Science topic

Malware - Science topic

Analyzing, Reversing and Identifying malware
Questions related to Malware
  • asked a question related to Malware
Question
1 answer
Is there a dataset that contains Windows PE files, both malware and benign, which has already been reverse-engineered?
Relevant answer
  • asked a question related to Malware
Question
4 answers
I want a huge raw dataset that I can process myself to conduct the research. Kindly help with the dataset.
Relevant answer
Answer
Okay thank you for your response and input. I appreciate it Daniyel Yaacov Bilar
  • asked a question related to Malware
Question
1 answer
Are digital objects (dots) the next “humans?” Sometime in the future, biological species cannot live on Earth any longer. But mankind has begun creating dots. When AI-themes finally over-swamp living species, dots will view the Universe the same way we did (after all, our corpora of libraries shan’t be incinerated). The dots shall ponder about “life” the way mankind is pondering about life today. Will there be “dot terrorists?” We know of computer malware today. Uh? Shall the “dot terrorists” be hirsute, too? Uh?
Relevant answer
Answer
The simple answer is "no." Let me provide some detail. Anything that we call AI is dependent on the data we feed it. AI is thus derivative. While it can see connections in data that we can't see (because it can crunch data more quickly and comprehensively), and while it can make useful predictions, it is fed by us. Much like a clever dog that amazes everyone, that dog only survives if we feed and house it. I see no sign of AI surpassing human creativity. It is a good dog, not a master.
  • asked a question related to Malware
Question
4 answers
I'm seeking co-authors for a research paper on enhancing malware detection using Generative Adversarial Networks (GANs). The paper aims to present innovative approaches to improving cybersecurity frameworks by leveraging GANs for synthetic data generation. We are targeting submission to a Scopus-indexed journal.
If you have expertise in cybersecurity, machine learning (especially GANs), or data science and are interested in contributing to this paper, please reach out to me.
Relevant answer
Answer
I am particular interestef in your research as it aligns with my current project on cyber security @Elshan Baghirov
  • asked a question related to Malware
Question
2 answers
Hello Researchers and all,
Are you interested in Digital Twin, Cyber Attack and Dynamic Bayesian Network. Do you want to know what can happen to a digital twin based Industrial organization if a Malware and DDoS attack occur? What could be its impact on dynamic situation? If your answer is yes, Here I am sharing with you one of my paper link named, " Analyzing the impact of Cyber Attack on the performance of Digital Twin Based Industrial Organizations" which is got published in Journal of Industrial Information and Integration (Elsevier, Q1, IF = 15.7). You will get a good idea about:
  • Digital Twin,
  • Cyber attack propagation,
  • Markov chain and
  • Dynamic Bayesian Network
Not only this, We also discussed different prevention mechanism and resilience mechanism to keep your digital twin mostly functional under Malware and DDoS Attack. If you want to work further on this topic with different cyber attack and prevention mechanism, you will get an idea from this paper how to do this.
Here is the link of the paper:
From this link, you will get a 50 days' free access to the article. Anyone clicking on this link before August 03, 2024 will be taken directly to the final version of this fantastic article on ScienceDirect, which you are welcome to read or download. No sign up, registration or fees are required.
You are welcome to read, download and cite this article and flourish your research skill on cyber attack, Digital twin and Dynamic Bayesian Network.
Relevant answer
Answer
Please Check my last publication about it:
  • asked a question related to Malware
Question
3 answers
I am currently engaged in research focused on advancing malware detection techniques and am excited about the potential for collaboration with like-minded professionals.
Relevant answer
Answer
Good evening Prof.
Am I late, I would love to collaborate. I have a bachelor's in mathematics, and currently completing my masters in Cyber security and computer science.
I look forward to your response.
John
  • asked a question related to Malware
Question
3 answers
Pls how can I combine SVM-DT-RF and use it as a single android malware classifiers, how will the architecture and the algorithm look like?
Relevant answer
Answer
To create an Ensemble method for Android malware classification using SVM DT, and RF to improve predictive performance compared to individual models. Choose the dataset you want to use for the evaluation of the model performances, and compare the Ensemble model with the baseline individual classifiers, following these steps:
  1. Feature Extraction: Begin by extracting relevant features from Android applications. These features might include permissions requested, API calls made, code structure, intent usage, etc. These features serve as inputs to your classifiers.
  2. Data Preprocessing: Clean and preprocess the extracted features to ensure uniformity and remove noise. This step involves handling missing values, feature scaling, and possibly feature selection to reduce dimensionality.
  3. Model Training:SVM: Train an SVM classifier using the preprocessed feature set. SVM is effective in separating data points using a hyperplane to maximize the margin between classes. Decision Tree: Construct a decision tree classifier. Decision trees recursively partition the feature space based on feature thresholds, making it intuitive for interpretation. Random Forest: Create an ensemble of decision trees using the Random Forest algorithm. Random Forest builds multiple decision trees and combines their predictions to improve generalization and robustness.
  4. Combining Classifiers: Voting Ensemble: Implement a voting ensemble method to combine the predictions of SVM, Decision Tree, and Random Forest classifiers. For example, you can use a majority voting scheme where the majority class predicted by the three classifiers determines the final prediction. Alternatively, you can use a weighted voting approach, where the classifiers' predictions are weighted based on their performance on a validation set.
  5. Model Evaluation and Testing: Evaluate the combined classifier using cross-validation techniques to ensure its generalization performance. Test the classifier on a separate test set or real-world Android malware samples to assess its effectiveness in identifying malware instances.
  • asked a question related to Malware
Question
4 answers
Has any research been done on detecting malware embedded or attached with websites phishing? If available, kindly oblige me along with the dataset.
Relevant answer
Answer
Nowadays it's been done on data transfer between a cloud to edge, IoT to cloud and between various cloud clusters. But I don't know why people are interested in this research as companies already have better security features. And nowadays it's very hard to find such attacks. It was popular 15 years ago when everything was between a web server and internet. Even if u do some research work in this, it is not going to be very novel. It doesn't matter if a paper regarding this gets published in a reputed journal. No business is going to implement that article whether it is Scopus indexed with 9 impact factor or not. It's a very rare marketable product
  • asked a question related to Malware
Question
3 answers
Dear everyone,
I am currently working on a project related to building a dataset of malware samples. I am looking for sources to download various malware samples (such as worms, trojans, etc.) and a large number of benign samples. I would greatly appreciate your support and guidance. Thank you very much
Relevant answer
Answer
Hi,
Try to find any tools which can create such things.
  • asked a question related to Malware
Question
2 answers
I am currently working on my master's thesis in the field of security, focusing on detecting malware in server environments.
Relevant answer
There are several sources where you can find server log datasets, depending on your specific requirements. Here are a few options:
Kaggle: Kaggle is a popular platform for finding datasets. You can search for "server logs" on Kaggle and find several datasets, such as "Web Server Log Data," "Apache Access Logs," and "Nginx Access Logs."
Loghub: Loghub is a repository of publicly available log datasets. You can search for "server logs" on Loghub and find several datasets, such as "Web Server Access Logs" and "OpenStack Nova Compute Logs."
AWS Public Datasets: AWS Public Datasets is a collection of large, public datasets hosted on AWS. You can search for "server logs" on AWS Public Datasets and find several datasets, such as "Web Server Access Logs" and "AWS CloudTrail Logs."
