The Experts below are selected from a list of 192 Experts worldwide ranked by ideXlab platform
Yuval Elovici - One of the best experts on this subject based on the ideXlab platform.
-
Deep feature transfer learning for trusted and automated malware signature generation in private cloud environments.
Neural Networks, 2020Co-Authors: Daniel Nahmias, Aviad Cohen, Nir Nissim, Yuval EloviciAbstract:Abstract This paper presents TrustSign, a novel, trusted automatic malware signature generation method based on high-level deep features transferred from a VGG-19 neural network model pretrained on the ImageNet dataset. While traditional automatic malware signature generation techniques rely on static or dynamic analysis of the malware’s executable, our method overcomes the limitations associated with these techniques by producing signatures based on the presence of the Malicious Process in the volatile memory. By leveraging the cloud’s virtualization technology, TrustSign analyzes the Malicious Process in a trusted manner, since the malware is unaware and cannot interfere with the inspection procedure. Additionally, by removing the dependency on the malware’s executable, our method is fully capable of signing fileless malware as well. TrustSign’s signature generation Process does not require feature engineering or any additional model training, and it is done in a completely unsupervised manner, eliminating the need for a human expert. Because of this, our method has the advantage of dramatically reducing signature generation and distribution time. In fact, in this paper we rethink the typical use of deep convolutional neural networks and use the VGG-19 model as a topological feature extractor for a vastly different task from the one it was trained for. The results of our experimental evaluation demonstrate TrustSign’s ability to generate signatures impervious to the Process state over time. By using the signatures generated by TrustSign as input for various supervised classifiers, we achieved up to 99.5% classification accuracy.
-
TrustSign: Trusted Malware Signature Generation in Private Clouds Using Deep Feature Transfer Learning
2019 International Joint Conference on Neural Networks (IJCNN), 2019Co-Authors: Daniel Nahmias, Aviad Cohen, Nir Nissim, Yuval EloviciAbstract:This paper presents TrustSign, a novel, trusted automatic malware signature generation method based on high-level deep features transferred from a VGG-19 neural network model pre-trained on the ImageNet dataset. While traditional automatic malware signature generation techniques rely on static or dynamic analysis of the malware's executable, our method overcomes the limitations associated with these techniques by producing signatures based on the presence of the Malicious Process in the volatile memory. Signatures generated using TrustSign well represent the real malware behavior during runtime. By leveraging the cloud's virtualization technology, TrustSign analyzes the Malicious Process in a trusted manner, since the malware is unaware and cannot interfere with the inspection procedure. Additionally, by removing the dependency on the malware's executable, our method is capable of signing fileless malware. Thus, we focus our research on in-browser cryptojacking attacks, which current antivirus solutions have difficulty to detect. However, TrustSign is not limited to cryptojacking attacks, as our evaluation included various ransomware samples. TrustSign's signature generation Process does not require feature engineering or any additional model training, and it is done in a completely unsupervised manner, obviating the need for a human expert. Therefore, our method has the advantage of dramatically reducing signature generation and distribution time. The results of our experimental evaluation demonstrate TrustSign's ability to generate signatures invariant to the Process state over time. By using the signatures generated by TrustSign as input for various supervised classifiers, we achieved 99.5% classification accuracy.
-
IJCNN - TrustSign: Trusted Malware Signature Generation in Private Clouds Using Deep Feature Transfer Learning
2019 International Joint Conference on Neural Networks (IJCNN), 2019Co-Authors: Daniel Nahmias, Aviad Cohen, Nir Nissim, Yuval EloviciAbstract:This paper presents TrustSign, a novel, trusted automatic malware signature generation method based on high-level deep features transferred from a VGG-19 neural network model pre-trained on the ImageNet dataset. While traditional automatic malware signature generation techniques rely on static or dynamic analysis of the malware’s executable, our method overcomes the limitations associated with these techniques by producing signatures based on the presence of the Malicious Process in the volatile memory. Signatures generated using TrustSign well represent the real malware behavior during runtime. By leveraging the cloud’s virtualization technology, TrustSign analyzes the Malicious Process in a trusted manner, since the malware is unaware and cannot interfere with the inspection procedure. Additionally, by removing the dependency on the malware’s executable, our method is capable of signing fileless malware. Thus, we focus our research on in-browser cryptojacking attacks, which current antivirus solutions have difficulty to detect. However, TrustSign is not limited to cryptojacking attacks, as our evaluation included various ransomware samples. TrustSign’s signature generation Process does not require feature engineering or any additional model training, and it is done in a completely unsupervised manner, obviating the need for a human expert. Therefore, our method has the advantage of dramatically reducing signature generation and distribution time. The results of our experimental evaluation demonstrate TrustSign’s ability to generate signatures invariant to the Process state over time. By using the signatures generated by TrustSign as input for various supervised classifiers, we achieved 99.5% classification accuracy.
