An Adaptive Tribal Topology for Particle Swarm Optimization

Brezinski, Kenneth; Ferens, Ken

doi:10.1007/978-3-030-70296-0_79

Cited by 1 publication

(1 citation statement)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Autorun, hide, and protect Network: open and listen on a port, communicate over e-mail service, communicate with CnC server Windows Service: terminate windows update, frewall, setup Telnet or SSH Others: hooking keyboard, hiding window, scan for existing vulnerabilities and confguration Code injection usually begins with the usage of thirdpart DLLs or injecting code into a Windows DLL. Malware makes use of Ntdll.exe indirectly to make use of kernel APIs, so checking the stack trace of event activity is important [321]. Malware authors have to balance gaining increased functionality at the cost of rising suspicion, so a careful deliberation of which APIs to use is always in mind [322].…”

Section: Malicious Windows Application Programmingmentioning

confidence: 99%

Metamorphic Malware and Obfuscation: A Survey of Techniques, Variants, and Generation Kits

Brezinski,

Ferens

2023

Security and Communication Networks

View full text Add to dashboard Cite

The competing landscape between malware authors and security analysts is an ever-changing battlefield over who can innovate over the other. While security analysts are constantly updating their signatures of known malware, malware variants are changing their signature each time they infect a new host, leading to an endless game of cat and mouse. This survey looks at providing a thorough review of obfuscation and metamorphic techniques commonly used by malware authors. The main topics covered in this work are (1) to provide an overview of string-scanning techniques used by antivirus vendors and to explore the impact malware has had from a security and monetary perspective; (2) to provide an overview of the methods of obfuscation during disassembly, as well as methods of concealment using a combination of encryption and compression; (3) to provide a comprehensive list of the datasets we have available to us in malware research, including tools to obfuscate malware samples, and to finally (4) discuss the various ways Windows APIs are categorized and vectorized to identify malicious binaries, especially in the context of identifying obfuscated malware variants. This survey provides security practitioners a better understanding of the nature and makeup of the obfuscation employed by malware. It also provides a review of what are the main barriers to reverse-engineering malware for the purposes of uncovering their complexity and purpose.

show abstract

Section: Malicious Windows Application Programmingmentioning

confidence: 99%