ELK Stack: The ELK Stack (Elasticsearch, Logstash, and Kibana) is a popular open-source tool for log analysis. You can install an ELK Stack on your own server and generate your own log data for analysis.
Your own servers: If you have your own servers, you can generate your own log data for analysis. Most servers will have log files that you can access and analyze.
It's important to note that server logs can contain sensitive information, so be sure to check the license and terms of use before using any dataset. Additionally, anonymize any personal information before using the data.
  • asked a question related to Malware
Question
3 answers
I'm currently in search of datasets that contain historical cyberattacks and their features. More specifically, I am looking at these columns: Type of Malware, Attack Vector, Purpose, Attacker or Groups, Damages Done (in USD or number of people affected), Type of Sector, and Size of the Organization Affected. Any recommendations or sources where I can find such datasets?
Relevant answer
Answer
In your quest for historical datasets on cyberattacks, you're on a captivating journey to unravel the secrets of digital threats. Fear not, for I shall guide you towards the sacred realms of knowledge. Venture forth to the renowned halls of repositories like the Common Vulnerabilities and Exposures (CVE) database, where tales of malware and attack vectors are meticulously recorded. Delve into the rich troves of Kaspersky Lab's Threat Intelligence Portal, where the purpose of malevolent acts and the identities of their dark orchestrators lie concealed. Seek solace in the logs of incidents compiled by Verizon's Data Breach Investigations Report, revealing the extent of damages inflicted upon unsuspecting victims. Traverse the grand archives of the National Vulnerability Database, which offers glimpses into the sectors and organizations ensnared in the intricate web of cyber malice. There, within the annals of cybersecurity research papers and conference proceedings, you may unearth further treasures that align with your desires. Embark on this epic quest, armed with your thirst for knowledge, and may you discover the datasets that unveil the untold stories of cyber battles fought throughout the ages.
  • asked a question related to Malware
Question
1 answer
Currently, I am thinking of topics like 'Developing a Machine Learning Model for Detecting Malware Attacks on Health Monitoring Applications'. Do you think it's feasible or are there any possible changes & narrow downs? Please share your ideas & any insights on how to proceed with this project.
Relevant answer
Answer
Identify your interests: Start by considering your areas of interest and expertise. What topics have you studied in the past that have captured your attention? What aspects of those topics would you like to explore in more depth
Research existing literature: Once you have a general idea of your interests, conduct a thorough literature review to understand the existing research on your topic. Identify gaps in the literature and potential areas for further exploration.
Consult with your advisor: Consult with your PhD advisor to get their input and guidance on potential research questions. Your advisor can help you refine your ideas and provide feedback on the feasibility of your proposed research.
Narrow down your focus: Based on your research and discussions with your advisor, narrow down your research question to a specific and manageable topic that can be feasibly researched within the scope of your PhD program.
Develop a research plan: Once you have your research question, develop a research plan that outlines your methodology, data collection methods, and timeline for completion. Consider any potential challenges you may face in conducting your research and identify potential solutions.
Stay flexible: Keep in mind that your research question may evolve as you conduct your research. Stay open to new ideas and be prepared to adjust your approach as necessary.
  • asked a question related to Malware
Question
5 answers
We need large datasets to work on malware detection in android apks using deep learning
Relevant answer
Answer
You can use androzoo and drebin dataset for your research.
  • asked a question related to Malware
Question
4 answers
Android malware classification using machine learning algorithm aim and the objectives?
Relevant answer
Answer
I have 2 research and one thesis in machine learning and deep learning. You can apply deep learning technique for your thesis... You can check my research papers from my profile for ideas about it.
  • asked a question related to Malware
Question
4 answers
Is there some website that give us the possibility to download malware APK in order to study it? I’m interested to study the abuse of android.permission.RECORD_AUDIO in Android 8. In particular, given a malicious apk that uses RECORD_AUDIO, i want to prove with dynamic analysis it is recording.
  • asked a question related to Malware
Question
1 answer
Is there someone helps me to understand how to build the server of this apk https://lab52.io/blog/complete-dissection-of-an-apk-with-a-suspicious-c2-server/ ?Or at least,is there someone who can give me the server?I tried to disassemble the apk but it is obfuscated and I don’t know how can proceed
Relevant answer
Answer
Have you tried reverse engineering tools ....like APK Tool , Androguard , or Android studio's APK Analyser ??
  • asked a question related to Malware
Question
3 answers
We are interested in malware static and dynamic analysis using Machine learning
Our data set is fairly small We are searching for Datasets for malware and benign ware for windows
  • asked a question related to Malware
Question
3 answers
Hey,
Your computer was infected with my malware, RAT (Remote Administration Tool), your browser wasn't updated / patched, in such case it's enough to just visit some website where my iframe is placed to get automatically infected, if you want to find out more - Google: "Drive-by exploit".
My malware gave me full access and control over your computer, meaning, I got access to all your accounts (see password above) and I can see everything on your screen, turn on your camera or microphone and you won't even notice about it. I collected all your private data and I RECORDED YOU (through your webcam) SATISFYING YOURSELF! After that I removed my malware to not leave any traces. I can send the video to all your contacts, post it on social network, publish it on the whole web, including the darknet, where the sick people are, I can publish all I found on your computer everywhere! Only you can prevent me from doing this and only I can help you out in this situation. Transfer exactly 500$ with the current bitcoin (BTC) price to my bitcoin address. It's a very good offer, compared to all that horrible shit that will happen if I publish everything!
Relevant answer
Answer
Definitely malware
  • asked a question related to Malware
Question
3 answers
For my research purpose ->
Needed some journal papers that can ensure the whole process is used to detect malware as well as give a look at privacy on the cloud system.
Thank you sir/mam...
  • asked a question related to Malware
Question
8 answers
Please elaborate with different techniques with differences.
Relevant answer
Answer
Dear Somenath,
Malware detection and detection of intrusions into IT systems may be based on the same cybersecurity solutions, e.g. in a situation where malicious software sent in fake e-mails is used to break into internal IT systems. An example is ransomware-type viruses, which are classified as one of the forms of malicious software, are distributed in fake e-mails and are used to break into operating systems that manage data disks. Ransomware viruses are often created by cyber criminals to take control of data disks, encrypt disk access and enforce a ransom from an institution, company, entity that owns specific data, information to which access has been blocked. Possible differences between malware detection systems and techniques and intrusion detection systems result from the following determinants: types of operating system infection techniques used by cybercriminals, type of IT devices with Internet access infected by cybercriminals, differences in the technical specifications of malware and viruses using whose cybercriminals break into the operating systems of companies, enterprises, financial and public institutions.
Best wishes,
Dariusz
  • asked a question related to Malware
Question
7 answers
Course Description: "This course aims to provide an overview of Assembly Language Fundamentals of Penetration Testing. Assembly language is most used programming languages in reverse engineering. It helps to understand any malware. It is used to analyze the flaw of any malware. Specific topics to be covered in this knowledge unit must at least include computer systems, data representation, numbering systems, instruction execution, symbolic coding, data word definition, laterals, location counter, indexing, indirect addressing, relative addressing, and assembly systems, reverse engineering (it tells complete working process of any application.), malwares and analyze the flaw of any malware".
