fills the gap by presenting a survey on available malware evasion countermeasures from both academia and industry. Our main goal of proposing this taxonomy is, help to build a scalable classification of evasion countermeasures which will support malware analysis and classification as well as to guide the design of future evasion countermeasures.

Compromised websites that redirect users to malicious websites are often used by attackers to distribute malware. These attackers compromise popular websites and integrate them into a drive-by download attack scheme to lure unsuspecting users to malicious websites. An incident response organization such as a CSIRT contributes to preventing the spread of malware infection by analyzing compromised websites reported by users and sending abuse reports with detected URLs to webmasters. However, these abuse reports with only URLs are not sufficient to clean up the websites; therefore, webmasters cannot respond appropriately to such reports. In addition, it is difficult to analyze malicious websites across different client environments, i.e., a CSIRT and a webmaster, because these websites change behavior depending on the client environment. To expedite compromised website clean-up, it is important to provide fine-grained information such as the precise position of compromised web content, malicious URL relations, and the target range of client environments. In this paper, we propose a method of constructing a redirection graph with context, such as which web content redirects to which malicious websites. Our system with the proposed method analyzes a website in a multi-client environment to identify which client environment is exposed to threats. We evaluated our system using crawling datasets of approximately 2,000 compromised websites. As a result, our system successfully identified compromised web content and malicious URL relations, and the amount of web content and the number of URLs to be analyzed were sufficient for incident responders by 0.8% and 15.0%, respectively. Furthermore, it can also identify the target range of client environments in 30.4% of websites and a vulnerability that has been used in malicious websites by leveraging target information. This fine-grained information identified with our system would dramatically make the daily work of incident responders more efficient.

Rucas over privacy of domain name registration

Botnet is a malicious software that can perform malicious activities, such as (Distributed Denial of Services) DDoS, spamming, phishing, key logging, click fraud, steal personal information and important data, etc. Botnets can replicate themselves without user consent. Several systems of botnet detection have been done by using a machine learning method with feature selection approach. Currently, the creation of dataset feature based on network flow, Domain Name System (DNS) traffic and content based that represent botnet behavior. Unfortunately the dataset for botnet detection is dummy dataset, to implement in machine learning needs extractor tool which is very expensive to buy. Therefore we create our own features extractor. In this paper we propose network flow using connection logs approach on the dataset. First of all we made the data model using pair of source IP (Internet Protocol), destination IP and source port, destination port in a period time to extract new features. To predict the accuracy, the extracted features will be validated using K-Fold Cross Validation with number of k= 10. The results of the validation with six various types of botnet shows the high Precision=98.70%, F-Measure=99.40%, Recall=98.80%, and Accuracy=98.80% for Rule Induction algorithm, while K-Nearest Neighbor is the most stable than all algorithms that achieve precision, Recall, F-measure and accuracy to 98.10% and high speed (50 ms).

Online social networks (OSNs) are continuously suffering from the plague of cross-site scripting (XSS) vulnerabilities. This article presents a contemporary XSS defensive framework for the OSN-based web applications that is completely based on the context type qualifier. The proposed framework executes in two key phases: Context-Aware Sanitization Generator (CASG) and Context-Aware Dynamic Parsing (CADP). The former phase performs the static analysis of HTML document to determine the context of the untrusted JavaScript code. In addition to this, it also injects the context-sensitive sanitizers in the location of the untrusted JavaScript code. The later phase performs the dynamic parsing of HTML document generated by the first phase. The main objective of this phase is to determine the context of the untrusted malicious script code that is statically ambiguous to identify in the first phase. It also performs the sanitization depending on the context identified. The testing and evaluation of proposed framework was done on a tested suite of real-world OSN-based web applications (e.g., HumHub and Elgg). The experimental results revealed that the proposed framework is capable of implementing auto-context aware sanitization on the untrusted JavaScript malicious code with less number of false positives and false negatives. Evaluation outcomes also revealed that the technique has accomplished the untrusted malicious JavaScript code isolation in the HTML document generated by OSN-based web applications for mitigating the effect of XSS worms with less dynamic runtime overhead.

Ransomware is one of the most increasing malwares used by cyber-criminals in recent days. This type of malware uses cryptographic technology that encrypts a user's important files, folders makes the computer systems unusable, holds the decryption key and asks for the ransom from the victims for recovery. The recent ransomware families are very sophisticated and difficult to analyze & detect using static features only. On the other hand, latest crypto-ransomwares having sandboxing and IDS evading capabilities. So obviously, static or dynamic analysis of the ransomware alone cannot provide better solution. In this paper, we will present a Machine Learning based approach which will use integrated method, a combination of static and dynamic analysis to detect ransomware. The experimental test samples were taken from almost all ransomware families including the most recent “WannaCry”. The results also suggest that combined analysis can detect ransomware with better accuracy compared to individual analysis approach. Since ransomware samples show some “run-time” and “static code” features, it also helps for the early detection of new and similar ransomware variants.

This thesis focuses on antivirus evasion techniques. It examines how an antivirus engine operates and studies various evasion methods for each antivirus operation. Subsequently, it investigates the level of difficulty in bypassing an antivirus by manual modification of malware code to escape detection. Finally, several open-sourced antivirus evasion tools are compared against the top award-winning antivirus products to evaluate their effectiveness.

A capability of cloud-based IDS in identifying complicated and anonymous attacks is rising in the current era. However, unwanted delays hinder the detection rate. A malicious user might utilize vast quantities of computational power. The cloud provides to perform attacks both within and without the cloud. Furthermore, there are major challenges for intrusion detection due to the ease of the cloud and also the continual restructuring and movement of cloud resources. Intruder detection, feature extraction, and data processing are all included in the novel optimization-based Intrusion Detection System (IDS) paradigm that will be presented in this study. Data normalization is used to first pre-process the input data. Then, appropriate feature extraction is carried out, including the extraction of (a) raw features, (b) statistical features, then (c) higher-order statistical features using suggested kurtosis. The detection phase is then applied to the retrieved features. A two-stage ensemble method is suggested for finding intruders in clouds. Random forest (RF), Support Vector Machine (SVM), optimal Neural Network (NN), and RNN make up the suggested ensemble technique. The RF, SVM, and Optimized NN algorithms are directly fed the collected features. The output of these classifiers is then provided to the RNN classifier (i.e.), RF output to RNN1, SVM output to RNN2, and optimized NN output to RNN3. Then, the weighted average of RNN 1, 2, and 3 is considered as the final output. A Self Adaptive Salp Swarm Optimization optimizes the weights of NN for exact detection (SA-SSO). Finally, a test is conducted to confirm the developed model’s superiority.