The Experts below are selected from a list of 285 Experts worldwide ranked by ideXlab platform
Antonella Santone - One of the best experts on this subject based on the ideXlab platform.
-
towards an interpretable deep learning model for mobile malware detection and family identification
Computers & Security, 2021Co-Authors: Giacomo Iadarola, Francesco Mercaldo, Fabio Martinelli, Antonella SantoneAbstract:Abstract Mobile devices are pervading everyday activities of our life. Each day we store a plethora of sensitive and private information in smart devices such as smartphones or tablets, which are typically equipped with an always-on internet connection. These information are of interest for malicious writers that are developing more and more aggressive harmful code for stealing sensitive and private information from mobile devices. Considering the weaknesses exhibited from current Antimalware signature-based detection, in this paper we propose a method relying on application representation in terms on images used to input an explainable deep learning model designed by authors for Android malware detection and family identification. Moreover, we show how the explainability can be considered from the analyst to assess different models. Experimental results demonstrated the effectiveness of the proposed method, obtaining an average accuracy ranging from 0.96 to 0.97; we evaluated 8446 Android samples belonging to six different malware families and one more family for trusted samples, by providing also interpretability about the predictions performed by the model.
-
Evaluating model checking for cyber threats code obfuscation identification
Journal of Parallel and Distributed Computing, 2018Co-Authors: Fabio Martinelli, Francesco Mercaldo, Antonella Santone, Vittoria Nardone, Arun Kumar Sangaiah, Aniello CimitileAbstract:Abstract Code obfuscation is a set of transformations that make code programs harder to understand. The goal of code obfuscation is to make reverse engineering of programs infeasible, while maintaining the logic on the program. Originally, it has been used to protect intellectual property. However, recently code obfuscation has been also used by malware writers in order to make cyber threats easily able to evade Antimalware scanners. As a matter of fact, metamorphic and polymorphic viruses exhibit the ability to obfuscate their code as they propagate. In this paper we propose a model checking-based approach which is able to identify the most widespread obfuscating techniques, without making any assumptions about the nature of the obfuscations used. We evaluate the proposed method on a real-world dataset obtaining an accuracy equal to 0.9 in the identification of obfuscation techniques.
-
formal methods meet mobile code obfuscation identification of code reordering technique
Workshops on Enabling Technologies: Infrastracture for Collaborative Enterprises, 2017Co-Authors: Aniello Cimitile, Francesco Mercaldo, Fabio Martinelli, Vittoria Nardone, Antonella SantoneAbstract:Android represents the most widespread mobile environment. This increasing diffusion is the reason why attackers are attracted to develop malware targeting this platform. Malware writers usually use code obfuscation techniques in order to evade the current Antimalware detection and to generate new malware variants. These techniques make code programs harder to understand and they change the signature of the application making ineffective the signature extraction work. We propose a method based on formal methods able to identify whether a mobile application is obfuscated. In this preliminary work we identify one of the most widespread obfuscation technique: the code reordering. We test our method on a real-world dataset composed by Android trusted and ransomware samples, obtaining encouraging results.
-
model checking for mobile android malware evolution
Formal Methods, 2017Co-Authors: Aniello Cimitile, Francesco Mercaldo, Fabio Martinelli, Antonella Santone, Vittoria Nardone, Gigliola VagliniAbstract:Software engineering researchers have largely demonstrated that newer versions of software make use of previous versions. No exception to this rule for the so-called malicious software, that frequently evolves in order to evade the detection by Antimalware. As matter of fact, mobile malicious programs, such as trojans, are frequently related to previous malware through evolutionary relationships. Discovering those relationships and constructing a phylogenetic model is expected to be helpful for analyzing new malware and for establishing a principled naming scheme. In this paper we propose a model checking based method to infer mobile malware phylogenetic trees. We demonstrate, implementing our approach in the droid-Sapiens tool, that mobile malware families come from an ancestor and they influence own descendant, basing on the payload that they exhibit.
Francesco Mercaldo - One of the best experts on this subject based on the ideXlab platform.