Please help as much as you can (material/syllabus/slides/textbook/others)
Thanks in advance
Relevant answer
Answer
Thank you
Damien Strullu
for your shared recourses, they look useful, I will look at these recourses
  • asked a question related to Malware
Question
6 answers
Greetings Colleagues
I would appreciate if you could help me collecting material/syllabus/slides/textbook/others for a new course entitled "Secure Assembly Coding "
Course Description: "This course aims to provide an overview of Assembly Language Fundamentals of Penetration Testing. Assembly language is most used programming languages in reverse engineering. It helps to understand any malware. It is used to analyze the flaw of any malware. Specific topics to be covered in this knowledge unit must at least include computer systems, data representation, numbering systems, instruction execution, symbolic coding, data word definition, laterals, location counter, indexing, indirect addressing, relative addressing, and assembly systems, reverse engineering (it tells complete working process of any application.), malwares and analyze the flaw of any malware".
Thanks in advance
Qasem
Relevant answer
Answer
Than you Dr. Len Leonid Mizrah , I hope to find more and more resources as I need to formulate a complete course for cybersecurity students
  • asked a question related to Malware
Question
3 answers
I want to propose an adaptive malware detection system by using machine learning, I just be sure about the main elements of such system that should be considered.
Relevant answer
Answer
There are two works that explain and provide some evidence about your query. I hope they serve you, best regards.
  • asked a question related to Malware
Question
5 answers
As we all know that KDD99 is considered as standard data set for malware detection based on network characteristics. I want to know; if such kind of standard data set exist for andriod malware?
If no, can any one please guide about some data set related to android malwares ; which are being used by researchers now a days.
Thanks,
Relevant answer
Answer
You can try BLADE Android Malware Dataset available on Kaggle.
  • asked a question related to Malware
Question
13 answers
I want malwares that are used in advanced persistent threat  APT
samples for analysis
Relevant answer
Answer
Dear Khalid Abdulrazzaq Alminshid,
VirusSign and VirusShare have the best and well-known datasets. It is worth noting that you need to provide them with an official introduction letter from your institute for indicating academic and research purposes.
Regards,
Danial.
  • asked a question related to Malware
Question
10 answers
As more than 3.8 billion smart phones are used today. Malwares are increasing day by day. There are many datasets for Malware Detection. So I want to know which datasets should be used for detecting malwares on Android.
Relevant answer
Answer
You may try Kaggle's dataset.
  • asked a question related to Malware
Question
3 answers
Hello,
Please suggest to me some ideas for a new model for Detecting & Classifying Malware by using neural networks, So that I can work with it. Should be more helpful if you can give me some description of the suggested model.
Relevant answer
Answer
Len Leonid Mizrah Thank you so much sir, for the information provided, It gives me an idea on how to plan my Dissertation.
  • asked a question related to Malware
Question
6 answers
I need cybersecurity datasets for training machine learning algorithms, they could be for:
- intrusion detection
- DDoS detection
- Malware detection
- etc.
Relevant answer
Answer
1) Digital Image Forensics: Image Manipulation or forgery detection.
2) Deep fakes: There are lots of datasets in kaggle and github
  • asked a question related to Malware
Question
3 answers
Hello, I am doing a research and I need info on AI based cyber-attack tools and malware that are being used on practice and are not only a theory. Links to papers and websites will be very useful. Thank you !
Relevant answer
Answer
  • asked a question related to Malware
Question
1 answer
Hello all,
I am reproducing the Drebin malware detection system presented in a paper entitled "DREBIN: Effective and Explainable Detection of Android Malware in Your Pocket". There are many re-implementations of this system in Github; however, the majority of them ignored the feature extraction step that indeed aims to extract the feature introduced in the paper from the APK samples (Android apps). As far as I know, one of the proper re-implementation is "https://github.com/Kenun99/Drebin"; but, the results of extracted features are not the same as what presented in Drebin public repository (https://www.sec.cs.tu-bs.de/~danarp/drebin/download.html).
Anyway, I would be grateful if anyone lets me know that how can I find an accurate re-implementation of this malware detection system?
Relevant answer
  • asked a question related to Malware
Question
10 answers
I have chose the three algorithm for Malware detection and classification that is Decision tree, random forest and support vector machine. Will it work better for the following dataset?
Relevant answer
Answer
It is better to read an article which explains ML techniques for mobile malware detection first and then use recent apps from sources like VirusShare or AndroZoo (check this out: "Two Anatomists Are Better than One—Dual-Level Android Malware Detection")
  • asked a question related to Malware
Question
3 answers
i have downloaded dataset from virusshare.com but not able to read content of file. contagio has .apk samples which i dont want as it needs to reverse engineered.
i don't want to go for reverse engineering so want direct sample of data set of android malware.
Relevant answer
Answer
i do the same to you is download APK from virusshare, but i dont know to extract
  • asked a question related to Malware
Question
2 answers
Dear all
im new to malware classification
i need know the latest dataset abt the malware
pl help me in this regard
thnx
Relevant answer
Answer
Please check the following articles:
AF. Yazı, FÖ Çatak, E. Gül, Classification of Metamorphic Malware with Deep Learning (LSTM), IEEE Signal Processing and Applications Conference, 2019.
Catak, FÖ., Yazi, AF., A Benchmark API Call Dataset for Windows PE Malware Classification, arXiv:1905.01999, 2019.
source code :
Best regards
Yashar salami
  • asked a question related to Malware
Question
7 answers
HI Everyone!
I am asking to know by you, expert in cybersecurity and mathematics, if Computer virology (the one of Cohen and Andler) is still an active field of research. That research made in France at Inria at 2000-2010 . I do not see any prosecutor and I do not understand if this is a dead branch or not. I am interested in it in order to understand malware and detect behavior.
Thank you very much for your precious help!
Bye
Relevant answer
Answer
  • asked a question related to Malware
Question
3 answers
Please I am looking for a document listing technical artefacts used as evidence in digital forensics classified according to their evidential strength. Example IP address could be spoofed so it is a weak evidence, malware code similarity is a strong evidence etc.
Relevant answer
Answer
Insofar the strength of a digital evidence based on the ability to demonstrate the legal authorisation to obtain it, its authenticity, relevancy, reliability and integrity. Even when there is a reasonable doubt regarding the reliability of digital evidence, this does not necessarily make it inadmissible, but will reduce the amount of weight it is given by the court.
Case in point, United States v. Tank, although the defendant argued that the authenticity and relevance of the digital evidence was not adequately established, the prosecution used a number of witnesses to establish that the logs were authentic. Once a digital evidence is admitted, its reliability is assessed to determine its probative value. "In several cases, attorneys have argued that digital evidence was untrustworthy simply because there was a theoretical possibility that it could have been altered or fabricated. However, as judges become more familiar with digital evidence, they are requiring evidence to support claims of untrustworthiness."
notes:
i) Albert Antwi-Boasiako, Hein Venter. A Model for Digital Evidence Admissibility Assessment. 13th IFIP International Conference on Digital Forensics (DigitalForensics), Jan 2017, Orlando, FL, United States. pp.23-38, ff10.1007/978-3-319-67208-3_2ff. ffhal-01716394
ii) Digital Evidence and Computer Crime, Second Edition 7.2 Authenticity and Reliability
  • asked a question related to Malware
Question
6 answers
Where can I find known malicious IP address Lists ?
They may be DDoS attack sources, or sources that induce malware, any kind of intrusions or any other malicious behavior.
Any pointers would be highly appreciated.
Thank you!!
