The Experts below are selected from a list of 1653 Experts worldwide ranked by ideXlab platform
Takeshi Yagi - One of the best experts on this subject based on the ideXlab platform.
-
malicious url sequence detection using event de noising convolutional neural network
International Conference on Communications, 2017Co-Authors: Toshiki Shibahara, Takeshi Yagi, Daiki Chiba, Mitsuaki Akiyama, Kohei Yamanishi, Yuta Takata, Yuichi Ohsita, Masayuki MurataAbstract:Attackers have increased the number of infected hosts by redirecting users of compromised popular websites toward websites that exploit vulnerabilities of a browser and its plugins. To prevent damage, detecting infected hosts based on proxy logs, which are generally recorded on enterprise networks, is gaining attention rather than blacklist-based filtering because creating blacklists has become difficult due to the short lifetime of malicious domains and concealment of exploit code. Since information extracted from one URL is limited, we focus on a sequence of URLs that includes artifacts of malicious redirections. We propose a system for detecting malicious URL sequences from proxy logs with a low false positive rate. To elucidate an effective approach of malicious URL sequence detection, we compared three approaches: individual-based approach, convolutional neural network (CNN), and our newly developed event de-noising CNN (EDCNN). Our EDCNN is a new CNN to reduce the negative effect of benign URLs redirected from compromised websites included in malicious URL sequences. Our evaluation shows that the EDCNN lowers the operation cost of Malware Infection by reducing 47% of false alerts compared with a CNN when users access compromised websites but do not obtain exploit code due to browser fingerprinting.
-
Malware Detection with Deep Neural Network Using Process Behavior
Proceedings - International Computer Software and Applications Conference, 2016Co-Authors: Shun Tobiyama, Tomonori Ikuse, Hajime Shimada, Takeshi YagiAbstract:Increase of Malware and advanced cyber-attacks are now becoming a serious problem. Unknown Malware which has not determined by security vendors is often used in these attacks, and it is becoming difficult to protect terminals from their Infection. Therefore, a countermeasure for after Infection is required. There are some Malware Infection detection methods which focus on the traffic data comes from Malware. However, it is difficult to perfectly detect Infection only using traffic data because it imitates benign traffic. In this paper, we propose Malware process detection method based on process behavior in possible infected terminals. In proposal, we investigated stepwise application of Deep Neural Networks to classify Malware process. First, we train the Recurrent Neural Network (RNN) to extract features of process behavior. Second, we train the Convolutional Neural Network (CNN) to classify feature images which are generated by the extracted features from the trained RNN. The evaluation result in several image size by comparing the AUC of obtained ROC curves and we obtained AUC= 0:96 in best case.
-
botprofiler profiling variability of substrings in http requests to detect Malware infected hosts
Trust Security And Privacy In Computing And Communications, 2015Co-Authors: Daiki Chiba, Takeshi Yagi, Mitsuaki Akiyama, Kazufumi Aoki, Takeo Hariu, Shigeki GotoAbstract:Malware is constantly evolving, which makes it difficult to prevent it from infecting hosts. Many countermeasures against Malware Infection, such as generating network-based signatures or templates, have been investigated. Such templates are designed to introduce regular expressions to detect polymorphic attacks conducted by attackers. A potential problem with such templates, however, is that they sometimes falsely regard benign communications as malicious, resulting in false positives, due to an inherent aspect of regular expressions. Since the cost of responding to Malware Infection is quite high, the number of false positives should be kept to a minimum. Therefore, we propose a system to generate templates that cause fewer false positives than a conventional system. We focused on the key idea that malicious infrastructures, such as command and control, tend to be reused instead of created from scratch. The results of implementing our system and validating it using real traffic data indicate that it reduced false positives by up to two-thirds compared to the conventional system and even increased the detection rate of infected hosts.
Gene Tsudik - One of the best experts on this subject based on the ideXlab platform.
-
invited reconciling remote attestation and safety critical operation on simple iot devices
Design Automation Conference, 2018Co-Authors: Xavier Carpent, Ahmadreza Sadeghi, Karim Eldefrawy, Norrathep Rattanavipanon, Gene TsudikAbstract:Remote attestation (RA) is a means of Malware detection, typically realized as an interaction between a trusted verifier and a potentially compromised remote device (prover). RA is especially relevant for low-end embedded devices that are incapable of protecting themselves against Malware Infection. Most current RA techniques require on-demand and uninterruptible (atomic) operation. The former fails to detect transient Malware that enters and leaves between successive RA instances; the latter involves performing potentially time-consuming computation over prover's memory and/or storage, which can be harmful to the device's safety-critical functionality and general availability. However, relaxing either on-demand or atomic RA operation is tricky and prone to vulnerabilities. This paper identifies some issues that arise in reconciling requirements of safety-critical operation with those of secure remote attestation, including detection of transient and self-relocating Malware. It also investigates mitigation techniques, including periodic self-measurements as well as interruptible attestation modality that involves shuffled memory traversals and various memory locking mechanisms.
