Search

Malicious malware targeting Android systems has alarmingly increased due to the quick spread of Android devices. For these devices to be secure and to protect the private data of users, Android virus detection is essential. The selection of features, model performance, and efficiency are issues with existing Android malware detection techniques. To overcome these drawbacks, we suggest a unique method for identifying malicious Android data that combines Tree Seed Optimization with Support Vector Machines (TSO-SVM).TSO is a nature-inspired optimization technique that looks for the best feature subsets by simulating the tree's seed dispersal process. The efficiency and effectiveness of SVM-based classification are increased by our method's use of TSO to choose the most instructive features from the Android malware dataset. To normalize the features of the Android application dataset before training, we use a data-cleaning method known as Z-Score normalization. Our Android malware detection solution uses Independent Component Analysis (ICA) as a feature reduction method. Our test results show how well the TSO-SVM technique works at detecting Malicious Android data. In terms of accuracy, precision, recall, and F1-Score for malicious detection, the suggested model achieves 97.12%, 96.35%, 97.88%, and 96.84%, respectively. The proposed technique successfully solves the problem of suboptimal classification accuracy in the presence of dynamic and changing malware threats. The results of this work highlight the potential of TSO techniques for enhancing the security of Android-based devices and present a promising direction for further investigation in the area of mobile security. [ABSTRACT FROM AUTHOR]

Currently, malware activities pose a substantial risk to the security of Android applications. These risks are capable of stealing important information and causing chaos in the economy, social structure, and financial sector. Malicious network traffic targets Android applications due to their constant connectivity. This study develops the NMal-Droid approach for network-based Android malware detection and classification. First, we designed a packet parser algorithm that filters the combination of HTTP traces and TCP flows from PCAPs (Packet Capturing) files. Second, the fine-tune embedding approach is developed that uses a word2vec pre-trained model to analyze features' embeddings in three different ways, i.e., random, static, and dynamic. It is used to learn and extract feature-matrix matrices with related meanings. Third, The Convolutional Neural Network (CNN) is used to extract effective features from embedded information. Fourth, the Bi-directional Gated Recurrent Unit (Bi-GRU) neural network is designed to compute gradient computation in the context of time-forward and time-reversed. Finally, a multi-head ensemble of CNN-BiGRU is developed for accurate malware classification and detection. The proposed approach is evaluated on five different activation functions with 100 filters and a range of 1–5 kernel sizes for in-depth investigation. An explainable AI-based experiment is conducted to interpret and validate the proposed approach. The proposed method is tested using two big Android malware datasets, CIC-AAGM2017 and CICMalDroid 2020, which comprise a total of 10.2k malware and 3.2K benign samples. It is shown that the proposed approach outperforms as compared to the state-of-the-art methods. [ABSTRACT FROM AUTHOR]

Malware detection has become a critical aspect of ensuring the security and integrity of computer systems. With the ever-evolving landscape of malicious software, developing effective detection methods is of utmost importance. This study focuses on the identification of important features for malware detection methods, aiming to enhance the accuracy and efficiency of such systems. In this work, we propose an ensemble approach called FRAMC to identify the key features that contribute significantly to the detection of malware. The effectiveness of FRAMC is assessed using different types of classifiers on a number of real-world malware datasets. The outcomes of our analysis demonstrate that the proposed approach excels in terms of performance when compared to other methods. [ABSTRACT FROM AUTHOR]

Research in the field of malware detection is currently leaning toward methods based on artificial intelligence algorithms due to the increasing limitations of traditional detection methods and the increasing accuracy of these methods. This study therefore introduces a novel approach to malware detection. This method integrates a deep learning model's autoencoder network with a grayscale graphic depiction of malware. By looking at the autoencoder's reconstruction error, we may assess if the grey-scale picture approach is feasible to use for malware detection. Additionally, it differentiates between malicious and safe software by utilizing the autoencoder's dimensionality reduction capabilities. Using the Android dataset, our newly introduced detection model attained a 95% accuracy and maintained a consistently high F-score of approximately 95% This outperformed more conventional methods of machine learning detection. [ABSTRACT FROM AUTHOR]