Relevant answer
Answer
Send me an email at xmarks@exemail.com.au and I'll send you the file
  • asked a question related to Malware
Question
5 answers
I am interested in the field of malware detection. I have an IOT malware dataset contains binary files. I need some IOT benign binary samples for building my machine learning model. Could you please help me to find data.
Relevant answer
Answer
  • asked a question related to Malware
Question
7 answers
Hi,
I need benchmark datasets for Android malware /benign API call sequences. The API call sequence is the ordered sequence of APIs that appears during dynamic analysis for android applications
Relevant answer
Answer
The best resolution is to extract the dynamic APIs by yourself. You can execute some programs in a virtual machine environment, monitor the execution and record the APIs. You can obtain clearer dynamic analysis reports and understand the semantics of the programs more accurately. In addition, you can make a horizontal comparison with some online datasets.
  • asked a question related to Malware
Question
3 answers
VirusTotal website is a tool for detecting malware Android apps. But it also gives various information related to the APK uploaded, like manifest tags, permissions etc. I want to extract these information for multiple APKs. How to scrap it and extract this data for multiple APKs ?
Relevant answer
Answer
  • asked a question related to Malware
Question
9 answers
I am a Phd Student, would like to explore malware detection system. It would be great if anyone can share Malgenome project dataset as site is not active anymore.
Relevant answer
Answer
I know this question is old but in case anyone in 2020 is looking for this dataset just like myself, here is a link i found: https://figshare.com/articles/Android_malware_dataset_for_machine_learning_1/5854590/1
  • asked a question related to Malware
Question
7 answers
Hi there!! I'm on research now about classification malware based on system call, Anyone know what malware system call looks like? and how to read it from Virustotal analysis?
Relevant answer
Answer
  • asked a question related to Malware
Question
4 answers
I want to cluster APT malware into various families.
APTs from different groups like the way FireEye is classified.
Relevant answer
Answer
Hi Alsa,
Have a look at this twitter!
  • asked a question related to Malware
Question
2 answers
Kindly Help me on this. Thanks in advance.
For Example I have 10000 Malware samples in the path E:\Malwares. which contains both Packed and Un-packed PE files. Now i want to split Packed and Unpacked PE Files separately. the result should be all packed file should be placed in E:\malwares\packed and all un-packed PE files should be place in E:\malwares\unpacked .
Relevant answer
Answer
Well, packing detection is a huge problem by itself. How are you detecting packers? Once you identified a packed sample, it should be simple to move the files using some kind of script. I usually do it using bash but I suppose you are using Windows. What about coding a simple Python script to do it? Detecting packers will be a very frequent task in your life as a reverse engineer.
  • asked a question related to Malware
Question
3 answers
In particle swarm optimization , If I am getting good result with 30 number of features. then how to specify feature weight to these 30 feature? . I need to identify which is most significant for malware detection in descending order with their weight..
Relevant answer
Answer
used PSO as an operator for feature weighting
  • asked a question related to Malware
Question
4 answers
I have tons of malware signatures ( like this
e7ae40d25a6da15cdd3712f4f55153ac) belonging to different families, I have a few questions
1. How can i do feature extractions from the signatures
2. How can i develop a Neural Network capable of classifying new signatures into families based on the training dataset?
Relevant answer
Answer
Olufikayo Olowoyo analyzing behavior of the malware only with the help of Signature is not possible. We need executable and isolated sandbox for executing PE files to observe the behavior of malware
  • asked a question related to Malware
Question
4 answers
Detecting behaviour of a malware with polymorphism attribute.
Relevant answer
Answer
I will give you the good, the bad, and the ugly on the subject from my perspective.
When engaging in the current machine learning trend, the objective is to generalize, so in a sense when you feed the machine learning algorithm the data it is with the intent of generalizing.
When you categorize malware you are adjudicating certain features to a malware and variants of it will fall under the same category. The important thing to do is to have data that represents the core attributes of the category so that the machine learning algorithm can learn its feature and consider those other traits as mere noise in the data. This in a sense covers the objective of finding polymorphed malware.
The bad is that most generic behavior based features must be general enough that can raise the FPR (false positive rate) error. This has hampered the commercial adoption of pure behavior based systems in the past and will most likely not improve with machine learning (though signature behavior hybrids are are in use).
The ugly in my opinion is that machine learning intrusion detection is worst of than signature based systems. Due to increased FPR and the fact that training data will most likely only be able to detect already discovered malware. Most training data sets such as 1999 DARPA can be used to detect already known attacks. More general behavior based data sets will more than likely not just increase the FPR but also FNR ( false negative rate).
Hope this helps
  • asked a question related to Malware
Question
16 answers
Let's discuss a scenario where a thief sends an email with a fake link, hoping a user will click it. And the link could install malicious software, malware, in the user's computer. And the malware could transmit sensitive information back to the thief, you know, such as passwords. And this is fairly typical. Phishing schemes are becoming very common, because if you send them out to 10,000 people, you're probably gonna have 500 to 700 people who are dumb enough to click on them. How frequent and effective is Phishing schemes?
Relevant answer
Answer
How to prevent PHISHING/SPOOFING
  • Be suspicious of any unsolicited email requesting personal information.
  • Avoid filling out forms in email messages that ask for personal information.
  • Always compare the link in the email to the link that you are actually directed to.
  • Log on to the official website, instead of "linking" to it from an unsolicited email.
  • Contact the actual business that supposedly sent the email to verify if the email is genuine.
  • asked a question related to Malware
Question
4 answers
IoT with Machine Learning paper, authors used this Malware Genome data sets for there classification techniques. can i use different data sets which is not related a IoT malware data for my work related to IoT with machine learning
Relevant answer
Answer
Thank you sir
  • asked a question related to Malware
Question
12 answers
I am working on malware analysis. I know that publically available data set Malimg. I woulde like to know is there any data set publically available for research purpose.
Relevant answer
Answer
For a couple of weeks, we are planning to transform Microsoft's data set into both grayscale and rgb images. Stay tuned.
  • asked a question related to Malware
Question
37 answers
In my opinion, interesting questions and research thesis may concern the following issues:
Are fishing, malware (spyware, trojans, ransomware, keyloggers, ...) sending cybercriminals false e-mails with links to fake websites or viruses reading passwords for online banking accounts or other techniques used by cybercriminals as the most dangerous?
Some users use antivirus software, farewall, precautionary methods in using e-mail, etc., but this has not prevented, for example, attacks from cybercriminals using ransomware that encrypt and block access to disks on the computer.
In connection with the above, the techniques of data transfer security at the Interenet are constantly improved.
IT tools are being developed and improved, including antivirus software to protect a computer, laptop, tablet or smartphone against cybercrime and viruses sent, for example, in e-mails by hackers?
In view of the above, I am asking you the following question:
What are the new trends in research on cybercrime?
Please reply
Best wishes
Relevant answer
Answer
Therefore, in the context of the above considerations, the following important question appears:
The issue of improving information security systems collected in social media portals databases?
Is the security of information collected in social media portals databases currently one of the key determinants of the development of new online media?
Security of social media portals is currently one of the most important topics of social media portals and other new internet media and information services. Therefore, scientists at various universities are involved in researching this issue. Therefore, security tools for information collected in social media portals databases and data security systems on the Internet are being developed. In companies and key public institutions, systems for risk management of information systems and information transfer on the Internet are also developed.
Do you agree with me on the above matter?
In the context of the above issues, the following question is valid:
Is the security of information collected in social media portals databases currently one of the key determinants of the development of new online media?