Jing Wang - One of the best experts on this subject based on the ideXlab platform.
-
Protecting Private Keys against Memory Disclosure Attacks Using Hardware Transactional Memory
2015 IEEE Symposium on Security and Privacy, 2015Co-Authors: Le Guan, Jiwu Jing, Jing WangAbstract:Cryptography plays an important role in computer and communication security. In practical implementations of cryptosystems, the cryptographic keys are usually loaded into the memory as plaintext, and then used in the cryptographic algorithms. Therefore, the private keys are subject to memory disclosure attacks that read unauthorized data from RAM. Such attacks could be performed through software methods (e.g., Open SSL Heart bleed) even when the integrity of the victim system's executable binaries is maintained. They could also be performed through physical methods (e.g., Cold-boot attacks on RAM chips) even when the system is free of software vulnerabilities. In this paper, we propose Mimosa that protects RSA private keys against the above software-based and physical memory attacks. When the Mimosa service is in idle, private keys are encrypted and reside in memory as cipher text. During the cryptographic computing, Mimosa uses hardware transactional memory (HTM) to ensure that (a) whenever a Malicious Process other than Mimosa attempts to read the plaintext private key, the transaction aborts and all sensitive data are automatically cleared with hardware mechanisms, due to the strong atomicity guarantee of HTM, and (b) all sensitive data, including private keys and intermediate states, appear as plaintext only within CPU-bound caches, and are never loaded to RAM chips. To the best of our knowledge, Mimosa is the first solution to use transactional memory to protect sensitive data against memory disclosure attacks. We have implemented Mimosa on a commodity machine with Intel Core i7 Haswell CPUs. Through extensive experiments, we show that Mimosa effectively protects cryptographic keys against various attacks that attempt to read sensitive data from memory, and it only introduces a small performance overhead.
-
Mimosa: Protecting Private Keys against Memory Disclosure Attacks using Hardware Transactional Memory
IEEE Transactions on Dependable and Secure Computing, 1Co-Authors: Congwu Li, Le Guan, Jiwu Jing, Jing WangAbstract:Cryptography is essential for computer and network security. In practice, the cryptographic keys are loaded into the memory as plaintext during cryptographic computations. Therefore, the keys are subject to memory disclosure attacks that read unauthorized data from RAM. This paper presents Mimosa, protecting RSA private keys against both software-based and physical memory disclosure attacks. Mimosa uses hardware transactional memory (HTM) to ensure that (a) whenever a Malicious Process attempts to read the plaintext private key, the transaction aborts and all sensitive data are automatically cleared, due to the atomicity guarantee of HTM; and (b) all sensitive data appear as plaintext only within caches, and are never loaded to RAM chips. To the best of our knowledge, Mimosa is the first to use transactional memory to protect sensitive data against memory attacks. We implemented Mimosa with Intel TSX. However, the fragility of TSX transactions introduces extra cache-clogging denial-of-service (DoS) threats, and attackers could sharply degrade the performance. We further partition an RSA private-key computation into multiple transactional parts, while (sensitive) intermediate results are protected across transactional parts. Experiments show that Mimosa effectively protects cryptographic keys against memory disclosure attacks, and introduces a small overhead, even with concurrent cache-clogging workloads.
Daniel Nahmias - One of the best experts on this subject based on the ideXlab platform.
-
Deep feature transfer learning for trusted and automated malware signature generation in private cloud environments.
Neural Networks, 2020Co-Authors: Daniel Nahmias, Aviad Cohen, Nir Nissim, Yuval EloviciAbstract:Abstract This paper presents TrustSign, a novel, trusted automatic malware signature generation method based on high-level deep features transferred from a VGG-19 neural network model pretrained on the ImageNet dataset. While traditional automatic malware signature generation techniques rely on static or dynamic analysis of the malware’s executable, our method overcomes the limitations associated with these techniques by producing signatures based on the presence of the Malicious Process in the volatile memory. By leveraging the cloud’s virtualization technology, TrustSign analyzes the Malicious Process in a trusted manner, since the malware is unaware and cannot interfere with the inspection procedure. Additionally, by removing the dependency on the malware’s executable, our method is fully capable of signing fileless malware as well. TrustSign’s signature generation Process does not require feature engineering or any additional model training, and it is done in a completely unsupervised manner, eliminating the need for a human expert. Because of this, our method has the advantage of dramatically reducing signature generation and distribution time. In fact, in this paper we rethink the typical use of deep convolutional neural networks and use the VGG-19 model as a topological feature extractor for a vastly different task from the one it was trained for. The results of our experimental evaluation demonstrate TrustSign’s ability to generate signatures impervious to the Process state over time. By using the signatures generated by TrustSign as input for various supervised classifiers, we achieved up to 99.5% classification accuracy.
