A framework for detection and prevention of novel keylogger spyware attacks

Wazid, Mohammad; Katal, Avita; Goudar, R. H.; Singh, Devesh Pratap; Tyagi, A.K.; Sharma, Robin; Bhakuni, P.

doi:10.1109/isco.2013.6481194

Cited by 23 publications

(6 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Then the keylogger employs the GetKeyboardState API function to determine information about the Keyboard State Table [4]. Generally this thread contains an infinite loop with another loop inside, which requests every key state by applying this function: if a key is pressed, then it is logged [32].…”

Section: Keyboard State Table Methodsmentioning

confidence: 99%

Mouse Underlaying: Global Key and Mouse Listener Based on an Almost Invisible Window with Local Listeners and Sophisticated Focus

Witte¹

2018

ICST Transactions on Security and Safety

View full text Add to dashboard Cite

Keyloggers are serious threats for computer users both private and commercial. If an attacker is capable of installing this malware on the victim's machine then he or she is able to monitor keystrokes of a user. This keylog contains login information. As a consequence, protection and detection techniques against keyloggers become increasingly better. This article presents the method of Mouse Underlaying for creating a new kind of software based keyloggers. This method is implemented in Java for testing countermeasures concerning keylogger protection, virtual keyboard, signatures and behavior detection by anti-virus programs. Products of various manufacturers are used for demonstration purposes. All of them failed without an exception. In addition, the reasons why these products failed are analyzed, and moreover, measures against Mouse Underlaying are developed based on the demonstration results.

show abstract

Section: Keyboard State Table Methodsmentioning

confidence: 99%

Mouse Underlaying: Global Key and Mouse Listener Based on an Almost Invisible Window with Local Listeners and Sophisticated Focus

Witte¹

2018

ICST Transactions on Security and Safety

View full text Add to dashboard Cite

show abstract

“…The second method, behavior based detection, the main function is to analyze the behavior of either known or unknown spyware [4]. The third method, specification based detection, the process of monitoring programs is involved in executions and detecting the degree of difference from the behavior from the specification [5].…”

Section: Detection Techniquesmentioning

confidence: 99%

Performance and Maintainability Evaluation of Anti-Spyware System

Adel¹,

Zaki²,

Abd³

et al. 2016

IJCA

View full text Add to dashboard Cite

Spyware is somewhat of a silent killer, because its essential task is secretly and quietly monitoring or sending victim's sensitive information to a separate third party. Unfortunately, existing anti-spyware systems lack the ability to cope with the rapid changes in the spyware signatures and programs.The main challenge in recent anti-spyware systems is to design efficient system that able to detect new and unknown spywares in a reasonable time. Furthermore, lack of interest in existing anti-spyware systems reusability. This paper introduces an adaptive anti-spyware system that able to deal with unpredictable discovered spywares on run time and improves the detection accuracy. The proposed system adopts design patterns approach in detecting and classifying spyware, in the sense that, reuse existing systems components in detecting new or unknown spywares without performing changes on these systems' designs. The proposed anti-spyware system can be considered as an engineering product that needs to be verified in terms of performance and maintainability. The aim here is to guarantee the performance of the designed system by defining evaluation methods for assessing the performance and maintainability of this design. Thus, the performance of the proposed system has been evaluated through the adopted data mining evaluation metrics. While, amount of reuse and reusability metrics have been defined to evaluate the proposed system maintainability. General TermsComputer security.

show abstract

“…The detection phase is the comparison of the current system behavior after attack to the normal behavior. The differences between both behaviors are marked as potential threats [5]. The most important advantage of this detection technique is that it is able to find and locate both known and unknown or new instances of spyware.…”

Section: Behavior Based Detectionmentioning

confidence: 99%

Spyware Detection by Extracting and Selecting Features in Executable Files

Sheta¹,

Zaki

Hadad³

2016

The International Conference on Electrical Engineering

View full text Add to dashboard Cite

Spyware detection techniques have been presented using three approaches; signature-based, behavior-based, and specification-based. These approaches failed in detecting new spyware. Data mining is a new approach in detecting spyware that has the ability to detect new spyware or mutated effects of existing spyware. The main challenges in designing anti-spyware systems using data mining techniques are in extracting and selecting the most strong and significant features from spyware data set. In this paper a new approach of extracting and selecting features is proposed. In this approach, the unique features are extracted from all executable files in each class type. Then the selection of the strongest features is done based on the occurrence or the frequency of the features in the data set. The experimental results of the proposed approach outperform all the previous competing approaches.

show abstract

A framework for detection and prevention of novel keylogger spyware attacks

Cited by 23 publications

References 7 publications

Mouse Underlaying: Global Key and Mouse Listener Based on an Almost Invisible Window with Local Listeners and Sophisticated Focus

Mouse Underlaying: Global Key and Mouse Listener Based on an Almost Invisible Window with Local Listeners and Sophisticated Focus

Performance and Maintainability Evaluation of Anti-Spyware System

Spyware Detection by Extracting and Selecting Features in Executable Files

Contact Info

Product

Resources

About