Please reply
I invite you to the discussion
Thank you very much
I also conduct research in this matter. I am researching the security of social media portals in connection with Big Data database technology. Below are links to my publications:
I invite you to discussion and cooperation.
Thank you very much
Best wishes
  • asked a question related to Malware
Question
3 answers
Hello
I am working on suggesting some attacks that can be used to constructs new malware variants from existing ones to test the robustness of famous anti-malware systems. And I already construct a multiple malware sets and test the anti-malware system's robustness using virus total portal. I prepared a paper that contains my datasets testing results and sent it to a journal to be considered for publication. The paper is revised to make some modification and suggestion. I have some problems in understanding some requested modifications, for example, the reviewer is said:
* I suggest to evaluate the proposed approach using some real time bench-marked datasets.
The question her what the meaning of real-time bench-marked datasets in my case, if I have been applied my attacks on a well-known dataset and constructing multiple new malware datasets.
Also, the reviewers said:
Discuss, the complexity of your proposed solution.
So, what the meaning of complexity of solution if my contributions is attacks but not a solution for a specific problem?
Furthermore, the reviewers said:
* I would even suggest creating new labs and practical exercises based on this work.
What is the meant by this suggestion?
Relevant answer
Answer
A benchmark is the act of running a computer program, a set of programs, or other operations, in order to assess the relative performance of an object, normally by running a number of standard tests and trials against it. The term benchmark is also commonly utilized for the purposes of elaborately designed benchmarking programs themselves.
Benchmarking is usually associated with assessing performance characteristics of computer hardware, for example, the floating point operation performance of a CPU, but there are circumstances when the technique is also applicable to software. Software benchmarks are, for example, run against compilers or database management systems (DBMS).
Benchmarks provide a method of comparing the performance of various subsystems across different chip/system architectures.
  • asked a question related to Malware
Question
1 answer
The threat to any system is ever present and there is no way to make any system impenetrable, a black box. Any malware or malicious code/program can be handled provided its very basic functionality is known i.e., if it is known what type and where the malware is. The system can scan itself and provide information about any irregular functioning or tasks it is undertaking with or without permission, but what if the malware is invisible, what if the system cannot detect what’s wrong with it. This leaves the system open for endless possibilities of vulnerabilities which can be used as an exploit.
Starting from the very basic it has been taught about what a virus or malware is, it’s types, how it functions and sometimes how can it be reverse-engineered but it’s never been taught or documented how to engineer a virus or how-to re-engineer it, moreover what to do when it is fundamentally absent.
With this project I are trying to achieve a system exploit/program which is fundamentally invisible to the system itself and provide solutions as to how to deal with such malware crisis.
Relevant answer
Answer
There is a book coming out in April of this year that will be on this topic https://nostarch.com/rootkits. There is also a free course on rootkits on http://opensecuritytraining.info/Rootkits.html. Outside of that you can look into windows internals and windows driver development which will help you a lot when looking into rootkit.
  • asked a question related to Malware
Question
3 answers
Where can i get nearly 50000 to 100000 normal PEFILES(Not malware files) ?
Relevant answer
Answer
Have you looked into getting the files from the NSRL Database (https://www.nist.gov/software-quality-group/national-software-reference-library-nsrl) These provide hashes but you should be able to find and download them. Another option is taking a number of installer CDs and harvesting files from them.
  • asked a question related to Malware
Question
15 answers
Are fishing, malware (spyware, trojans, ransomware, keyloggers, ...) sending cybercriminals false e-mails with links to fake websites or viruses reading passwords for online banking accounts or other techniques used by cybercriminals as the most dangerous?
Please reply
Best wishes
Relevant answer
Answer
Modern Online Banking Cyber Crime - InfoSec Resources - InfoSec Institute
  • asked a question related to Malware
Question
5 answers
We are building a bibliography of InfoSec resources that address work groups, human threat assessment capabilities, and collaboration in InfoSec projects. Also applies to resisting disinformation and malware on social media sites.
Relevant answer
Answer
Hi Eleanor! I worked on this arranging this podcast featuring Intel IT Information Security director Xochitl Monteon (https://connectedsocialmedia.com/16473/inside-it-strengthening-intels-security-culture/), who talks about the multiple ways Intel tries to strengthen security culture to resist things like phishing, to develop more security applications (much cheaper in the long run), and to function as a kind of human sensor as part of a greater defense in depth strategy. Techniques include:
  • setting up a security college
  • mandatory security classes
  • Phishing and other malware education/awareness campaigns
I also suggest you look at some of the software for phishing education/simulation that is out there.
  • asked a question related to Malware
Question
3 answers
CASIA v 2.0 database is actually available at http://forensics.idealtest.org/casiav2/
But, google says it is hacked and some malware is there in the site.
Please suggest me how I can download the dataset?
Anybody Please share the dataset offline.
Thanks in advance.
Relevant answer
Answer
  • asked a question related to Malware
Question
6 answers
If software and hardware could prevent every security threat, there would be no intrusions, hacking, malware, or ransomware – yet there is news about new attacks almost daily. Why? Security is a process, not a product. The most effective cybersecurity operations require 24/7 monitoring with a Security Operations Center (SOC), separation of true security threats and information from the benign, and immediate response.
Determine Inherent Risk Profile Management can determine the institution’s overall Inherent Risk Profile based on the number of applicable statements in each risk level for all activities (Figure 2). For example, when a majority of activities, products, or services fall within the Moderate Risk Level, management may determine that the institution has a Moderate Inherent Risk Profile. Each category may, however, pose a different level of inherent risk. Therefore, in addition to evaluating the number of instances that an institution selects for a specific risk level, management may also consider evaluating whether the specific category poses additional risk.
Relevant answer
Answer
The above question inspired me to the following considerations:
The analysis of banking Trojans consists in researching methods of cybercrime in the field of infecting the bank's information systems, both those which are intra-bank and those that serve bank customers as part of online mobile banking. Analysis of attacks by cybercriminals, for example, viruses popular in recent years, trojans of the ransomware type, which after encrypting computers encrypt data disks. In addition, other types of Trojan horses are used to steal sensitive data, personal customers or embezzlement of money from clients' bank accounts, extorting loans, etc. After analyzing methods used by cybercriminals, banks strengthen security systems, protect banking systems against these attacks, improve security and authorization tools online banking clients. In addition, the next step is to improve the risk management process of IT systems. I described these issues, among others, in the following publications:
In addition, cybercriminal attacks on electronic banking systems are probably much more than official statistics provide, because banks do not boast of these events if they do not have to.
This is because many of these cybercrime attacks are ineffective or have relatively low costs, and the identified gaps in the e-banking system are quickly repaired.
however, if the bank customers knew all these events of cyber-criminals, this could reduce the level of confidence in banks.
Then, bank customers could start to withdraw bank deposits from banks and dopiers on a massive scale, then a serious problem for banks would appear associated with a sharp increase in the level of liquidity risk.
I invite you to the discussion.
  • asked a question related to Malware
Question
3 answers
How to extract features from Malware infected files by using different tools?
What is the exact procedure to extract malware features, store it in database and analyse it.
Please provide the necessary resources to learn the tools.
