Search

The evolution of malware is continuing at an alarming rate, despite the efforts made towards detecting and mitigating them. Malware analysis is needed to defend against its sophisticated behaviour. However, the manual heuristic inspection is no longer effective or efficient. To cope with these critical issues, behaviour-based malware detection approaches with machine learning techniques have been widely adopted as a solution. It involves supervised classifiers to appraise their predictive performance on gaining the most relevant features from the original features’ set and the trade-off between high detection rate and low computation overhead. Though machine learning-based malware detection techniques have exhibited success in detecting malware, their shallow learning architecture is still deficient in identifying sophisticated malware. Therefore, in this paper, a Convolutional Neural Network (CNN) based Windows malware detector has been proposed that uses the execution time behavioural features of the Portable Executable (PE) files to detect and classify obscure malware. The 10-fold cross-validation tests were conducted to assess the proficiency of the proposed approach. The experimental results showed that the proposed approach was effective in uncovering malware PE files by utilizing significant behavioural features suggested by the Relief Feature Selection Technique. It attained detection accuracy of 97.968 percent.

The popularity of the Android Operating System in the smartphone market has given rise to lots of Android malware. To accurately detect these malware, many of the existing works use machine learning and deep learning-based methods, in which feature extraction methods were used to extract fixed-size feature vectors using the files present inside the Android Application Package (APK). Recently, Graph Convolutional Network (GCN) based methods applied on the Function Call Graph (FCG) extracted from the APK are gaining momentum in Android malware detection, as GCNs are effective at learning tasks on variable-sized graphs such as FCG, and FCG sufficiently captures the structure and behaviour of an APK. However, the FCG lacks information about callback methods as the Android Application Programming Interface (API) is event-driven. This paper proposes enhancing the FCG to eFCG (enhanced-FCG) using the callback information extracted using Android Framework Space Analysis to overcome this limitation. Further, we add permission - API method relationships to the eFCG. The eFCG is reduced using node contraction based on the classes to get R-eFCG (Reduced eFCG) to improve the generalisation ability of the Android malware detection model. The eFCG and R-eFCG are then given as the inputs to the Heterogeneous GCN models to determine whether the APK file from which they are extracted is malicious or not. To test the effectiveness of eFCG and R-eFCG, we conducted an ablation study by removing their various components. To determine the optimal neighbourhood size for GCN, we experimented with a varying number of GCN layers and found that the Android malware detection model using R-eFCG with all its components with four convolution layers achieved maximum accuracy of 96.28%.

Indian economy depends on agriculture production. However, the quantity of agricultural production depends on fertility of the soil. In this study chemical soil measurements are used to classify fertility of the soil. The 11 soil parameters namely, pH, EC, OC, P, K, S, Zn, B, Fe, Cu, Mn were used to classify soil as LOW, MEDIUM and HIGH fertile. The machine learning-based classifiers such as naive bayes, logistic regression, Support Vector Machine (SVM), decision tree bagging, Boosted Regression Tree (BRT), Random Forests (RF) were used to classify the soil as LOW, MEDIUM and HIGH fertile soil. The RF classifier showed best performance among other classifiers.

Semantic image segmentation is the essential task of computer vision. It requires dividing visual input into different meaningful interpretable categories. In this work image attribution and segmentation approach is proposed. It can identify complex objects present in an image. The proposed model starts with superpixelization using Simple Linear Iterative Clustering (SLIC). A Multi Heat Map Slices Fusion model (MSF) produces an object seed heat map, and a Saliency Edge Colour Texture (SECT) model generates pixel-level annotations. Lastly, the PSPNet model for developing the final semantic segmentation of the object. The proposed model was implemented, and compared with the earlier work, it excelled the performance score.

As smartphone adoption is happening at a rapid rate, its threat landscape is also widening. Android is a popular smartphone Operating System (OS) which was subject to many malware attacks in recent years, compromising the privacy and security of its users. Although many works are developed to detect Android malware, few use graphs extracted from the Android Package (APK) directly as an input to the deep learning model due to the lack of suitable architectures. Graph Convolutional Networks (GCNs) are becoming a popular architecture in the deep learning community that can directly take a graph as an input. However, their applicability to Android malware detection is less explored. To bridge this gap, this work proposes an Android malware detection model using GCNs based on Function Call Graph (FCG). FCG captures the caller-callee relationships between the methods inside an APK as a directed graph. Every node in FCG is assigned a feature vector that represents its characteristics. To evaluate the performance of the proposed model, a set of experiments is conducted by varying GCN algorithms, node features and the number of GCN layers in the model. A recent Android malware dataset is used to conduct experiments. As GCNs consider the node count of the FCG, the dataset is balanced using a new technique to make node count distributions of benign and malware APKs similar. As a result of these experiments, the maximum accuracy of 92.29% with the F1-score of 0.9223 is obtained, suggesting that the GCNs have the potential to detect Android malware.

Cloud Computing enabled by virtualization technology exhibits revolutionary change in IT Infrastructure. Hypervisor is a pillar of virtualization and it allows sharing of resources to virtual machines. Vulnerabilities present in virtual machine leveraged by an attacker to launch the advanced persistent attacks such as stealthy rootkit, Trojan, Denial of Service (DoS) and Distributed Denial of Service (DDoS) attack etc. Virtual Machines are prime target for malignant cloud user or an attacker to launch attacks as they are easily available for rent from Cloud Service Provider (CSP). Attacks on virtual machine can disrupt the normal operation of cloud infrastructure. In order to secure the virtual environment, defence mechanism is highly imperative at each virtual machine to identify the attacks occurring at virtual machine in timely manner. This work proposes In-and-Out-of-the-Box Virtual Machine and Hypervisor based Intrusion Detection and Prevention System for virtualized environment to ensure robust state of the virtual machine by detecting followed by eradicating rootkits as well as other attacks. We conducted experiments using popular open source Host based Intrusion Detection System (HIDS) called Open Source SECurity Event Correlator (OSSEC). Both Linux and windows based rootkits, DoS attack, Files integrity verification test are conducted and they are successfully detected by OSSEC.

This paper induces the prominence of variegated machine learning techniques adapted so far for the identifying different network attacks and suggests a preferable Intrusion Detection System (IDS) with the available system resources while optimizing the speed and accuracy. With booming number of intruders and hackers in todays vast and sophisticated computerized world, it is unceasingly challenging to identify unknown attacks in promising time with no false positive and no false negative. Principal Component Analysis (PCA) curtails the amount of data to be compared by reducing their dimensions prior to classification that results in reduction of detection time. In this paper, PCA is adopted to reduce higher dimension dataset to lower dimension dataset. It is accomplished by converting network packet header fields into a vector then PCA applied over high dimensional dataset to reduce the dimension. The reduced dimension dataset is tested with Support Vector Machines (SVM), K-Nearest Neighbors (KNN), J48 Tree algorithm, Random Forest Tree classification algorithm, Adaboost algorihm, Nearest Neighbors generalized Exemplars algorithm, Navebayes probabilistic classifier and Voting Features Interval classification algorithm. Obtained results demonstrates detection accuracy, computational efficiency with minimal false alarms, less system resources utilization. Experimental results are compared with respect to detection rate and detection time and found that TREE classification algorithms achieved superior results over other algorithms. The whole experiment is conducted by using KDD99 data set.