The Experts below are selected from a list of 6990 Experts worldwide ranked by ideXlab platform
Nikhil Ranade - One of the best experts on this subject based on the ideXlab platform.
-
security toolbox for Detecting novel and sophisticated android Malware
2015Co-Authors: Benjamin Holland, Tom Deering, Jon Mathews, Suresh Kothari, Nikhil RanadeAbstract:This paper presents a demo of our Security Toolbox to Detect novel Malware in Android apps. This Toolbox is developed through our recent research project funded by the DARPA Automated Program Analysis for Cybersecurity (APAC) project. The adversarial challenge ("Red") teams in the DARPA APAC program are tasked with designing sophisticated Malware to test the bounds of Malware Detection technology being developed by the research and development ("Blue") teams. Our research group, a Blue team in the DARPA APAC program, proposed a "human-in-the-loop program analysis" approach to Detect Malware given the source or Java bytecode for an Android app. Our Malware Detection apparatus consists of two components: a general-purpose program analysis platform called Atlas, and a Security Toolbox built on the Atlas platform. This paper describes the major design goals, the Toolbox components to achieve the goals, and the workflow for auditing Android apps. The accompanying video illustrates features of the Toolbox through a live audit. Video: http://youtu.be/WhcoAX3HiNU
-
security toolbox for Detecting novel and sophisticated android Malware
2015Co-Authors: Benjamin Holland, Tom Deering, Jon Mathews, Suresh Kothari, Nikhil RanadeAbstract:This paper presents a demo of our Security Toolbox to Detect novel Malware in Android apps. This Toolbox is developed through our recent research project funded by the DARPA Automated Program Analysis for Cybersecurity (APAC) project. The adversarial challenge ("Red") teams in the DARPA APAC program are tasked with designing sophisticated Malware to test the bounds of Malware Detection technology being developed by the research and development ("Blue") teams. Our research group, a Blue team in the DARPA APAC program, proposed a "human-in-the-loop program analysis" approach to Detect Malware given the source or Java bytecode for an Android app. Our Malware Detection apparatus consists of two components: a general-purpose program analysis platform called Atlas, and a Security Toolbox built on the Atlas platform. This paper describes the major design goals, the Toolbox components to achieve the goals, and the workflow for auditing Android apps. The accompanying video (this http URL) illustrates features of the Toolbox through a live audit.
Yuxin Ding - One of the best experts on this subject based on the ideXlab platform.
-
a Malware Detection method based on family behavior graph
2018Co-Authors: Yuxin Ding, Xiaoling Xia, Sheng ChenAbstract:Abstract Graph-based Malware Detection methods must build a behavior graph for each known Malware, and they are difficult to apply in practice. To solve this issue, we study how to build a common behavior graph for each Malware family. We represent Malware behaviors as dependency graphs. To find the dependency relations between system calls, we use a dynamic taint analysis technique to mark the system call parameters with taint tags, and we then build the system call dependency graph by tracing the propagation of the taint data. Based on the dependency graphs of Malware samples, we propose an algorithm to extract the common behavior graph, which is used to represent the behavioral features of a Malware family. Finally, a graph matching algorithm that is based on the maximum weight subgraph is used to Detect malicious code. The experimental results show that the proposed method has a high Detection rate and a low false positive rate and can Detect Malware variants.
-
control flow based opcode behavior analysis for Malware Detection
2014Co-Authors: Yuxin Ding, Wei Dai, Shengli Yan, Yumei ZhangAbstract:Opcode sequences from decompiled executables have been employed to Detect Malware. Currently, opcode sequences are extracted using text-based methods, and the limitation of this method is that the extracted opcode sequences cannot represent the true behaviors of an executable. To solve this issue, we present a control flow-based method to extract executable opcode behaviors. The behaviors extracted by this method can fully represent the behavior characteristics of an executable. To verify the efficiency of control flow-based behaviors, we perform a comparative study of the two types of opcode behavior analysis methods. The experimental results indicate that the proposed control flow-based method has a higher overall accuracy and a lower false positive rate.
Pablo Garcia Bringas - One of the best experts on this subject based on the ideXlab platform.
-
MAMA: Manifest analysis for Malware Detection in android
2013Co-Authors: Borja Sanz, Carlos Laorden, Xabier Ugarte-pedrero, Julia Nieves, Pablo Garcia Bringas, Igor Santos, Gonzalo Álvarez MarañónAbstract:The use of mobile phones has increased because they offer nearly the same functionality as a personal computer. In addition, the number of applications available for Android-based mobile devices has increased. Google offers programmers the opportunity to upload and sell applications in the Android Market, but Malware writers upload their malicious code there. In light of this background, we present here manifest analysis for Malware Detection in Android (MAMA), a new method that extracts several features from the Android manifest of the applications to build machine learning classifiers and Detect Malware.