-
towards an interpretable deep learning model for mobile malware detection and family identification
Computers & Security, 2021Co-Authors: Giacomo Iadarola, Francesco Mercaldo, Fabio Martinelli, Antonella SantoneAbstract:Abstract Mobile devices are pervading everyday activities of our life. Each day we store a plethora of sensitive and private information in smart devices such as smartphones or tablets, which are typically equipped with an always-on internet connection. These information are of interest for malicious writers that are developing more and more aggressive harmful code for stealing sensitive and private information from mobile devices. Considering the weaknesses exhibited from current Antimalware signature-based detection, in this paper we propose a method relying on application representation in terms on images used to input an explainable deep learning model designed by authors for Android malware detection and family identification. Moreover, we show how the explainability can be considered from the analyst to assess different models. Experimental results demonstrated the effectiveness of the proposed method, obtaining an average accuracy ranging from 0.96 to 0.97; we evaluated 8446 Android samples belonging to six different malware families and one more family for trusted samples, by providing also interpretability about the predictions performed by the model.
-
Extinguishing Ransomware - A Hybrid Approach to Android Ransomware Detection
Foundations and Practice of Security, 2018Co-Authors: Alberto Ferrante, Francesco Mercaldo, Miroslaw Malek, Fabio Martinelli, Jelena MilosevicAbstract:Mobile ransomware is on the rise and effective defense from it is of utmost importance to guarantee security of mobile users’ data. Current solutions provided by Antimalware vendors are signature-based and thus ineffective in removing ransomware and restoring the infected devices and files. Also, current state-of-the art literature offers very few solutions to effectively detecting and blocking mobile ransomware. Starting from these considerations, we propose a hybrid method able to effectively counter ransomware. The proposed method first examines applications to be used on a device prior to their installation (static approach) and then observes their behavior at runtime and identifies if the system is under attack (dynamic approach). To detect ransomware, the static detection method uses the frequency of opcodes while the dynamic detection method considers CPU usage, memory usage, network usage and system call statistics. We evaluate the performance of our hybrid detection method on a dataset that contains both ransomware and legitimate applications. Additionally, we evaluate the performance of the static and dynamic stand-alone methods for comparison. Our results show that although both static and dynamic detection methods perform well in detecting ransomware, their combination in a form of a hybrid method performs best, being able to detect ransomware with 100% precision and having a false positive rate of less than 4%.
-
Evaluating model checking for cyber threats code obfuscation identification
Journal of Parallel and Distributed Computing, 2018Co-Authors: Fabio Martinelli, Francesco Mercaldo, Antonella Santone, Vittoria Nardone, Arun Kumar Sangaiah, Aniello CimitileAbstract:Abstract Code obfuscation is a set of transformations that make code programs harder to understand. The goal of code obfuscation is to make reverse engineering of programs infeasible, while maintaining the logic on the program. Originally, it has been used to protect intellectual property. However, recently code obfuscation has been also used by malware writers in order to make cyber threats easily able to evade Antimalware scanners. As a matter of fact, metamorphic and polymorphic viruses exhibit the ability to obfuscate their code as they propagate. In this paper we propose a model checking-based approach which is able to identify the most widespread obfuscating techniques, without making any assumptions about the nature of the obfuscations used. We evaluate the proposed method on a real-world dataset obtaining an accuracy equal to 0.9 in the identification of obfuscation techniques.
-
formal methods meet mobile code obfuscation identification of code reordering technique
Workshops on Enabling Technologies: Infrastracture for Collaborative Enterprises, 2017Co-Authors: Aniello Cimitile, Francesco Mercaldo, Fabio Martinelli, Vittoria Nardone, Antonella SantoneAbstract:Android represents the most widespread mobile environment. This increasing diffusion is the reason why attackers are attracted to develop malware targeting this platform. Malware writers usually use code obfuscation techniques in order to evade the current Antimalware detection and to generate new malware variants. These techniques make code programs harder to understand and they change the signature of the application making ineffective the signature extraction work. We propose a method based on formal methods able to identify whether a mobile application is obfuscated. In this preliminary work we identify one of the most widespread obfuscation technique: the code reordering. We test our method on a real-world dataset composed by Android trusted and ransomware samples, obtaining encouraging results.