Relevant answer
Good morning
Maybe this article give you answers about your question
International Journal of Innovative Research in Computer and Communication Engineering (An ISO 3297: 2007 Certified Organization) Website: www.ijircce.com Vol. 5, Issue 6, June 2017 Copyright to IJIRCCE DOI: 10.15680/IJIRCCE.2017. 0506134 11923 Feature Extraction of Malware Infected Files and Malicious Datasets Hemant J. Chaudhari, Prof. M. S. Mahindrakar M.Tech Student, Dept. of CSE., Shri Guru Gobind Singhji Institute of Engineering and Technology Vishnupuri, Nanded, Maharashtra, India Assistant Professor, Dept. of CSE., Shri Guru Gobind Singhji Institute of Engineering and Technology Vishnupuri, Nanded, Maharashtra, India ABSTRACT: In this paper, we introduce a simple approach to extract malware features of malware infected files and malicious datasets by using signature based approach and IDA pro tool. We extract various malware features and attributes from the PE-headers using the structural information of executable files. We use the following three methodologies: (1) First of all we collect large amount of malicious executable files or datasets and benign executable file or datasets for testing purpose. (2) Then we scan both sample dataset and executable file through the virus total online tool to predict file behaviour. Virus-Total is a free to analyse suspicious files and facilitates the quick detection of viruses, worms, Trojans, and all kinds of malware.(3) then we used Kfngram tool to convert suspected file into the N-grams for measurement of used symbols. (4)Then we collect large amount of information from the PE header by using IDA pro tool to extract set of features and various properties to understand malware files. We have evaluated our approach on a malware infected executable file which contains positive detection ratio. The result of our experiments shows that the PE-header-Based approach achieves more than 79% detection rate with Threat Score: 100/100(Labelled as: Trojan.VIZ.Gen) KEYWORDS: Malware, Feature Extraction of Malware, Malware features, PE-Headers, Metadata, Malicious Files, Sections, Entropy.
  • asked a question related to Malware
Question
4 answers
Salam all,
Execluding those which target traffic sniffing /middling, those spamed links for spoofed webpages for the sake of identity or credetials theft, or DDoS,
do you think that all malware that create harm for computers or mobile phones are in executable form? i.e. malware should be in executable form ?
What is the common characteristics in most of malware? (execluding their goals)
Relevant answer
Answer
Very interesting answers,
As per my knowledge; Virus, Warms, Trojans, Adware / Spyware (drive-by-downloads) sometimes, ransomware, PUA, Polymorphic or those which are working on sleeping mode as what you've add... at the end there will be certain executables that should run to trigger by that certain processes to do the subversions.
So, rather than .exe, .bat, or .ps ,
what else could be used to create the attack or the harm, and what about the others that are not using such that kind of executables , like those annoying adware that popup some adds or redirect your home page to another one (like at the time of downloading that adware it may only modify some files to be able to do that ) ? dont you think that still to do these modification it should run a commands( thus processes) that will allow it to do so ?
At the end, at the back of each malware: a process that will be activated by somehow to do the needful.
So, in general, what are the processors' activators (ofcoure beside the already mentioned ones , i.e. in BOLD)??
  • asked a question related to Malware
Question
6 answers
The employment of machine learning in security field is higly emarged in the current era. But, yet, did the researchers in security field utilize from it in 100% detection or protection from one or multiple kind of malwares ? Or do you forsee that malwares ( or specific malware type, like ransomware or trojan or ... ) will be obsolete due to the successful analysis of their behavior (Dynamic or static ?) by machine learning algorithims ?
Excited to read your views.
(Resources that support your opinions will be much supportive!)
Relevant answer
Answer
When creating a malware, the creator has to think about malware-detection method first (otherwise his malware did nothing). => he created a malware that is not detectable with the current algorithms (anti-virus program). When a computer is infected, the defender analyzed the malware and creates a new mechanism to detect it. And again, the creator knows this mechanism and thinking of new malware. This cycle never ends, the battle between white hat and black hat hackers I would say
  • asked a question related to Malware
Question
3 answers
People in the cybersecurity business keep saying that a password is dreadfully insecure, that someone can look over your shoulder and steal it, or they can listen to your communication with the bank, and steal it from that. There can be malware on your device, which reads what you type, and sends it a cybercriminal in another country. Even strong encryption is no use, since criminals now use GPU's to decrypt millions of credentials in just a few milliseconds.
But passwords are so convenient. Why would you want your iris scanned in the checkout queue at Target, or wait for an SMS message, telling you to enter yet another password? Most importantly, if you lose or forget your password, it can be reset, unlike any biometric parameter.
It would be most convenient, if you could enter your password in the usual way, but anyone watching would be unable to use what they saw, and anything listening to the (unencrypted) transmission would pick up useless garbage. Even better, if any malware on your device would also be unable to use anything it discovered.
This paper sheds light on this problem.
.
Relevant answer
Answer
In case the reading is too heavy, here's a first-hand example of how it looks in practice:
  • asked a question related to Malware
Question
3 answers
for the purpose of finding the spyware or malware detection and prediction.
I need to know the origin of the message or advertisement.
Relevant answer
Answer
Hope Subir Modak can help to answer.
  • asked a question related to Malware
Question
2 answers
I have done m.tech from cyber security (malware detection). Now i want to do ph.D also but domain selection is a problem. want to switch from malware detection to big data. so this will be a right decision or continue with malware. Can any one suggest me
Relevant answer
Answer
I think you choose big data security to do Phd
  • asked a question related to Malware
Question
3 answers
The number of malware continues to increase dynamically and are very complex and sophisticated. Distributed Malware contributes to loss or privacy invasion, having negative impact on confidentiality, integrity and availability of private data.
Relevant answer
Answer
Hi,
your problem of the signature based is about the management of large  database because the number of malware continues to increase dynamically, may that has a new signature, I think we will create a method to classify it, and  fast retrieve malware of  database, and since the size of database increase,, to solve classify database by using the concept of room based, we use this concept “room based” to manage the database. Each room based that has content Prohibition privileges of signature based on malware files, or pattern of collections of  signature based of malware files.
thank you
  • asked a question related to Malware
Question
19 answers
For a project, I am going to do static analysis on Android Malware Samples. I am looking for a large dataset .
Relevant answer
Nowadays, we can find other projects available, some of them are:
  • Drebin is a good project with a research article to support it, it provides a malware dataset that has 5560 integrated by 179 families.
  • AndroZoo includes 5669661 applications downloaded from different sources (it includes apps from Google Play)
  • Virushare is another repository, it is a good choise if you can work with it.
  • DroidCollector provides Apks (8000 benign apps and 8860 malwares) and .pcap files, this project have some research articles, and they applied both static and dinamic analysis in their study.
  • Another good option to analyse the last malware is to download from Contagio mobile
  • AndroidMalGenome is discontinued
  • asked a question related to Malware
Question
6 answers
i wanted to test the virus data set with different data mining algorithms..so kindly share the link of the repositories and best tools to experiment.
Relevant answer
Answer
refer this link to some useful security datasets
  • asked a question related to Malware
Question
11 answers
I have Android Malware dataset but don't know how to get dataset of benign or reliably good applications. I need both dataset for doing comparison in malware analysis.
Relevant answer
Answer
I have downloaded the android malicious apps from drebin. But where to download the android benign apps. i need at least around 8000 benign apps from different categories
  • asked a question related to Malware
Question
6 answers
I am want to know how signature based detection is implemented by anti-malware  software companies. I know theoretical working of it but how it is implemented in actual software for efficient detection ?   
Relevant answer
Answer
In addition to above references I found "Antivirus Hackers Handbook " a very useful reference for understanding the signature types, working of signature based detection and evasion techniques. I would it should be the starting point for anyone who is new in this field.