-
Opcode sequences as representation of executables for data-mining-based unknown Malware Detection
2013Co-Authors: Igor Santos, Xabier Ugarte-pedrero, Felix Brezo, Pablo Garcia BringasAbstract:Malware can be defined as any type of malicious code that has the potential to harm a computer or network. The volume of Malware is growing faster every year and poses a serious global security threat. Consequently, Malware Detection has become a critical topic in computer security. Currently, signature-based Detection is the most widespread method used in commercial antivirus. In spite of the broad use of this method, it can Detect Malware only after the malicious executable has already caused damage and provided the Malware is adequately documented. Therefore, the signature-based method consistently fails to Detect new Malware. In this paper, we propose a new method to Detect unknown Malware families. This model is based on the frequency of the appearance of opcode sequences. Furthermore, we describe a technique to mine the relevance of each opcode and assess the frequency of each opcode sequence. In addition, we provide empirical validation that this new method is capable of Detecting unknown Malware.
-
puma permission usage to Detect Malware in android
2013Co-Authors: Borja Sanz, Carlos Laorden, Pablo Garcia Bringas, Igor Santos, Xabier Ugartepedrero, Gonzalo AlvarezAbstract:The presence of mobile devices has increased in our lives offering almost the same functionality as a personal computer. Android devices have appeared lately and, since then, the number of applications available for this operating system has increased exponentially. Google already has its Android Market where applications are offered and, as happens with every popular media, is prone to misuse. In fact, Malware writers insert malicious applications into this market, but also among other alternative markets. Therefore, in this paper, we present PUMA, a new method for Detecting malicious Android applications through machine-learning techniques by analysing the extracted permissions from the application itself.
Benjamin Holland - One of the best experts on this subject based on the ideXlab platform.
-
security toolbox for Detecting novel and sophisticated android Malware
2015Co-Authors: Benjamin Holland, Tom Deering, Jon Mathews, Suresh Kothari, Nikhil RanadeAbstract:This paper presents a demo of our Security Toolbox to Detect novel Malware in Android apps. This Toolbox is developed through our recent research project funded by the DARPA Automated Program Analysis for Cybersecurity (APAC) project. The adversarial challenge ("Red") teams in the DARPA APAC program are tasked with designing sophisticated Malware to test the bounds of Malware Detection technology being developed by the research and development ("Blue") teams. Our research group, a Blue team in the DARPA APAC program, proposed a "human-in-the-loop program analysis" approach to Detect Malware given the source or Java bytecode for an Android app. Our Malware Detection apparatus consists of two components: a general-purpose program analysis platform called Atlas, and a Security Toolbox built on the Atlas platform. This paper describes the major design goals, the Toolbox components to achieve the goals, and the workflow for auditing Android apps. The accompanying video illustrates features of the Toolbox through a live audit. Video: http://youtu.be/WhcoAX3HiNU
-
security toolbox for Detecting novel and sophisticated android Malware
2015Co-Authors: Benjamin Holland, Tom Deering, Jon Mathews, Suresh Kothari, Nikhil RanadeAbstract:This paper presents a demo of our Security Toolbox to Detect novel Malware in Android apps. This Toolbox is developed through our recent research project funded by the DARPA Automated Program Analysis for Cybersecurity (APAC) project. The adversarial challenge ("Red") teams in the DARPA APAC program are tasked with designing sophisticated Malware to test the bounds of Malware Detection technology being developed by the research and development ("Blue") teams. Our research group, a Blue team in the DARPA APAC program, proposed a "human-in-the-loop program analysis" approach to Detect Malware given the source or Java bytecode for an Android app. Our Malware Detection apparatus consists of two components: a general-purpose program analysis platform called Atlas, and a Security Toolbox built on the Atlas platform. This paper describes the major design goals, the Toolbox components to achieve the goals, and the workflow for auditing Android apps. The accompanying video (this http URL) illustrates features of the Toolbox through a live audit.
Fei Xiao - One of the best experts on this subject based on the ideXlab platform.
-
A Novel Approach to Detect Malware Variants Based on Classified Behaviors
2019Co-Authors: Donggao Du, Yan Ma, Fei XiaoAbstract:An application programming interface (API) is an excellent feature since it is a procedure call interface to an operating system resource. Behavior features based on API play an important role in analyzing Malware variants. However, the existing Malware Detection approaches have a lot of complex operations on construction and matching. Graph matching is an NP-complete problem and is time-consuming because of computational complexity. To address these issues, a promising approach is proposed to construct the classified behavior features from different Malware families. In the proposed approach, a classified behavior feature consists of a kernel object (an API call parameter) and a series of operations (an API trace). Besides, a classified behavior graph (CBG) is represented as a number by hash to reduce workload and matching time. Subsequently, multiple machine learning classifiers are used for system classification. In particular, to verify the efficiency of our approach, we perform a series of experiments with different families. The experiments on 1220 Malware samples show that the true positive rate is up to 88.3% and the false positive rate keeps within 3.9% by the support vector machine (SVM).