The Experts below are selected from a list of 6651 Experts worldwide ranked by ideXlab platform
Ponnurangam Kumaraguru - One of the best experts on this subject based on the ideXlab platform.
-
Facebook Inspector (FbI): Towards automatic real-time detection of Malicious Content on Facebook
Social Network Analysis and Mining, 2017Co-Authors: Prasun Dewan, Ponnurangam KumaraguruAbstract:Online Social Networks witness a rise in user activity whenever a major event makes news. Cyber criminals exploit this spur in user engagement levels to spread Malicious Content that compromises system reputation, causes financial losses and degrades user experience. In this paper, we collect and characterize a dataset of 4.4 million public posts generated on Facebook during 17 news-making events (natural calamities, sports, terror attacks, etc.) over a 16-month time period. From this dataset, we filter out two sets of Malicious posts, one using URL blacklists and another using human annotations. Our observations reveal some characteristic differences between Malicious posts obtained from the two methodologies, thus demanding a twofold filtering process for a more complete and robust filtering system. We empirically confirm the need for this twofold filtering approach by cross-validating supervised learning models obtained from the two sets of Malicious posts. These supervised learning models include Naive Bayesian, Decision Trees, Random Forest, and Support Vector Machine-based models. Based on this learning, we implement Facebook Inspector, a REST API-based browser plug-in for identifying Malicious Facebook posts in real time. Facebook Inspector uses class probabilities obtained from two independent supervised learning models based on a Random Forest classifier to identify Malicious posts in real time. These supervised learning models are based on a feature set comprising of 44 features and achieve an accuracy of over 80% each, using only publicly available features. During the first 9 months of its public deployment (August 2015–May 2016), Facebook Inspector processed 0.97 million posts at an average response time of 2.6 s per post and was downloaded over 2500 times. We also evaluate Facebook Inspector in terms of performance and usability to identify further scope for improvement.
-
detecting Malicious Content on facebook
arXiv: Social and Information Networks, 2015Co-Authors: Prateek Dewan, Ponnurangam KumaraguruAbstract:Online Social Networks (OSNs) witness a rise in user activity whenever an event takes place. Malicious entities exploit this spur in user-engagement levels to spread Malicious Content that compromises system reputation and degrades user experience. It also generates revenue from advertisements, clicks, etc. for the Malicious entities. Facebook, the world's biggest social network, is no exception and has recently been reported to face much abuse through scams and other type of Malicious Content, especially during news making events. Recent studies have reported that spammers earn $200 million just by posting Malicious links on Facebook. In this paper, we characterize Malicious Content posted on Facebook during 17 events, and discover that existing efforts to counter Malicious Content by Facebook are not able to stop all Malicious Content from entering the social graph. Our findings revealed that Malicious entities tend to post Content through web and third party applications while legitimate entities prefer mobile platforms to post Content. In addition, we discovered a substantial amount of Malicious Content generated by Facebook pages. Through our observations, we propose an extensive feature set based on entity profile, textual Content, metadata, and URL features to identify Malicious Content on Facebook in real time and at zero-hour. This feature set was used to train multiple machine learning models and achieved an accuracy of 86.9%. The intent is to catch Malicious Content that is currently evading Facebook's detection techniques. Our machine learning model was able to detect more than double the number of Malicious posts as compared to existing Malicious Content detection techniques. Finally, we built a real world solution in the form of a REST based API and a browser plug-in to identify Malicious Facebook posts in real time.
Yaw-chung Chen - One of the best experts on this subject based on the ideXlab platform.
-
a hybrid cpu gpu pattern matching algorithm for deep packet inspection
PLOS ONE, 2015Co-Authors: Chun Liang Lee, Yishan Lin, Yaw-chung ChenAbstract:The large quantities of data now being transferred via high-speed networks have made deep packet inspection indispensable for security purposes. Scalable and low-cost signature-based network intrusion detection systems have been developed for deep packet inspection for various software platforms. Traditional approaches that only involve central processing units (CPUs) are now considered inadequate in terms of inspection speed. Graphic processing units (GPUs) have superior parallel processing power, but transmission bottlenecks can reduce optimal GPU efficiency. In this paper we describe our proposal for a hybrid CPU/GPU pattern-matching algorithm (HPMA) that divides and distributes the packet-inspecting workload between a CPU and GPU. All packets are initially inspected by the CPU and filtered using a simple pre-filtering algorithm, and packets that might contain Malicious Content are sent to the GPU for further inspection. Test results indicate that in terms of random payload traffic, the matching speed of our proposed algorithm was 3.4 times and 2.7 times faster than those of the AC-CPU and AC-GPU algorithms, respectively. Further, HPMA achieved higher energy efficiency than the other tested algorithms.
Engin Kirda - One of the best experts on this subject based on the ideXlab platform.
