Detection of Malicious Portable Executables Using Evidence Combinational Theory with Fuzzy Hashing

Namanya, Anitta Patience; Mirza, Qublai Khan Ali; Al-Mohannadi, Hamad; Awan, Irfan; Disso, Jules Ferdinand Pagna

doi:10.1109/ficloud.2016.21

Cited by 10 publications

(10 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…First, objects of the same type are selected by the ObjectType feature of Object. Then, they are compared using FuzzyHash [49,50] using the ObjectHash feature. The idea of such a hash is that it allows you to compare objects with similar content (Algorithm 7).…”

Section: Algorithm For F_6mentioning

confidence: 99%

An Approach for Stego-Insider Detection Based on a Hybrid NoSQL Database

Kotenko

Krasov

Ushakov

et al. 2021

JSAN

View full text Add to dashboard Cite

One of the reasons for the implementation of information security threats in organizations is the insider activity of its employees. There is a big challenge to detect stego-insiders-employees who create stego-channels to secretly receive malicious information and transfer confidential information across the organization’s perimeter. Especially presently, with great popularity of wireless sensor networks (WSNs) and Internet of Things (IoT) devices, there is a big variety of information that could be gathered and processed by stego-insiders. Consequently, the problem arises of identifying such intruders and their transmission channels. The paper proposes an approach to solving this problem. The paper provides a review of the related works in terms of insider models and methods of their identification, including techniques for handling insider attacks in WSN, as well methods of embedding and detection of stego-embeddings. This allows singling out the basic features of stego-insiders, which could be determined by their behavior in the network. In the interests of storing these attributes of user behavior, as well as storing such attributes from large-scale WSN, a hybrid NoSQL database is created based on graph and document-oriented approaches. The algorithms for determining each of the features using the NoSQL database are specified. The general scheme of stego-insider detection is also provided. To confirm the efficiency of the approach, an experiment was carried out on a real network. During the experiment, a database of user behavior was collected. Then, user behavior features were retrieved from the database using special SQL queries. The analysis of the results of SQL queries is carried out, and their applicability for determining the attribute is justified. Weak points of the approach and ways to improve them are indicated.

show abstract

Section: Algorithm For F_6mentioning

confidence: 99%

An Approach for Stego-Insider Detection Based on a Hybrid NoSQL Database

Kotenko

Krasov

Ushakov

et al. 2021

JSAN

View full text Add to dashboard Cite

show abstract

“…Although the detection rates are not high, the scoring approach proposes a method of allowing a malware analyst in classifying malware based on urgency. In the quest to build a more resilient cyber space, this work further explores and expands the approach introduced in [22] and is an extension of our previous work presented in [23].…”

Section: Related Workmentioning

confidence: 99%

Similarity hash based scoring of portable executable files for efficient malware detection in IoT

Namanya

Awan

Disso

et al. 2020

Future Generation Computer Systems

Self Cite

View full text Add to dashboard Cite

The current rise in malicious attacks shows that existing security systems are bypassed by malicious files. Similarity hashing has been adopted for sample triaging in malware analysis and detection. File similarity is used to cluster malware into families such that their common signature can be designed. This paper explores four hash types currently used in malware analysis for portable executable (PE) files. Although each hashing technique produces interesting results, when applied independently, they have high false detection rates. This paper investigates into a central issue of how different hashing techniques can be combined to provide a quantitative malware score and to achieve better detection rates. We design and develop a novel approach for malware scoring based on the hashes results. The proposed approach is evaluated through a number of experiments. Evaluation clearly demonstrates a significant improvement (> 90%) in true detection rates of malware.

show abstract

“…Y. Li proved that the Fuzzy hashing algorithm is practically applicable to malicious code similarity analysis, and that it can be practically used for malicious code similarity analysis by evaluating the fuzzy hashing algorithms in the public malware dataset as a comprehensive framework [1]. AP Namanya proposed a proof-of-concept technique to detect similarity of files based on a similarity percentage between known and unknown to reduce the effect of obfuscation techniques of fuzzy hashing [2]. S. Gupta proposed a framework for linking malicious code with the Fuzzy Hashing algorithm by constructing high-level Category Sequences by extracting Windows API Call Sequences for each malicious code group and mapping the API to 26 categories [3].…”

Section: Similarity Based Malware Analysismentioning

confidence: 99%

Fast k-NN based Malware Analysis in a Massive Malware Environment

2019

KSII TIIS

View full text Add to dashboard Cite

It is a challenge for the current security industry to respond to a large number of malicious codes distributed indiscriminately as well as intelligent APT attacks. As a result, studies using machine learning algorithms are being conducted as proactive prevention rather than post processing. The k-NN algorithm is widely used because it is intuitive and suitable for handling malicious code as unstructured data. In addition, in the malicious code analysis domain, the k-NN algorithm is easy to classify malicious codes based on previously analyzed malicious codes. For example, it is possible to classify malicious code families or analyze malicious code variants through similarity analysis with existing malicious codes. However, the main disadvantage of the k-NN algorithm is that the search time increases as the learning data increases. We propose a fast k-NN algorithm which improves the computation speed problem while taking the value of the k-NN algorithm. In the test environment, the k-NN algorithm was able to perform with only the comparison of the average of similarity of 19.71 times for 6.25 million malicious codes. Considering the way the algorithm works, Fast k-NN algorithm can also be used to search all data that can be vectorized as well as malware and SSDEEP. In the future, it is expected that if the k-NN approach is needed, and the central node can be effectively selected for clustering of large amount of data in various environments, it will be possible to design a sophisticated machine learning based system.

show abstract

Detection of Malicious Portable Executables Using Evidence Combinational Theory with Fuzzy Hashing

Cited by 10 publications

References 10 publications

An Approach for Stego-Insider Detection Based on a Hybrid NoSQL Database

An Approach for Stego-Insider Detection Based on a Hybrid NoSQL Database

Similarity hash based scoring of portable executable files for efficient malware detection in IoT

Fast k-NN based Malware Analysis in a Massive Malware Environment

Contact Info

Product

Resources

About