The Experts below are selected from a list of 1836 Experts worldwide ranked by ideXlab platform

Hui Yin - One of the best experts on this subject based on the ideXlab platform.

  • Sensitive system calls based packed Malware variants detection using principal component initialized MultiLayers neural networks
    Cybersecurity, 2018
    Co-Authors: Jixin Zhang, Zheng Qin, Kehuan Zhang, Hui Yin
    Abstract:

    Malware detection has become mission sensitive as its threats spread from computer systems to Internet of things systems. Modern Malware variants are generally equipped with sophisticated packers, which allow them bypass Modern machine learning based detection systems. To detect packed Malware variants, unpacking techniques and dynamic Malware analysis are the two choices. However, unpacking techniques cannot always be useful since there exist some packers such as private packers which are hard to unpack. Although dynamic Malware analysis can obtain the running behaviours of executables, the unpacking behaviours of packers add noisy information to the real behaviours of executables, which has a bad affect on accuracy. To overcome these challenges, in this paper, we propose a new method which first extracts a series of system calls which is sensitive to malicious behaviours, then use principal component analysis to extract features of these sensitive system calls, and finally adopt multi-layers neural networks to classify the features of Malware variants and legitimate ones. Theoretical analysis and real-life experimental results show that our packed Malware variants detection technique is comparable with the the state-of-art methods in terms of accuracy. Our approach can achieve more than 95.6\% of detection accuracy and 0.048 s of classification time cost.

  • ICCCN - Malware Variant Detection Using Opcode Image Recognition with Small Training Sets
    2016 25th International Conference on Computer Communication and Networks (ICCCN), 2016
    Co-Authors: Jixin Zhang, Zheng Qin, Hui Yin, Sheng Xiao
    Abstract:

    Malware detection becomes mission critical as its threats spread from personal computers to industrial control systems. Modern Malware generally equips with sophisticated anti-detection mechanisms such as code-morphism, which allows the Malware to evolve into many variants and bypass traditional code feature based detection systems. In this paper, we propose to disassemble binary executables into opcodes sequences, and then convert the opcodes into images. By comparing the opcode images generated from binary targets with the opcode images generated from known Malware sample codes, we can detect if the target binary executables contain variants of these known Malwares. Theoretical analysis and real-life experiments results show that Malware detection using visualized analysis is comparable in terms of accuracy, our approach can significantly improve 15\% of detection accuracy when the detection set contains a large quantity of binaries and the training set is small.

  • ICPADS - IRMD: Malware Variant Detection Using Opcode Image Recognition
    2016 IEEE 22nd International Conference on Parallel and Distributed Systems (ICPADS), 2016
    Co-Authors: Jixin Zhang, Zheng Qin, Hui Yin
    Abstract:

    Malware detection becomes mission critical as its threats spread from personal computers to industrial control systems. Modern Malware generally equips with sophisticated anti-detection mechanisms such as code-morphism, which allows the Malware to evolve into many variants and bypass traditional code feature based detection systems. In this paper, we propose to disassemble binary executables into opcodes sequences, and then convert the opcodes into images. By using convolutional neural network to compare the opcode images generated from binary targets with the opcode images generated from known Malware sample codes, we can detect if the target binary executables is malicious. Theoretical analysis and real-life experiments results show that Malware detection using visualized analysis is comparable in terms of accuracy, our approach can significantly improve 15% of detection accuracy when the detection set contains a large quantity of binaries and the training set is much smaller.

Jixin Zhang - One of the best experts on this subject based on the ideXlab platform.

  • Sensitive system calls based packed Malware variants detection using principal component initialized MultiLayers neural networks
    Cybersecurity, 2018
    Co-Authors: Jixin Zhang, Zheng Qin, Kehuan Zhang, Hui Yin
    Abstract:

    Malware detection has become mission sensitive as its threats spread from computer systems to Internet of things systems. Modern Malware variants are generally equipped with sophisticated packers, which allow them bypass Modern machine learning based detection systems. To detect packed Malware variants, unpacking techniques and dynamic Malware analysis are the two choices. However, unpacking techniques cannot always be useful since there exist some packers such as private packers which are hard to unpack. Although dynamic Malware analysis can obtain the running behaviours of executables, the unpacking behaviours of packers add noisy information to the real behaviours of executables, which has a bad affect on accuracy. To overcome these challenges, in this paper, we propose a new method which first extracts a series of system calls which is sensitive to malicious behaviours, then use principal component analysis to extract features of these sensitive system calls, and finally adopt multi-layers neural networks to classify the features of Malware variants and legitimate ones. Theoretical analysis and real-life experimental results show that our packed Malware variants detection technique is comparable with the the state-of-art methods in terms of accuracy. Our approach can achieve more than 95.6\% of detection accuracy and 0.048 s of classification time cost.

  • ICCCN - Malware Variant Detection Using Opcode Image Recognition with Small Training Sets
    2016 25th International Conference on Computer Communication and Networks (ICCCN), 2016
    Co-Authors: Jixin Zhang, Zheng Qin, Hui Yin, Sheng Xiao
    Abstract:

    Malware detection becomes mission critical as its threats spread from personal computers to industrial control systems. Modern Malware generally equips with sophisticated anti-detection mechanisms such as code-morphism, which allows the Malware to evolve into many variants and bypass traditional code feature based detection systems. In this paper, we propose to disassemble binary executables into opcodes sequences, and then convert the opcodes into images. By comparing the opcode images generated from binary targets with the opcode images generated from known Malware sample codes, we can detect if the target binary executables contain variants of these known Malwares. Theoretical analysis and real-life experiments results show that Malware detection using visualized analysis is comparable in terms of accuracy, our approach can significantly improve 15\% of detection accuracy when the detection set contains a large quantity of binaries and the training set is small.

  • ICPADS - IRMD: Malware Variant Detection Using Opcode Image Recognition
    2016 IEEE 22nd International Conference on Parallel and Distributed Systems (ICPADS), 2016
    Co-Authors: Jixin Zhang, Zheng Qin, Hui Yin
    Abstract:

    Malware detection becomes mission critical as its threats spread from personal computers to industrial control systems. Modern Malware generally equips with sophisticated anti-detection mechanisms such as code-morphism, which allows the Malware to evolve into many variants and bypass traditional code feature based detection systems. In this paper, we propose to disassemble binary executables into opcodes sequences, and then convert the opcodes into images. By using convolutional neural network to compare the opcode images generated from binary targets with the opcode images generated from known Malware sample codes, we can detect if the target binary executables is malicious. Theoretical analysis and real-life experiments results show that Malware detection using visualized analysis is comparable in terms of accuracy, our approach can significantly improve 15% of detection accuracy when the detection set contains a large quantity of binaries and the training set is much smaller.

Zheng Qin - One of the best experts on this subject based on the ideXlab platform.

  • Sensitive system calls based packed Malware variants detection using principal component initialized MultiLayers neural networks
    Cybersecurity, 2018
    Co-Authors: Jixin Zhang, Zheng Qin, Kehuan Zhang, Hui Yin
    Abstract:

    Malware detection has become mission sensitive as its threats spread from computer systems to Internet of things systems. Modern Malware variants are generally equipped with sophisticated packers, which allow them bypass Modern machine learning based detection systems. To detect packed Malware variants, unpacking techniques and dynamic Malware analysis are the two choices. However, unpacking techniques cannot always be useful since there exist some packers such as private packers which are hard to unpack. Although dynamic Malware analysis can obtain the running behaviours of executables, the unpacking behaviours of packers add noisy information to the real behaviours of executables, which has a bad affect on accuracy. To overcome these challenges, in this paper, we propose a new method which first extracts a series of system calls which is sensitive to malicious behaviours, then use principal component analysis to extract features of these sensitive system calls, and finally adopt multi-layers neural networks to classify the features of Malware variants and legitimate ones. Theoretical analysis and real-life experimental results show that our packed Malware variants detection technique is comparable with the the state-of-art methods in terms of accuracy. Our approach can achieve more than 95.6\% of detection accuracy and 0.048 s of classification time cost.