With the fast growth of mobile phone usage, malicious threats against Android mobile devices are enhanced. The Android system utilizes a wide range of sensitive apps like banking apps; thus, it develops the aim of malware that uses the vulnerability of safety measures. Identifying Android malware in smartphones is a vital target for the cyber community to eliminate menacing malware instances. Drawing stimulus from the adaptability and efficacy of biological systems, these methods emulate nature's problem-solving systems for identifying malicious software. By integrating principles, namely, swarm intelligence (SI), neural networks (NN), and genetic algorithms (GA), these bioinspired systems reveal exceptional efficiency in identifying both known and developing Android malware attacks. This bioinspired system provides a capable avenue for robust Android malware detection from an ever-shifting threat landscape. This article designs a Bioinspired Artificial Intelligence-based Android Malware Detection and Classification (BAI-AMDC) technique for Cybersecurity Applications. The BAI-AMDC technique exploits the concept of bioinspired algorithms with a DL approach for the classification and detection of Android malware. In the BAI-AMDC technique, an improved cockroach swarm optimization algorithm-based feature selection (ICSOA-FS) technique can be applied to choose optimum features. The BAI-AMDC technique employs a bidirectional gated recurrent unit (BiGRU) model for Android malware detection. An arithmetic optimization algorithm (AOA) can be utilized to enhance the detection performance of the BAI-AMDC technique. The experimental validation of the BAI-AMDC system can be performed on the CICAndMal2017 database with 10,000 instances. The simulation values highlighted the productive ability of the BAI-AMDC system on the Android malware recognition process. [ABSTRACT FROM AUTHOR]

In this study, the domain of Android malware detection was explored with a specific focus on leveraging the potential of Machine Learning (ML). At the time of this study, Android had firmly established its dominance in the mobile landscape and IoT devices, necessitating a concerted effort to fortify its security against emerging malware threats. Static analysis methods were scrutinized as vital sources of feature extraction for ML, while dynamic analysis methods were employed to analyze the behavior of applications in real or simulated environments. Additionally, a hybrid method, combining both static and dynamic analyses, was investigated. The study evaluated four ML models: XGBoost, Random Forest (RF), Support Vector Machine (SVM), and Decision Tree (DT), revealing compelling insights into their performance metrics. Notably, RF achieved the highest accuracy of 0.99, closely followed by SVM with an accuracy of 0.96. These results underscore the potential effectiveness of ML techniques in bolstering Android malware detection and mitigating security risks. As the research progressed, it underscored the latent power of integrating ML into the framework of Android malware analysis. With an eye towards the future, the overarching goal was to empower enhanced security measures and foster a resilient mobile ecosystem through the insights gleaned from this investigation. [ABSTRACT FROM AUTHOR]

The widespread use of smartphones worldwide has led to a corresponding rise in the number of mobile applications available for Android devices. These apps offer users convenient ways to perform various daily tasks, but their proliferation has also created an environment in which attackers can steal sensitive information. Insecure options employed by many app developers create vulnerabilities that can be exploited by attackers to gain access to most smartphones. While existing methods can detect malware during app installation, they do not sufficiently address post-installation attacks, such as those resulting from fake apps or Man-in-the-Disk (MitD) attacks. To address this issue, the current study conducted research on post-installation attacks, including data leakage, malware injection, repackaging, reverse engineering, privilege escalation, and UI spoofing. MitD attacks are particularly challenging to counter, so, to mitigate this risk, the Post-Installation App Detection Method is proposed to monitor and regulate sensitive information flow and prevent MitD attacks. [ABSTRACT FROM AUTHOR]

The proliferation of Internet of Things (IoT) devices on Linux platforms has heightened concerns regarding vulnerability to malware attacks. This paper introduces a novel approach to investigating the behavior of Linux IoT malware by examining syscalls and library syscall wrappers extracted through static analysis of binaries, as opposed to the conventional method of using dynamic analysis for syscall extraction. We rank and categorize Linux system calls based on their security significance, focusing on understanding malware intent without execution. Feature analysis of the assigned syscall categories and risk ranking is conducted with statistical tests to validate their effectiveness and reliability in differentiating between malware and benign binaries. Our findings demonstrate that potential threats can be reliably identified with an F1 score of 96.86%, solely by analyzing syscalls and library syscall wrappers. This method can augment traditional static analysis, providing an effective preemptive measure to enhance Linux malware analysis. This research highlights the importance of static analysis in strengthening IoT systems against emerging malware threats. [ABSTRACT FROM AUTHOR]