-
service specific anomaly detection for network intrusion detection
ACM Symposium on Applied Computing, 2002Co-Authors: Christopher Krugel, Thomas Toth, Engin KirdaAbstract:The constant increase of attacks against networks and their resources (as recently shown by the CodeRed worm) causes a necessity to protect these valuable assets. Firewalls are now a common installation to repel intrusion attempts in the first place. Intrusion detection systems (IDS), which try to detect Malicious activities instead of preventing them, offer additional protection when the first defense perimeter has been penetrated. ID systems attempt to pin down attacks by comparing collected data to predefined signatures known to be Malicious (signature based) or to a model of legal behavior (anomaly based).Anomaly based systems have the advantage of being able to detect previously unknown attacks but they suffer from the difficulty to build a solid model of acceptable behavior and the high number of alarms caused by unusual but authorized activities. We present an approach that utilizes application specific knowledge of the network services that should be protected. This information helps to extend current, simple network traffic models to form an application model that allows to detect Malicious Content hidden in single network packets. We describe the features of our proposed model and present experimental data that underlines the efficiency of our systems.
Igino Corona - One of the best experts on this subject based on the ideXlab platform.
-
Stealth attacks: An extended insight into the obfuscation effects on Android malware
Computers and Security, 2015Co-Authors: Davide Maiorca, Igino Corona, Davide Ariu, Marco Aresu, Giorgio GiacintoAbstract:In order to effectively evade anti-malware solutions, Android malware authors are progressively resorting to automatic obfuscation strategies. Recent works have shown, on small-scale experiments, the possibility of evading anti-malware engines by applying simple obfuscation transformations on previously detected malware samples. In this paper, we provide a large-scale experiment in which the detection performances of a high number of anti-malware solutions are tested against two different sets of malware samples that have been obfuscated according to different strategies. Moreover, we show that anti-malware engines search for possible Malicious Content inside assets and entry-point classes. We also provide a temporal analysis of the detection performances of anti-malware engines to verify if their resilience has improved since 2013. Finally, we show how, by manipulating the area of the Android executable that contains the strings used by the application, it is possible to deceive anti-malware engines so that they will identify legitimate samples as malware. On one hand, the attained results show that anti-malware systems have improved their resilience against trivial obfuscation techniques. On the other hand, more complex changes to the application executable have proved to be still effective against detection. Thus, we claim that a deeper static (or dynamic) analysis of the application is needed to improve the robustness of such systems.
-
early detection of Malicious flux networks via large scale passive dns traffic analysis
IEEE Transactions on Dependable and Secure Computing, 2012Co-Authors: Roberto Perdisci, Igino Corona, Giorgio GiacintoAbstract:In this paper, we present FluxBuster, a novel passive DNS traffic analysis system for detecting and tracking Malicious flux networks. FluxBuster applies large-scale monitoring of DNS traffic traces generated by recursive DNS (RDNS) servers located in hundreds of different networks scattered across several different geographical locations. Unlike most previous work, our detection approach is not limited to the analysis of suspicious domain names extracted from spam emails or precompiled domain blacklists. Instead, FluxBuster is able to detect Malicious flux service networks in-the-wild, i.e., as they are "accessed” by users who fall victim of Malicious Content, independently of how this Malicious Content was advertised. We performed a long-term evaluation of our system spanning a period of about five months. The experimental results show that FluxBuster is able to accurately detect Malicious flux networks with a low false positive rate. Furthermore, we show that in many cases FluxBuster is able to detect Malicious flux domains several days or even weeks before they appear in public domain blacklists.
-
detecting Malicious flux service networks through passive analysis of recursive dns traces
Annual Computer Security Applications Conference, 2009Co-Authors: Roberto Perdisci, Igino Corona, David Dagon, Wenke LeeAbstract:In this paper we propose a novel, passive approach for detecting and tracking Malicious flux service networks. Our detection system is based on passive analysis of recursive DNS (RDNS) traffic traces collected from multiple large networks. Contrary to previous work, our approach is not limited to the analysis of suspicious domain names extracted from spam emails or precompiled domain blacklists. Instead, our approach is able to detect Malicious flux service networks in-the-wild, i.e., as they are accessed by users who fall victims of Malicious Content advertised through blog spam, instant messaging spam, social website spam, etc., beside email spam. We experiment with the RDNS traffic passively collected at two large ISP networks. Overall, our sensors monitored more than 2.5 billion DNS queries per day from millions of distinct source IPs for a period of 45 days. Our experimental results show that the proposed approach is able to accurately detect Malicious flux service networks. Furthermore, we show how our passive detection and tracking of Malicious flux service networks may benefit spam filtering applications.
W U Haijia - One of the best experts on this subject based on the ideXlab platform.
-
detection of Malicious Content attacks on web services
Journal of Computer Applications, 2010Co-Authors: W U HaijiaAbstract:Malicious Content attacks based on SOAP messages have great impact on application and popularization of Web services.In order to detect the Malicious Content in SOAP message this paper proposed a new method of SOAP message signature detection.This method defined the SOAP Item and SOAP Rule to describe the feature of Malicious Content and introduced the SOAP message parsing algorithm and SOAP rule matching algorithm to detect the Malicious Content attacks detection.According to this proposed method a prototype system of Web services attack detection was designed and implemented.The experimental results of attack detection and performance analysis show that this system has good detection effect and performance.