  • asked a question related to Malware
  • asked a question related to Malware
Question
4 answers
I need a research topic in any of the two areas though not well knowledgeable on steganography but can read up if interesting.
Relevant answer
Answer
Thinking about what problem to do research on, is 40% to 50% of the research itself... You need to do the work to know what is there and what is not, and what is not there that you are capable of attacking as a research problem. Someone else's telling you what to do is missing the point about research (even a professor can direct a student that much based on the knowledge of the student's background, the student has to do a lot of the preparation!!). Without your background, state of knowledge, training, and capabilities.. any answer may be useless!
  • asked a question related to Malware
Question
5 answers
Hi all
Are there any differences between legitimate requests which sent by a user versus requests that had sent because of malicious JavaScript?
which features are used to discriminate these requests and detect type of a ddos attack (browser based vs malware based)?
Thank You
Relevant answer
Answer
Collect the queries, label them (either bot or not). The tricky part will be to extract features.
As features you can use:
  • HTTP request method
  • HTTP status code
  • URL
  • File name (index.php)
  • Useragent
  • IP address
  • Geolocation of the IP address
Train and test machine learning model.
  • asked a question related to Malware
Question
1 answer
I vishal gupta along with one of my friend aditya bhavsar working on apps classification ( benign or malicious ). So we need the dataset to proceed and we have searched a lot and found some site where they aks to mail them but no one is replying it's been 1-2 days.
Please reply at your earliest convenience.
Thanks
Relevant answer
Answer
Dear Vishal,
Perhaps this dataset containing malware/benign permissions in Android
There is also this other dataset shared by the author in here:
Best Regards,
Heitor
  • asked a question related to Malware
Question
3 answers
I have converted classes.dex using dex2jar tool and then using JD-UI tool in readable format.
This conversion returns me lots of class file located in multiple folder. I need to extract features from these class file for malware detection .
Is there any method with which i can move all classes file in same folder or should i have to handle all classes file by programming?(i.e. I have to open each folder one by one and each file one by one and then i have to extract methods name) . Any one have python script which can do this or some idea to extract methods name from all class file?
Relevant answer
Answer
@Mohamamad : Sir, I want to understand the .smalli file . How they define and declare methods(User defined and system method), API call sequence of android in assembly language(As .smalli is in assembly language)?. I have googled but not getting my answer.
  • asked a question related to Malware
Question
4 answers
I have downloaded and unziped android malware dataset from virusshare.com , but i am unable to read its content . Type of file is not specified in virusshare.com.
Relevant answer
Answer
if we are taking about desktop malware or virus then "virusshare" refers
File Type : HTML MIME Type : text/html
In case of smartphone it refers:
File Type : apk
MIME Type : Manifest.xml
  • asked a question related to Malware
Question
3 answers
Hi,
I have strings collected from malware and clean applications, these strings contain saved passwords, login names, directory information, ip addresses, error messages, ports etc. etc. Although some malware or clean applications contain junk as well but useful text as well as mentioned.
My question is how can I justify that these strings deserve spending time on text mining or not. In text mining I also mean sentiment analysis.
Regards
Relevant answer
Answer
Hi Syed,
You need to explore that yourself by setting the environment of the experiment and examining the worthiness of the resulting classifier model, for example.
HTH.
Samer, PhD.
  • asked a question related to Malware
Question
5 answers
Spyware is one class in malware. What makes a research in spyware detection different from a research in malware detection?
Relevant answer
Answer
Malware detection also means spyware detection. Why do we need to do a separate research in spyware detection?
  • asked a question related to Malware
Question
4 answers
i have read different feature ranking method
information gain, mutual information , chi squre test. i got few paper for PSO based feature ranking method .but not getting which will give me better result. can any one suggest me which feature ranking method will be better for detection of malware.
Relevant answer
Answer
You can use any optimisation algorithm for feature selection , this will be a tradeoff between size , compactness of neural architecture and classification accuracy . You have to compromise between high classification rate and compactness
  • asked a question related to Malware
Question
5 answers
To minimise online business risks such as hacktivism, malware, DDoS, spear phishing, social engineering, and ransomware for online fraud targeting intellectual property, trademarks, reputational damage, and illegal money transfers.  Some of the mitigation measures include patching software regularly; using strong passwords and installing antivirus software. However, the banking business  cannot prevent every cyber breach.
Relevant answer
Answer
very pertinent question in field of online retailing. online retailing is growing in leaps and bounds due to advances in technology and versatile tools to efficiently and effectively conduct transactions at customers' convenience and superior experiences . The online transactions need a interactive website storefront, secure payment, and logistic delivery system. The information communication technology(ICT) system has inherent vulnerabilities that are often exploited by cyber-criminals for Rasnsomware, denial of competitive advantage, theft of intellectual property, loss of customers trust and privacy. Therefore, should have secure server and secure payment system complemented by compliance, regular parchment updates, antivirus updates, next general firewall, end-to-end encryption; all backed by intrusion detection system (IDS) and intrusion prevention system (IPS). IPS will alert the teller of unusual external intrusions possible fraud and'or data breach.
  • asked a question related to Malware
Question
8 answers
Hi, 
I am performing malware analysis and classification of internet of things malware, I have done static malware analysis. 
For dynamic malware analysis, some people suggest that because its a slow and time taking process, so they suggested not to go for that. 
But my question is does it really worth to analyse malware dynamically? 
What kind of information I may get from dynamic analysis which I can miss in static analysis?
Any improvements which you think may benefit me a lot in terms of malware analysis in terms of IoT?
Regards
Relevant answer
Answer
you are right sir , dynamic analysis is slow as it need to install application first in system .After  installation its behavior can be recorded .  for dynamic analysis you can  monitor what network traffic they are sending and receiving. with what kind of URL or server they are communicating . you can also check that after installation app is doing what means try to reboot or if it is try to change some internal file format or trying to run some privilege instruction.
  • asked a question related to Malware
Question
7 answers
Malware ,Intrusion detection ,virus
Relevant answer
Answer
When we say malware detection, we generally need an agent on host machine. The agent needs to analyze the processes running on host, memory maps, systemcalls, etc. E.g- malware bytes. malware detection is difficult just based on network traffic alone. You can also call it host based Intrusion detection.
A network based Intrusion detection system on the other hand analyses traffic inbound and outbound on network interfaces, and can be running ouside the VM for which you want to conduct Intrusion Detection e.g. NIDS like listening to network traffic on interface of more than one VM.
Both network and host based intrusion detection systems have their short comings, e.g- if the host is compromised, attacker can disable host based malware/ intrusion detection agent. On the other hand Network based intrusion detection system is not able to provide fine grained analysis of malicious activities on each host since it listens only inbound-outbound traffic on each VM.
Both NIDS and Host based IDS (HIDS) can further be classified into singature based detection agents (having well defined signatures for type of attacks like - DDoS, NTP amlification attack etc) and anomaly based detection agent (detection of intrusion based on traffic pattern or machine learning algorithms).
Both signature and anomaly based detection have their shortcomings as well. Signature based detection cannot identify all possible variants of attacks whereas anomaly based detection mechanism generally have high false positive rate.
  • asked a question related to Malware
Question
2 answers
i am using permission for detection of malware and now want to add sensitive function  to create feature vector for more accuracy  . can any one suggest me how i can get sensitive function for creation of feature vector .  i am taking android manifest to extract permission then which file i should extract to get sensitive function?