With the increasingly severe challenge of Software Supply Chain (SSC) security, the rising trend in guarding against security risks has attracted widespread attention. Existing techniques still face challenges in both accuracy and efficiency when detecting malware in SSC. To meet this challenge, this paper introduces two novel models, named the Bayesian Optimization-based Support Vector Machine (BO-SVM) and the Long Short-Term Memory–BO-SVM (LSTM-BO-SVM). The BO-SVM model is constructed on an SVM foundation, with its hyperparameters optimized by Bayesian Optimization. To further enhance its accuracy and efficiency, the LSTM-BO-SVM model is proposed, building upon BO-SVM and employing LSTM networks for pre-classification. Extensive experiments were conducted on two datasets: the balanced ClaMP dataset and the unbalanced CICMalDroid-2020 dataset. The experimental results indicate that the BO-SVM model is superior to other models in terms of accuracy; the accuracy of the LSTM-BO-SVM model on the two datasets is 98.2% and 98.6%, respectively, which is 2.9% and 2.2% higher than that of the BO-SVM on these two datasets. [ABSTRACT FROM AUTHOR]

The rapid evolution of network communication technologies has led to the emergence of new forms of malware and cybercrimes, posing significant threats to user safety, network infrastructure integrity, and data privacy. Despite efforts to develop advanced algorithms for detecting malicious activity, constructing models that are both accurate and reliable remains a challenge, especially in handling vast and dynamically shifting data patterns. The prevalent bag-of-words (BOW) method, while widely used, falls short in capturing crucial spatial and sequence information vital for detecting malware patterns. To address this challenge, the work presented in this paper proposes hybrid convolution neural network-long short-term memory network (CNN-LSTM) combination models, leveraging CNN's spatial information extraction and LSTM's temporal modeling capabilities. Focused on predicting the infiltration of malicious software into personal computers, the proposed hybrid CNN-LSTM model considers factors such as location, firmware version, operating system, and anti-virus software. The proposed models undergo training and evaluation using Microsoft's malware dataset, demonstrating superior performance compared to traditional CNN and LSTM models. The CNN-LSTM model achieves an impressive accuracy of 95% on the Microsoft malware dataset, highlighting its effectiveness in malware detection. [ABSTRACT FROM AUTHOR]

In today's digital world, Android phones play a vital part in a variety of facets of both professionals and individuals' personal and professional lives. Android phones are great for getting things done faster and more organized. The proportionate increase in the number of malicious applications has also been seen to be expanding. Since the play store offers millions of apps, detection of malware apps is challenging task. In this paper, a methodology is introduced for detecting malware in Android applications through the utilization of global image shape transform (GIST) features extracted from grayscale images of the applications. The dataset comprises samples of both malware and benign apps collected from the virus share website. After converting the apps into grayscale images, GIST features are extracted to capture their global spatial layout. Various machine learning (ML) algorithms, such as logistic regression (LR), k-nearest neighbour (KNN), AdaBoost, decision tree (DT), Naïve Bayes (NB), random forest (RF), support vector machine (SVM), extra tree classifier (ETC), and gradient boosting (GB), are employed to classify the applications according to their GIST features. Furthermore, a feed forward neural network (FFNN) is utilized as a deep learning (DL) technique to further improve the accuracy of classification. The performance of each algorithm is evaluated using metrics such as accuracy, precision and recall. The results demonstrated that the FFNN achieves superior accuracy compared to traditional ML classifiers, indicating its effectiveness in detecting malware in Android apps. [ABSTRACT FROM AUTHOR]

Security Testing of Android Applications is a difficult issue. Malicious apps are a threat to the Android platform's security. Traditional solutions are insufficient as the volume of malicious applications grows day by day. Android smartphones are now constantly exposed to new malware because of this predicament. Recent studies have demonstrated that machine learning is effective at spotting Android malware. Extreme Gradient Boosting (XGB) may find malicious permissions with a high dimension and complex relations because of the benefits of attribute combination and attribute selection. The challenging task of improving the XGB model is accomplished by hyper-parameter tuning using Adaptive Grey Wolf Optimization (AGWO). AGWO displays the grey wolf location and its movement as continuous values, and XGB will search the best value of hyper-parameters in continuous space. This article introduces a novel method for identifying malicious Android apps by improving the classification accuracy through a rigorous examination of permissions and the synergistic capabilities of XGB optimized by AGWO. It directly confronts security vulnerabilities, comparing various machine learning techniques with well-known ensemble learning classifiers on benchmark datasets including M0DROID, AMD, DREBIN, and MALGENOME. Evaluation is based on four widely recognized metrics: accuracy, precision, recall, and f1-score. The results unequivocally demonstrate the substantial enhancement achieved by the proposed AGWOXGB model compared to existing state-of-the-art methods. [ABSTRACT FROM AUTHOR]