  • ICCCN - Malware Variant Detection Using Opcode Image Recognition with Small Training Sets
    2016 25th International Conference on Computer Communication and Networks (ICCCN), 2016
    Co-Authors: Jixin Zhang, Zheng Qin, Hui Yin, Sheng Xiao
    Abstract:

    Malware detection becomes mission critical as its threats spread from personal computers to industrial control systems. Modern Malware generally equips with sophisticated anti-detection mechanisms such as code-morphism, which allows the Malware to evolve into many variants and bypass traditional code feature based detection systems. In this paper, we propose to disassemble binary executables into opcodes sequences, and then convert the opcodes into images. By comparing the opcode images generated from binary targets with the opcode images generated from known Malware sample codes, we can detect if the target binary executables contain variants of these known Malwares. Theoretical analysis and real-life experiments results show that Malware detection using visualized analysis is comparable in terms of accuracy, our approach can significantly improve 15\% of detection accuracy when the detection set contains a large quantity of binaries and the training set is small.

  • ICPADS - IRMD: Malware Variant Detection Using Opcode Image Recognition
    2016 IEEE 22nd International Conference on Parallel and Distributed Systems (ICPADS), 2016
    Co-Authors: Jixin Zhang, Zheng Qin, Hui Yin
    Abstract:

    Malware detection becomes mission critical as its threats spread from personal computers to industrial control systems. Modern Malware generally equips with sophisticated anti-detection mechanisms such as code-morphism, which allows the Malware to evolve into many variants and bypass traditional code feature based detection systems. In this paper, we propose to disassemble binary executables into opcodes sequences, and then convert the opcodes into images. By using convolutional neural network to compare the opcode images generated from binary targets with the opcode images generated from known Malware sample codes, we can detect if the target binary executables is malicious. Theoretical analysis and real-life experiments results show that Malware detection using visualized analysis is comparable in terms of accuracy, our approach can significantly improve 15% of detection accuracy when the detection set contains a large quantity of binaries and the training set is much smaller.

Lucia Vǎcariu - One of the best experts on this subject based on the ideXlab platform.

  • FPGA - Storage Mirroring for Bare-Metal Systems on FPGA Devices
    Proceedings of the 2019 ACM SIGDA International Symposium on Field-Programmable Gate Arrays, 2019
    Co-Authors: Dan Cristian Turicu, Octavian Cret, Lucia Vǎcariu
    Abstract:

    Malicious applications, Malware, continue to be a major security threat for computer systems. Due to the fast growing number and increasing complexity of Malware, manual analysis became impractical and automated methods are preferred by security analysts. The automated dynamic analysis of Malware executes the samples in controlled environments and monitors the execution for potentially malicious behavior. The vulnerability of this method is that Modern Malware detect these emulated or virtualized environments and suspend their malicious activities to foil the analysis. However, the Malware exhibit a semantically different behavior when running directly on computer system hardware, i.e. bare-metal systems. Consequently, the ultimate technique for analyzing the behavior of Malware is through execution of the samples in bare-metal analysis environments. Nevertheless, restoring the system to a clean state after each sample analysis is challenging. In order to restore the storage device state of a bare-metal system to a clean state, in this paper we propose an FPGA-implemented storage mirroring technique for instantaneous restoration of the storage device and, optionally, the retrieval of the files having been modified during the sample execution. The FPGA-based system can be integrated in commodity computer systems with Serial ATA storage devices. The retrieval of modified files is supported for systems running Windows operating systems with NTFS file-system. The experimental results demonstrate the viability of the solution.

Yu-feng Huang - One of the best experts on this subject based on the ideXlab platform.

  • A New Malware Classification Approach based on Statistical Feature
    DEStech Transactions on Computer Science and Engineering, 2017
    Co-Authors: Ying Fang, Yu-feng Huang
    Abstract:

    Malware variants which use obfuscation and metamorphism techniques are seen as a critical security threat. Machine learning based Malware classification techniques are able to discriminate different Malware families and improve existing anti-Malware tools. However, high dimensional feature space brings a higher time overhead and one-sided feature can decreases the accuracy. To solve this issue, we propose a statistical feature based Malware classification approach and a new feature selection method which can select strong discriminative features. The results demonstrate that the proposed approach can classify Modern Malware variants effectively.