What you see predicts what you get—lightweight agent‐based malware detection

Wang, Wei; Murynets, Ilona; Bickford, Jeffrey; Wart, Christopher Van; Xu, Gang

doi:10.1002/sec.528

Cited by 13 publications

(5 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Power law, which is also known as the 80:20 rule or Pareto principle, exponential, and log‐normal distributions are addressed in the literature that tends to search for a specific statistical distribution to discover the characteristics of many natural and unnatural phenomena. The example phenomena reflecting these distributions are compiled and categorized from (Limpert et al, 2001; Milojević, 2010; Newman, 2004; White et al, 2008) or other resources with given references as follows: Natural phenomena fitting log‐normal : element concentration in the Earth's crust, latent periods (from infection to the first symptoms) of infectious disease [e.g., the incubation period of Coronavirus disease 2019 (COVID‐19), SARS (severe acute respiratory syndrome), and MERS (Middle East Respiratory Syndrome; Backer et al, 2020)], the abundance of bacteria on plants; Unnatural phenomena fitting log‐normal : number of letters per word, number of words per sentence, age of first marriage in Western; Natural phenomena fitting exponential : damage in nuclear power incidents and accidents before 1980 (Wheatley et al, 2017), moderate‐sized disasters (observed sea‐level variations, wind velocity, annual river floods) (Pisarenko & Rodkin, 2010), the arrival rate of cosmic ray alpha particles or Geiger counter tics (Tobias, 2012); Unnatural phenomena fitting exponential : time to failure patterns (also in natural phenomena) (Frank, 2009), modeling malware propagation delays (Wang & Murynets, 2013), frequency of Korean family names (power law in family names in the world), intervals between aircraft arrivals to major airports (Willemain et al, 2004), the inter‐arrival times of the 911 calls (Albert, 2011), the time between goals in World Cup football matches (Chu, 2003), the dispersion of U.S. incomes which was qualified as a kind of thermal equilibrium (Bartels, 2012); Natural phenomena fitting power law : island sizes, lake sizes, flood magnitudes, species body sizes, individual body sizes (White et al, 2008), basic community structure descriptors (number of species, links, and links per species) with the area (Galiana et al, 2022); and Unnatural phenomena fitting power law : author productivity, citations received by papers, scattering of scientific literature (Milojević, 2010). Component sizes in component‐based software development (Sharma & Pendharkar, 2022).…”

Section: Fitting Binary Feature Frequencies Into a Statistical Distri...mentioning

confidence: 99%

Gaining insights in datasets in the shade of “garbage in, garbage out” rationale: Feature space distribution fitting

Canbek

2022

WIREs Data Min & Knowl

View full text Add to dashboard Cite

This article emphasizes comprehending the “Garbage In, Garbage Out” (GIGO) rationale and ensuring the dataset quality in Machine Learning (ML) applications to achieve high and generalizable performance. An initial step should be added in an ML workflow where researchers evaluate the insights gained by quantitative analysis of the datasets sample and feature spaces. This study contributes towards achieving such a goal by suggesting a technique to quantify datasets in terms of feature frequency distribution characteristics. Hence a unique insight is provided into how the features in the available dataset samples are frequent. The technique was demonstrated in 11 benign and malign (malware) Android application datasets belonging to six academic Android mobile malware classification studies. The permissions requested by applications such as CALL_PHONE compose a relatively high‐dimensional binary feature space. The results showed that the distributions fit well into two of the four long right‐tail statistical distributions: log‐normal, exponential, power law, and Poisson. Precisely, log‐normal was the most exhibited statistical distribution except the two malign datasets that were in exponential. This study also explores statistical distribution fit/unfit feature analysis that enhances the insights in feature space. Finally, the study compiles phenomena examples in the literature exhibiting these statistical distributions that should be considered for interpreting the fitted distributions. In conclusion, conducting well‐formed statistical methods provides a clear understanding of the datasets and intra‐class and inter‐class differences before proceeding with selecting features and building a classifier model. Feature distribution characteristics should be one to analyze beforehand. This article is categorized under: Technologies > Data Preprocessing Technologies > Classification Technologies > Machine Learning

show abstract

Section: Fitting Binary Feature Frequencies Into a Statistical Distri...mentioning

confidence: 99%

Gaining insights in datasets in the shade of “garbage in, garbage out” rationale: Feature space distribution fitting

Canbek

2022

WIREs Data Min & Knowl

View full text Add to dashboard Cite

show abstract

“…A lightweight malware detection system for detecting, analysing and predicting malware propagating via SMS and MMS messages on mobile devices is proposed in [28]. It deploys agents in the form of hidden contacts on the device to capture messages sent from malicious applications.…”

Section: Related Workmentioning

confidence: 99%

Large Iterative Multitier Ensemble Classifiers for Security of Big Data

Abawajy

Kelarev

Chowdhury

2014

IEEE Trans. Emerg. Topics Comput.

