A. Shabtai's research while affiliated with Ben-Gurion University of the Negev and other places

Publications (7)

Article
Today, organizations have limited resources available to allocate to the detection of complex cyber-attacks. In order to optimize their resource allocation, organizations must conduct a thorough risk analysis process so as to focus their efforts and resources on the protection of the organization's important assets. In this study we propose a frame...
Conference Paper
Email communication carrying malicious attachments or links is often used as an attack vector for initial penetration of the targeted organization. Existing defense solutions prevent executables from entering organizational networks via emails, therefore recent attacks tend to use non-executable files such as PDF. Machine learning algorithms have r...
Article
In this paper we present a new behavior-based anomaly detection system for detecting meaningful deviations in a mobile application's network behavior. The main goal of the proposed system is to protect mobile device users and cellular infrastructure companies from malicious applications by: (1) identification of malicious attacks or masquerading ap...
Article
Full-text available
Google's Android is a comprehensive software framework for mobile communication devices (i.e., smartphones, PDAs). The Android framework includes an operating system, middleware and a set of key applications. The incorporation of integrated access services to the Internet on such mobile devices, however, increases their exposure to damages inflicte...
Conference Paper
In this paper, we present a new pricing scheme for IP networks, in which the payment is collected on a per-packet basis on each router on the packet path. The DiffServ protocol is used to carry the users' required services level. The proposed pricing scheme is analyzed by using network simulations for four scenarios. The first illustrated, which is...

Citations

... At present, social networks play an important role in the daily lives of many people. In this regard, these online networks have changed the way individuals perceive the world, as people now have the convenience of communicating information directly without boundaries [1]. ...
... Mining Layer performs the task of information extraction from the cloud database. Various data sets are stored in the form of temporal instances, therefore in the current scenario, information mining is performed by Temporal Mining Technique [31,36,39]. Moreover, since events persist temporal diversity i.e. there are some events that requires continuous sensation (heart rate, and temperature) while other require instantaneous sensing (meal, and cleanliness), data abstraction using temporal mining will result in useful information from wider perspectives. ...
... Among PDF-related attacks, constructing document vulnerabilities by exploiting defects of Adobe software is extremely harmful [2][3][4][5]. Through exploiting the vulnerabilities of document readers or parsers, such attacks can cause various types of harm, including downloading malicious programs remotely, implementing backdoor implantation, and executing malicious code directly. ...
... The rationale was that malware might use more energy, due to the nature of work it accomplishes. Secondly, Shabtai et al. (2014) focused on network operations to detect maliciousness. They utilize deviations from an app's "normal" network behavior, as a sign of anomaly that can reveal malware. ...
... Considering the conditions, Android malware strives on, briefed in their study about the rapid increase in loopholes that come along with legitimate apps. They concluded that 80% of the Android executables consisted of manifest files with malicious codes [4]. Apparently, the new methods were researched upon for better representation of detection techniques. ...
... Numerous pricing schemes have been presented, which have used different approaches as Figure 2 depicts. Such schemes can be classified into: Auction Pricing Schemes [19], [20], [21], [22], [23], [24], [25], [26], or Priority Pricing Schemes [27], [28], [29], [30], as well as, Game Theoretic Pricing Schemes [31], [32], [33], [34], [35], [36], Assignment Pricing Schemes [37], [38], or use Rate Adaptation Pricing Schemes [39], Broadcasting Pricing Schemes [40], [41], or Probabilistic Pricing Schemes [42], [43], and Service Electronic Payment Pricing Schemes [44], [45] in order to support the need of interconnection. A dynamic mechanism is used also with a Programmable Pricing Schemes, aiming to allocate the network resources in case of congestion [46]. ...