-
TrustSign: Trusted Malware Signature Generation in Private Clouds Using Deep Feature Transfer Learning
2019 International Joint Conference on Neural Networks (IJCNN), 2019Co-Authors: Daniel Nahmias, Aviad Cohen, Nir Nissim, Yuval EloviciAbstract:This paper presents TrustSign, a novel, trusted automatic malware signature generation method based on high-level deep features transferred from a VGG-19 neural network model pre-trained on the ImageNet dataset. While traditional automatic malware signature generation techniques rely on static or dynamic analysis of the malware's executable, our method overcomes the limitations associated with these techniques by producing signatures based on the presence of the Malicious Process in the volatile memory. Signatures generated using TrustSign well represent the real malware behavior during runtime. By leveraging the cloud's virtualization technology, TrustSign analyzes the Malicious Process in a trusted manner, since the malware is unaware and cannot interfere with the inspection procedure. Additionally, by removing the dependency on the malware's executable, our method is capable of signing fileless malware. Thus, we focus our research on in-browser cryptojacking attacks, which current antivirus solutions have difficulty to detect. However, TrustSign is not limited to cryptojacking attacks, as our evaluation included various ransomware samples. TrustSign's signature generation Process does not require feature engineering or any additional model training, and it is done in a completely unsupervised manner, obviating the need for a human expert. Therefore, our method has the advantage of dramatically reducing signature generation and distribution time. The results of our experimental evaluation demonstrate TrustSign's ability to generate signatures invariant to the Process state over time. By using the signatures generated by TrustSign as input for various supervised classifiers, we achieved 99.5% classification accuracy.
-
IJCNN - TrustSign: Trusted Malware Signature Generation in Private Clouds Using Deep Feature Transfer Learning
2019 International Joint Conference on Neural Networks (IJCNN), 2019Co-Authors: Daniel Nahmias, Aviad Cohen, Nir Nissim, Yuval EloviciAbstract:This paper presents TrustSign, a novel, trusted automatic malware signature generation method based on high-level deep features transferred from a VGG-19 neural network model pre-trained on the ImageNet dataset. While traditional automatic malware signature generation techniques rely on static or dynamic analysis of the malware’s executable, our method overcomes the limitations associated with these techniques by producing signatures based on the presence of the Malicious Process in the volatile memory. Signatures generated using TrustSign well represent the real malware behavior during runtime. By leveraging the cloud’s virtualization technology, TrustSign analyzes the Malicious Process in a trusted manner, since the malware is unaware and cannot interfere with the inspection procedure. Additionally, by removing the dependency on the malware’s executable, our method is capable of signing fileless malware. Thus, we focus our research on in-browser cryptojacking attacks, which current antivirus solutions have difficulty to detect. However, TrustSign is not limited to cryptojacking attacks, as our evaluation included various ransomware samples. TrustSign’s signature generation Process does not require feature engineering or any additional model training, and it is done in a completely unsupervised manner, obviating the need for a human expert. Therefore, our method has the advantage of dramatically reducing signature generation and distribution time. The results of our experimental evaluation demonstrate TrustSign’s ability to generate signatures invariant to the Process state over time. By using the signatures generated by TrustSign as input for various supervised classifiers, we achieved 99.5% classification accuracy.
Vijay Varadharajan - One of the best experts on this subject based on the ideXlab platform.
-
IWCMC - Security Techniques for Zero Day Attacks
2011 7th International Wireless Communications and Mobile Computing Conference, 2011Co-Authors: Udaya Tupakula, Vijay VaradharajanAbstract:We propose security architecture to detect and prevent zero day attacks and techniques to deal with the polymorphic and metamorphic behaviour of the attacks. The components of our architecture are designed to deal with different types of Malicious behaviour. The entity validation component is used for capturing information of the operating system and applications running in the virtual machines, secure logging and detection of attacks that are generated with spoofed source address. The intrusion detection engine component is used for detection of known attacks and suspicious behaviour of the entities by monitoring the incoming and outgoing traffic of virtual machines. The dynamic analyzer is used for detection and validation of hidden Processes, detection of zero day attacks and fine granular isolation of Malicious Process that is generating the attack traffic. After a zero day attack is detected, interactive VM technique is used to determine if the zero day attack exhibits polymorphic or metamorphic behaviour and develop attack signatures to deal with the attacks efficiently.