-
model checking for mobile android malware evolution
Formal Methods, 2017Co-Authors: Aniello Cimitile, Francesco Mercaldo, Fabio Martinelli, Antonella Santone, Vittoria Nardone, Gigliola VagliniAbstract:Software engineering researchers have largely demonstrated that newer versions of software make use of previous versions. No exception to this rule for the so-called malicious software, that frequently evolves in order to evade the detection by Antimalware. As matter of fact, mobile malicious programs, such as trojans, are frequently related to previous malware through evolutionary relationships. Discovering those relationships and constructing a phylogenetic model is expected to be helpful for analyzing new malware and for establishing a principled naming scheme. In this paper we propose a model checking based method to infer mobile malware phylogenetic trees. We demonstrate, implementing our approach in the droid-Sapiens tool, that mobile malware families come from an ancestor and they influence own descendant, basing on the payload that they exhibit.
Universidad De La Sabana - One of the best experts on this subject based on the ideXlab platform.
-
Campus Estudiantes. Periódico Universidad de La Sabana / Edición 1401
Universidad de La Sabana Consejo Editorial, 2017Co-Authors: Universidad De La SabanaAbstract:10 páginasEsta edición contiene los siguientes títulos: Alianza de alto nivel para construir la paz / ¡El Poporo de Oro es nuestro otra vez! / Salvando vidas, cambiando el mundo desde Kenia / "Me motivó a pensar lo que se puede hacer por servir" -Juan Pablo Soche / La Nueva Cara de la Clínica / Siempre protegidos / Seminario Permanente de Ingeniería y Biociencias de marzo / CREA: Una nueva forma de estudiar / Estudiantes del programa de Ciencias Políticas en IMUN 2017 / Creaividad y curiosidad, claves a la hora de investigar / Participa en los premios Everis 2017 / Internacionalización. El país de la semana: Italia / Salidas académicas internacionales de la EICEA / De Argentina a Colombia:el programa de Fisioterapia traspasa fronteras / Profesionales para el entorno digital / Alumni Sabana expande el camino laboral de sus graduados / Nueva solución Antimalware / Semana Santa en Popayán / Haciendo de La Sabana un segundo hogar / Semana de Estilos de Vida Saludable / XIII concurso de cuento corto
-
Campus Empleados. Periódico Universidad de La Sabana / Edición 1402
Universidad de La Sabana Consejo Editorial, 2017Co-Authors: Universidad De La SabanaAbstract:10 páginasEsta edición contiene los siguientes títulos: ¡El Poporo de Oro es nuestro otra vez! / La Sabana en los medios: febrero / Negro, el color de la tradición y la inclusión / ""Es en la prudencia donde surgen las mejores decisiones"" / Libros a la mano y sin que te pesen / Y a la Biblioteca, ¿qué libros han llegado? / 14va sesión del Club de lectura para el personal administrativo / Participa en los Premios Everis 2017 / La Asociación Universitaria Iberoamericana de Postgrado apoya la movilidad entre universidades /Programa iberoamericano apoya la conformación de redes de investigación / Evite ser víctima de ciberacoso, por Cristina Henning Manzuoli / Reconocimiento: Jairo Ernesto Guzmán Piñeros, Director de Profesores y Estudiantes -25 años de servicios prestados; Luis Mauricio Agudelo Otálora, Profesor Facultad de Ingeniería -20 años de servicios prestados; Gloria Estrella Rivera,Auxiliar de Aseo-20 años de servicios prestados; Campañas de renovación de pólizas / No pases por alto un esguince de tobillo / La relación médico-paciente: por encima de las reformas en el sistema de salud, por Juan Guillermo Ortiz Martínez / Todos tenemos una misión, ¿cuál es la tuya? / ¿SabÍas que... / Jornada de vacunación / Del perdón a la paz, exposición de arte / Nueva solución Antimalware
-
Campus Empleados. Periódico Universidad de La Sabana / Edición 1400
Universidad de La Sabana Consejo Editorial, 2017Co-Authors: Universidad De La SabanaAbstract:10 páginasEsta edición contiene los siguientes títulos: Alianza de alto nivel para construir la paz / La Sabana presentó el portafolio institucional de estudios de paz y lideró el diálogo sobre el desarrollo de la infancia y la adolescencia / Anuncios sin cuidado, por Jairo Valderrama / Salvando vidas y cambiando el mundo desde Kenia-Cirujano de la Clínica Universidad de La Sabana, en África / Amor al estudio, un romance que dura toda la vida / Ser parte de la planta profesoral de La Sabana, un sueño que puede cumplirse / Creatividad y curiosidad, claves a la hora de investigar / Alumni Sabana expande el camino laboral de sus graduados / ¿Para qué hacer una especialización? / Convocatoria de becas de doctorado y estancias cortas posdoctorales-De la Fundación Carolina / El valor de la fortaleza en la familia, por Cristián Conen / Reconocimiento: Luz Yolanda Sandoval Estupiñán, Profesora de la Facultad de Educación-25 años de servicios prestados / ¿SabÍas que... / Se acerca la renovación de las pólizas voluntarias de vida y hogar / La ""borrachera económica"" de los colombianos, por Giovanni Hernández / Cuello de texto o text neck / Nueva solución Antimalware / Presentación de las mejoras y los beneficios de la zona WIFI
Fabio Martinelli - One of the best experts on this subject based on the ideXlab platform.