View full text Add to dashboard Cite

This paper introduces and investigates large iterative multitier ensemble (LIME) classifiers specifically tailored for big data. These classifiers are very large, but are quite easy to generate and use. They can be so large that it makes sense to use them only for big data. They are generated automatically as a result of several iterations in applying ensemble meta classifiers. They incorporate diverse ensemble meta classifiers into several tiers simultaneously and combine them into one automatically generated iterative system so that many ensemble meta classifiers function as integral parts of other ensemble meta classifiers at higher tiers. In this paper, we carry out a comprehensive investigation of the performance of LIME classifiers for a problem concerning security of big data. Our experiments compare LIME classifiers with various base classifiers and standard ordinary ensemble meta classifiers. The results obtained demonstrate that LIME classifiers can significantly increase the accuracy of classifications. LIME classifiers performed better than the base classifiers and standard ensemble meta classifiers.INDEX TERMS LIME classifiers, ensemble meta classifiers, random forest, big data. 352 2168-6750

show abstract

“…Project Honey Pot [15] employed a web based honeypot network which uses software embedded in web sites to collect information about IPs harvesting e-mail addresses for spam, bulk mailing and fraud. Most recently on the mobile communications front, Collin [16] implemented HoneyDroid, a smartphone honeypot for the Android operating system to catch attacks originating from the Internet, mobile networks, as well as through malicious applications; while Wang [24] introduced fake contacts on mobile devices to quickly detect messaging-based malware propagation in cellular networks. Brian et al [8] proposed trap-based defense mechanisms and a deployment platform for addressing the problem of insiders attempting to exfiltrate and use sensitive information.…”

Section: Related Workmentioning

confidence: 99%

Detecting Targeted Attacks By Multilayer Deception

Wang

Bickford

Murynets

et al. 2013

JCSM

Self Cite

View full text Add to dashboard Cite

Over the past few years, enterprises are facing a growing number of highly customized and targeted attacks that use sophisticated techniques and seek after important company assets, such as customer data and intellectual property. Unlike conventional attacks, targeted attacks are operated by experts who use multiple steps to gain access to sensitive assets, and most of time, leave very few network traces behind for detection. In this paper, we propose a multi-layer deception system that provides an in depth defense against such sophisticated targeted attacks. Specifically, based on previous knowledge and patterns of such attacks, we model the attacker as trying to compromising an enterprise network via multiple stages of penetration and propose defenses at each of these layers using deception based detection. Due to multiple layers of deception, the probability of detecting such an attack will be greatly enhanced. We present a proof of concept implementation of one of the key deception methods proposed. Due to various financial constraints of an enterprise, we also model the design of the deception system as an optimization problem in order to minimize the total expected loss due to system deployment and asset compromise. We find that there is an optimal solution to deploy deception entities, and even over spending budget on more entities will only increase the total expected loss to the enterprise. Such a system Detecting Targeted Attacks by Multilayer Deception 177 phase, gathering information such as the organization background, resources and individual employees to initially target to launch the attack. By using social engineering techniques, such as a spear-phishing email, the attacker attempts to "infiltrate" into the enterprise by using a particular employee as the entry point. This typically requires an employee to fall victim to the social engineering attack, for example by following a web link or opening an attachment that contains some exploit and malicious payload. During this phase of "exploitation", the attacker penetrates a level deeper by gaining control of the employee's personal assets (such as email and personal computer). This may then be used to penetrate another level deeper into the enterprise through manual "exploration" of remote servers (hosting databases, proprietary algorithms, intellectual properties etc.), or to launch additional social engineering attacks against other employees who have access to the information that the attacker seeks to obtain. Some attacks may exploit and gain control of many different servers and machines during the exploration phase to gain a persistent foothold in the enterprise. Once an asset has been obtained, the attacker finally "exfiltrates" the data out of the enterprise network and the attack can be considered successful.This pattern, as mentioned above, reveals that there are three layers of penetration -a human layer, a local asset layer, and a global asset layer. Each layer of penetration brings the attacker closer to the targeted information assets...

show abstract

What you see predicts what you get—lightweight agent‐based malware detection

Cited by 13 publications

References 32 publications

Gaining insights in datasets in the shade of “garbage in, garbage out” rationale: Feature space distribution fitting

Gaining insights in datasets in the shade of “garbage in, garbage out” rationale: Feature space distribution fitting

Large Iterative Multitier Ensemble Classifiers for Security of Big Data

Detecting Targeted Attacks By Multilayer Deception

Contact Info

Product

Resources

About