Xuxian Jiang - One of the best experts on this subject based on the ideXlab platform.
-
AirBag: Boosting Smartphone Resistance to Malware Infection
Proceedings of the 21th …, 2014Co-Authors: Chiachih Wu, Yajin Zhou, Kunal Patel, Zhenkai Liang, Xuxian JiangAbstract:Recent years have experienced explosive growth of smartphone sales. Inevitably, the rise in the popularity of smartphones also makes them an attractive target for attacks. In light of these threats, current mobile platform providers have developed various server-side vetting processes to block malicious applications (“apps”). While helpful, they are still far from ideal in achieving their goals. To make matters worse, the presence of alternative (less-regulated) mobile marketplaces also opens up new attack vectors, which necessitate client-side solutions (e.g., mobile anti-virus software) to run on mobile devices. However, existing client-side solutions still exhibit limitations in their capability or deployability. In this paper, we present AirBag, a lightweight OS-level virtualization approach to enhance the popular Android platform and boost our defense capability against mobile Malware Infection. Assuming a trusted smartphone OS kernel and the fact that untrusted apps will be eventually installed onto users’ phones, AirBag is designed to isolate and prevent them from infecting our normal systems (e.g., corrupting the phone firmware) or stealthily leaking private information. More specifically, by dynamically creating an isolated runtime environment with its own dedicated namespace and virtualized system resources, AirBag not only allows for transparent execution of untrusted apps, but also effectively mediates their access to various system resources or phone functionalities (e.g., SMSs or phone calls). We have implemented a proof-of-concept prototype on three representative mobile devices, i.e., Google Nexus One, Nexus 7, and Samsung Galaxy S III. The evaluation results with a number of untrusted apps, including real-world mobile Malware, demonstrate its practicality and effectiveness
Xavier Carpent - One of the best experts on this subject based on the ideXlab platform.
-
invited reconciling remote attestation and safety critical operation on simple iot devices
Design Automation Conference, 2018Co-Authors: Xavier Carpent, Ahmadreza Sadeghi, Karim Eldefrawy, Norrathep Rattanavipanon, Gene TsudikAbstract:Remote attestation (RA) is a means of Malware detection, typically realized as an interaction between a trusted verifier and a potentially compromised remote device (prover). RA is especially relevant for low-end embedded devices that are incapable of protecting themselves against Malware Infection. Most current RA techniques require on-demand and uninterruptible (atomic) operation. The former fails to detect transient Malware that enters and leaves between successive RA instances; the latter involves performing potentially time-consuming computation over prover's memory and/or storage, which can be harmful to the device's safety-critical functionality and general availability. However, relaxing either on-demand or atomic RA operation is tricky and prone to vulnerabilities. This paper identifies some issues that arise in reconciling requirements of safety-critical operation with those of secure remote attestation, including detection of transient and self-relocating Malware. It also investigates mitigation techniques, including periodic self-measurements as well as interruptible attestation modality that involves shuffled memory traversals and various memory locking mechanisms.
Shun Tobiyama - One of the best experts on this subject based on the ideXlab platform.
-
Malware Detection with Deep Neural Network Using Process Behavior
Proceedings - International Computer Software and Applications Conference, 2016Co-Authors: Shun Tobiyama, Tomonori Ikuse, Hajime Shimada, Takeshi YagiAbstract:Increase of Malware and advanced cyber-attacks are now becoming a serious problem. Unknown Malware which has not determined by security vendors is often used in these attacks, and it is becoming difficult to protect terminals from their Infection. Therefore, a countermeasure for after Infection is required. There are some Malware Infection detection methods which focus on the traffic data comes from Malware. However, it is difficult to perfectly detect Infection only using traffic data because it imitates benign traffic. In this paper, we propose Malware process detection method based on process behavior in possible infected terminals. In proposal, we investigated stepwise application of Deep Neural Networks to classify Malware process. First, we train the Recurrent Neural Network (RNN) to extract features of process behavior. Second, we train the Convolutional Neural Network (CNN) to classify feature images which are generated by the extracted features from the trained RNN. The evaluation result in several image size by comparing the AUC of obtained ROC curves and we obtained AUC= 0:96 in best case.