-
towards an interpretable deep learning model for mobile malware detection and family identification
Computers & Security, 2021Co-Authors: Giacomo Iadarola, Francesco Mercaldo, Fabio Martinelli, Antonella SantoneAbstract:Abstract Mobile devices are pervading everyday activities of our life. Each day we store a plethora of sensitive and private information in smart devices such as smartphones or tablets, which are typically equipped with an always-on internet connection. These information are of interest for malicious writers that are developing more and more aggressive harmful code for stealing sensitive and private information from mobile devices. Considering the weaknesses exhibited from current Antimalware signature-based detection, in this paper we propose a method relying on application representation in terms on images used to input an explainable deep learning model designed by authors for Android malware detection and family identification. Moreover, we show how the explainability can be considered from the analyst to assess different models. Experimental results demonstrated the effectiveness of the proposed method, obtaining an average accuracy ranging from 0.96 to 0.97; we evaluated 8446 Android samples belonging to six different malware families and one more family for trusted samples, by providing also interpretability about the predictions performed by the model.
-
Extinguishing Ransomware - A Hybrid Approach to Android Ransomware Detection
Foundations and Practice of Security, 2018Co-Authors: Alberto Ferrante, Francesco Mercaldo, Miroslaw Malek, Fabio Martinelli, Jelena MilosevicAbstract:Mobile ransomware is on the rise and effective defense from it is of utmost importance to guarantee security of mobile users’ data. Current solutions provided by Antimalware vendors are signature-based and thus ineffective in removing ransomware and restoring the infected devices and files. Also, current state-of-the art literature offers very few solutions to effectively detecting and blocking mobile ransomware. Starting from these considerations, we propose a hybrid method able to effectively counter ransomware. The proposed method first examines applications to be used on a device prior to their installation (static approach) and then observes their behavior at runtime and identifies if the system is under attack (dynamic approach). To detect ransomware, the static detection method uses the frequency of opcodes while the dynamic detection method considers CPU usage, memory usage, network usage and system call statistics. We evaluate the performance of our hybrid detection method on a dataset that contains both ransomware and legitimate applications. Additionally, we evaluate the performance of the static and dynamic stand-alone methods for comparison. Our results show that although both static and dynamic detection methods perform well in detecting ransomware, their combination in a form of a hybrid method performs best, being able to detect ransomware with 100% precision and having a false positive rate of less than 4%.
-
Evaluating model checking for cyber threats code obfuscation identification
Journal of Parallel and Distributed Computing, 2018Co-Authors: Fabio Martinelli, Francesco Mercaldo, Antonella Santone, Vittoria Nardone, Arun Kumar Sangaiah, Aniello CimitileAbstract:Abstract Code obfuscation is a set of transformations that make code programs harder to understand. The goal of code obfuscation is to make reverse engineering of programs infeasible, while maintaining the logic on the program. Originally, it has been used to protect intellectual property. However, recently code obfuscation has been also used by malware writers in order to make cyber threats easily able to evade Antimalware scanners. As a matter of fact, metamorphic and polymorphic viruses exhibit the ability to obfuscate their code as they propagate. In this paper we propose a model checking-based approach which is able to identify the most widespread obfuscating techniques, without making any assumptions about the nature of the obfuscations used. We evaluate the proposed method on a real-world dataset obtaining an accuracy equal to 0.9 in the identification of obfuscation techniques.