-
On the design of Virtual machine Intrusion detection system
12th IFIP IEEE International Symposium on Integrated Network Management (IM 2011) and Workshops, 2011Co-Authors: Udaya Tupakula, Vijay VaradharajanAbstract:In this paper we propose comprehensive security architecture called VICTOR to deal with different types of attacks on virtual machines. Our model takes into account the specific characteristics of operating system and applications running in each virtual machine (VM) at a fine granular level to deal with the attacks. Our architecture has several components such as entity validation, intrusion detection engine and dynamic analyzer. The entity validation component is used in the detection of attack traffic with spoofed source address, secure logging, and capturing information of the operating system and applications running in the virtual machines. The intrusion detection engine component is used for detection of known attacks and suspicious behaviour by monitoring the incoming and outgoing traffic of virtual machines. The dynamic analyzer is used for detection and validation of suspicious Processes, detection of zero day attacks and fine granular isolation of Malicious Process or application that is generating the attack traffic.
-
Integrated Network Management - On the design of Virtual machine Intrusion detection system
12th IFIP IEEE International Symposium on Integrated Network Management (IM 2011) and Workshops, 2011Co-Authors: Udaya Tupakula, Vijay VaradharajanAbstract:In this paper we propose comprehensive security architecture called VICTOR to deal with different types of attacks on virtual machines. Our model takes into account the specific characteristics of operating system and applications running in each virtual machine (VM) at a fine granular level to deal with the attacks. Our architecture has several components such as entity validation, intrusion detection engine and dynamic analyzer. The entity validation component is used in the detection of attack traffic with spoofed source address, secure logging, and capturing information of the operating system and applications running in the virtual machines. The intrusion detection engine component is used for detection of known attacks and suspicious behaviour by monitoring the incoming and outgoing traffic of virtual machines. The dynamic analyzer is used for detection and validation of suspicious Processes, detection of zero day attacks and fine granular isolation of Malicious Process or application that is generating the attack traffic.
Le Guan - One of the best experts on this subject based on the ideXlab platform.
-
Protecting Private Keys against Memory Disclosure Attacks Using Hardware Transactional Memory
2015 IEEE Symposium on Security and Privacy, 2015Co-Authors: Le Guan, Jiwu Jing, Jing WangAbstract:Cryptography plays an important role in computer and communication security. In practical implementations of cryptosystems, the cryptographic keys are usually loaded into the memory as plaintext, and then used in the cryptographic algorithms. Therefore, the private keys are subject to memory disclosure attacks that read unauthorized data from RAM. Such attacks could be performed through software methods (e.g., Open SSL Heart bleed) even when the integrity of the victim system's executable binaries is maintained. They could also be performed through physical methods (e.g., Cold-boot attacks on RAM chips) even when the system is free of software vulnerabilities. In this paper, we propose Mimosa that protects RSA private keys against the above software-based and physical memory attacks. When the Mimosa service is in idle, private keys are encrypted and reside in memory as cipher text. During the cryptographic computing, Mimosa uses hardware transactional memory (HTM) to ensure that (a) whenever a Malicious Process other than Mimosa attempts to read the plaintext private key, the transaction aborts and all sensitive data are automatically cleared with hardware mechanisms, due to the strong atomicity guarantee of HTM, and (b) all sensitive data, including private keys and intermediate states, appear as plaintext only within CPU-bound caches, and are never loaded to RAM chips. To the best of our knowledge, Mimosa is the first solution to use transactional memory to protect sensitive data against memory disclosure attacks. We have implemented Mimosa on a commodity machine with Intel Core i7 Haswell CPUs. Through extensive experiments, we show that Mimosa effectively protects cryptographic keys against various attacks that attempt to read sensitive data from memory, and it only introduces a small performance overhead.
-
Mimosa: Protecting Private Keys against Memory Disclosure Attacks using Hardware Transactional Memory
IEEE Transactions on Dependable and Secure Computing, 1Co-Authors: Congwu Li, Le Guan, Jiwu Jing, Jing WangAbstract:Cryptography is essential for computer and network security. In practice, the cryptographic keys are loaded into the memory as plaintext during cryptographic computations. Therefore, the keys are subject to memory disclosure attacks that read unauthorized data from RAM. This paper presents Mimosa, protecting RSA private keys against both software-based and physical memory disclosure attacks. Mimosa uses hardware transactional memory (HTM) to ensure that (a) whenever a Malicious Process attempts to read the plaintext private key, the transaction aborts and all sensitive data are automatically cleared, due to the atomicity guarantee of HTM; and (b) all sensitive data appear as plaintext only within caches, and are never loaded to RAM chips. To the best of our knowledge, Mimosa is the first to use transactional memory to protect sensitive data against memory attacks. We implemented Mimosa with Intel TSX. However, the fragility of TSX transactions introduces extra cache-clogging denial-of-service (DoS) threats, and attackers could sharply degrade the performance. We further partition an RSA private-key computation into multiple transactional parts, while (sensitive) intermediate results are protected across transactional parts. Experiments show that Mimosa effectively protects cryptographic keys against memory disclosure attacks, and introduces a small overhead, even with concurrent cache-clogging workloads.