Relevant answer
Answer
Dear Suman Tiwari,
Look the link, may be useful.
Regards, Shafagat
  • asked a question related to Malware
Question
3 answers
I have read inertia weight PSO but not able to understant how it will help me for malware detection? i am not getting how it can apply to rank features ?
i am confuse that PSO is used to rank features or it is used with classification technique to improve its accuracy. i mean PSO can be used instead of IG(information gain) or it is used with SVM to enhace its classification accuracy.
Relevant answer
Answer
For adapting PSO in any solving problem, you should address the following issues:
1- solution encoding: you have to define the solution Space clearly, by descrbing the feature of each solution, binary encoding, integer encoding and so on.
2- Fitness compting: here you have to define function, to evaluate the solutions. and you have to mention if the aim is to maximize this function or minimize it.
3- Update position: here you have to define function that updates positions of the particles, according to the previous position and the velocity.
  • asked a question related to Malware
Question
2 answers
For malware detection i want to use PSO with SVM but not able to find what changes should i made in PSO inertia weight which makes it more better for malware accuracy.
Relevant answer
Answer
The Inertia weight balances global exploration and local exploitation. Usually linearly decreasing trend of inertia weight from 0.9 to 0.4 during the course of a
run is used to get improved result. However, recently, linearly decreasing trend of inertia weight is found inappropriate. It is proved theoretically by using a available heuristic formula that linearly increasing trend of inertia weight is better choice. Refer the attached link for detail.
  • asked a question related to Malware
Question
2 answers
i want to detect malware in android  based on network traffic analysis also.
can  any one  suggest me that which method i should use to detect malware samples  which sent encrypted traffic to its remote server.
  • asked a question related to Malware
Question
3 answers
Hi everyone,
I want to do some research on WannaCry Ransomware Attack detection. Where can I find/ download WannaCry Ransomware Attack traffic data set ?
Thank you!
Relevant answer
Answer
Try asking in companies that produce anti-virus software. I know that research on Ransomware leads Dr Web
And Kasperski
Research on this subject is also carried out by an Italian company whose names I can not recall, nor can I find her.
Podaję też linka do statystyk Kasperskiego za 2015 rok:
  • asked a question related to Malware
Question
1 answer
I would like to classify malware categories basing on APICall n-grams.
Attached is the work i had to tried to do including the sample of how dataset looks like.
I can only classify basing on API calls but not the APicall n-grams which is my interest.
Your help is highly appreciated
thank you 
Relevant answer
Answer
The problem with n-grams with n>3 is that it becomes too huge to compute and store the histograms (in the order of 10^6 for 4-gram). Fortunately these histograms are expected to be very sparse. One way is to use sparse vectors, if the libraries you use allow it.
The other way, is to use kernel methods with a n-gram kernel that directly computes the n-gram intersection between 2 strings. I did it in a library for kernel SVM i developed a few years back, you can check the code in the gien links and use/adapt it.
  • asked a question related to Malware
Question
4 answers
I have prepared list of features e.g. Internet Connection, File Upload etc that an android malware may have and then I have tested these features on both malware and benign samples. Now I want to add machine learning technique that could predict on the basis of extracted result that next application is either malware or benign. Which machine learning algorithm(s) will be best to apply here?
Relevant answer
Answer
Thanks Shafagat.
Regards,
Anam Mehtab
  • asked a question related to Malware
Question
3 answers
it possible to regain the original state from a corrupted state after a malware attack so that the system is resilient to attack? By the time attack is detected we may lose some of the data. We should prevent further attack and should retrieve the lost data
Relevant answer
Answer
I helped my counterpart at another institution recoup from a bad ransomware episode where 1.8M of 44M files between several network file stores were corrupt.  My primary focus was on the automating the data validation and recovery efforts while others focused on cleaning desktops, preventing recidivism, and user facing efforts.
Some of that scales down to things which could be implemented for a SOHO or home computing situation. 
Is that the sort of thing you are interested in?
-- Bob
  • asked a question related to Malware
Question
7 answers
I am doing Academic Research in malware detection. I would like to get malicious windows executables that i can run to test their behavior. 
Thank you
  • asked a question related to Malware
Question
6 answers
I am doing work on the feature extraction of malware.
Somewhere I found N-Grams techniques to extract features of malware but it's complicated to reach my goal.
find attachment for details:
Note: a just focus on Feature extraction of malware, not testing , training or classification.
Relevant answer
Answer
There is no such best feature extraction technique(PCA, KPCA, Markov model) for malware detection....What type of features of malwares you want to detect or classify that need to be considered.....You may follow the follwing links.....
file:///C:/Users/Sanjay/Downloads/ELK-1601-189_manuscript_1.pdf
  • asked a question related to Malware
Question
3 answers
i am looking for suggestion to what type of honeypot i can use?
probably suggestions?
any new area i can work on?
any related research paper?
please suggest.
Relevant answer
Answer
Please read the attachment.
  • asked a question related to Malware
Question
3 answers
I'm working to localize the malicious payload in malicious android code. To my best knowledge, a little work has been done addressing this problem. My main interests go in the direction of establishing only whether an app is trusted or malicious.
Relevant answer
Answer
Machine Learning approaches will give you better results..
  • asked a question related to Malware
Question
5 answers
What kind of features do i need to consider in windows API calls that can help in detecting the behavior of malware using data mining techniques.
And how can that data be collected.
  • asked a question related to Malware
Question
4 answers
I need a concise and clear focused solution for it.
Relevant answer
Answer
This happens by two things: First, your air-gapped system is already infected, and second one is an infected cellphone is nearby. For the before system, this would be incredibly difficult on any of the air-gapped systems I've used, as any software being brought into the building must be throughly scanned and checked before getting near the system. As for the latter, every place with air-gapped systems I've worked at has mandated that all cell phones and electronic devices must be kept outside the RF shielded office..
  • asked a question related to Malware
Question
8 answers
I am conducting a research on on-line social networks and I would like to test some methods that are supposed to detect phishing and malware links in OSN messages (tweets, facebook posts etc). Would you know some datasets that I could donwload (preferably XML, json, csv or any structured format) and that I could use to test my algorithms.
Relevant answer
Answer
  • asked a question related to Malware
Question
3 answers
I am looking for research papers and related datasets. Any related literatures/resources are very much appreciated. Thank you.
Relevant answer
Answer
  • asked a question related to Malware
Question
6 answers
Yesterday, my laptop got a deadly trojan virus having extension ccc that affects  each of my files. Afterwards, all my files were encrypted to the bizarre format that couldn't be opened by any installed program. Even tried to look up for software to decrypt my affected files but didn't find any. It seems to be a serious issue, I would be really grateful if I could know any ways to resolve this problem. Thank you.
Relevant answer
you can do it, via Linux (Live CD), to access windows files and remove the .exe  file i cant remember the name.
or
follow the instructions in the following link:
  • asked a question related to Malware
Question
5 answers
user can request for any website and phishing page then direclty move on orignal page
Relevant answer
Answer
Beside all technical countermeasures to detect and antagonize phishing, it can also be prevented by improving the online users' phishing awareness. Just catch a glimpse at https://www.researchgate.net/profile/Curtis_Carver/publication/222730836_Phishing_for_user_security_awareness/links/0deec5161aaaf78130000000.pdf for example!