-
formal methods meet mobile code obfuscation identification of code reordering technique
Workshops on Enabling Technologies: Infrastracture for Collaborative Enterprises, 2017Co-Authors: Aniello Cimitile, Francesco Mercaldo, Fabio Martinelli, Vittoria Nardone, Antonella SantoneAbstract:Android represents the most widespread mobile environment. This increasing diffusion is the reason why attackers are attracted to develop malware targeting this platform. Malware writers usually use code obfuscation techniques in order to evade the current Antimalware detection and to generate new malware variants. These techniques make code programs harder to understand and they change the signature of the application making ineffective the signature extraction work. We propose a method based on formal methods able to identify whether a mobile application is obfuscated. In this preliminary work we identify one of the most widespread obfuscation technique: the code reordering. We test our method on a real-world dataset composed by Android trusted and ransomware samples, obtaining encouraging results.
-
model checking for mobile android malware evolution
Formal Methods, 2017Co-Authors: Aniello Cimitile, Francesco Mercaldo, Fabio Martinelli, Antonella Santone, Vittoria Nardone, Gigliola VagliniAbstract:Software engineering researchers have largely demonstrated that newer versions of software make use of previous versions. No exception to this rule for the so-called malicious software, that frequently evolves in order to evade the detection by Antimalware. As matter of fact, mobile malicious programs, such as trojans, are frequently related to previous malware through evolutionary relationships. Discovering those relationships and constructing a phylogenetic model is expected to be helpful for analyzing new malware and for establishing a principled naming scheme. In this paper we propose a model checking based method to infer mobile malware phylogenetic trees. We demonstrate, implementing our approach in the droid-Sapiens tool, that mobile malware families come from an ancestor and they influence own descendant, basing on the payload that they exhibit.
Aniello Cimitile - One of the best experts on this subject based on the ideXlab platform.
-
Evaluating model checking for cyber threats code obfuscation identification
Journal of Parallel and Distributed Computing, 2018Co-Authors: Fabio Martinelli, Francesco Mercaldo, Antonella Santone, Vittoria Nardone, Arun Kumar Sangaiah, Aniello CimitileAbstract:Abstract Code obfuscation is a set of transformations that make code programs harder to understand. The goal of code obfuscation is to make reverse engineering of programs infeasible, while maintaining the logic on the program. Originally, it has been used to protect intellectual property. However, recently code obfuscation has been also used by malware writers in order to make cyber threats easily able to evade Antimalware scanners. As a matter of fact, metamorphic and polymorphic viruses exhibit the ability to obfuscate their code as they propagate. In this paper we propose a model checking-based approach which is able to identify the most widespread obfuscating techniques, without making any assumptions about the nature of the obfuscations used. We evaluate the proposed method on a real-world dataset obtaining an accuracy equal to 0.9 in the identification of obfuscation techniques.
-
formal methods meet mobile code obfuscation identification of code reordering technique
Workshops on Enabling Technologies: Infrastracture for Collaborative Enterprises, 2017Co-Authors: Aniello Cimitile, Francesco Mercaldo, Fabio Martinelli, Vittoria Nardone, Antonella SantoneAbstract:Android represents the most widespread mobile environment. This increasing diffusion is the reason why attackers are attracted to develop malware targeting this platform. Malware writers usually use code obfuscation techniques in order to evade the current Antimalware detection and to generate new malware variants. These techniques make code programs harder to understand and they change the signature of the application making ineffective the signature extraction work. We propose a method based on formal methods able to identify whether a mobile application is obfuscated. In this preliminary work we identify one of the most widespread obfuscation technique: the code reordering. We test our method on a real-world dataset composed by Android trusted and ransomware samples, obtaining encouraging results.
-
model checking for mobile android malware evolution
Formal Methods, 2017Co-Authors: Aniello Cimitile, Francesco Mercaldo, Fabio Martinelli, Antonella Santone, Vittoria Nardone, Gigliola VagliniAbstract:Software engineering researchers have largely demonstrated that newer versions of software make use of previous versions. No exception to this rule for the so-called malicious software, that frequently evolves in order to evade the detection by Antimalware. As matter of fact, mobile malicious programs, such as trojans, are frequently related to previous malware through evolutionary relationships. Discovering those relationships and constructing a phylogenetic model is expected to be helpful for analyzing new malware and for establishing a principled naming scheme. In this paper we propose a model checking based method to infer mobile malware phylogenetic trees. We demonstrate, implementing our approach in the droid-Sapiens tool, that mobile malware families come from an ancestor and they influence own descendant, basing on the payload that they exhibit.