The healthcare systems are a prime target for cyber-attacks due to the sensitive nature of the information combined with the essential need for continuity of care. Medical laboratories are particularly vulnerable to cyber-attacks for a number of reasons, including the high level of information technology (IT), computerization and digitization. Based on reliable and widespread evidence that medical laboratories may be inadequately prepared for cyber-terrorism, a panel of experts of the Task Force Preparation of Labs for Emergencies (TF-PLE) of the European Federation of Clinical Chemistry and Laboratory Medicine (EFLM) has recognized the need to provide some general guidance that could help medical laboratories to be less vulnerable and better prepared for the dramatic circumstance of a disruptive cyber-attack, issuing a number of consensus recommendations, which are summarized and described in this opinion paper. [ABSTRACT FROM AUTHOR]

Malware as a service (MaaS) has become a profitable profession, allowing individuals who are not technologically competent, and criminal organizations, to purchase such malicious software to conduct a variety of attacks. This has created space for those with the technological abilities to make a business off the malware that they write, and it is therefore important to understand where these developers are learning the skills needed. The current study was carried out to assess how malware developers use an encrypted messaging platform for knowledge acquisition, more specifically knowledge about malware development. This was carried out through a qualitative analysis of questions and answers posted within Telegram channels that are related to malware, and malware development and distribution. Further to this, latent class analysis was conducted to aid in determining whether there are subsets of individuals posting this information. A total of 467 user questions and 518 user responses were captured from eight channels. Results from this study revealed that posters are usually responsive to questions posed within these communities, with seven different response themes identified: Criticized question, offered answer or advice, offered help or service, probing for further information, provided resource, and unhelpful response. Therefore, while not many people are seeking Telegram channels to learn, when they do pose questions, respondents are likely to offer helpful advice to aid in their learning of malware development. [ABSTRACT FROM AUTHOR]

The ubiquitous adoption of Android devices has unfortunately brought a surge in malware threats, compromising user data, privacy concerns, and financial and device integrity, to name a few. To combat this, numerous efforts have explored automated botnet detection mechanisms, with anomaly-based approaches leveraging machine learning (ML) gaining attraction due to their signature-agnostic nature. However, the problem lies in devising accurate ML models which capture the ever evolving landscape of malwares by effectively leveraging all the possible features from Android application packages (APKs).This paper delved into this domain by proposing, implementing, and evaluating an image-based Android malware detection (AMD) framework that harnessed the power of feature hybridization. The core idea of this framework was the conversion of text-based data extracted from Android APKs into grayscale images. The novelty aspect of this work lied in the unique image feature extraction strategies and their subsequent hybridization to achieve accurate malware classification using ML models. More specifically, four distinct feature extraction methodologies, namely, Texture and histogram of oriented gradients (HOG) from spatial domain, and discrete wavelet transform (DWT) and Gabor from the frequency domain were employed to hybridize the features for improved malware identification. To this end, three image-based datasets, namely, Dex, Manifest, and Composite, derived from the information security centre of excellence (ISCX) Android Malware dataset, were leveraged to evaluate the optimal data source for botnet classification. Popular ML classifiers, including naive Bayes (NB), multilayer perceptron (MLP), support vector machine (SVM), and random forest (RF), were employed for the classification task. The experimental results demonstrated the efficacy of the proposed framework, achieving a peak classification accuracy of 93.03% and recall of 97.1% for the RF classifier using the Manifest dataset and a combination of Texture and HOG features. These findings validate the proof-of-concept and provide valuable insights for researchers exploring ML/deep learning (DL) approaches in the domain of AMD. [ABSTRACT FROM AUTHOR]

With the rapid development of the Internet of Things (IoT), the sophistication and intelligence of sensors are continually evolving, playing increasingly important roles in smart homes, industrial automation, and remote healthcare. However, these intelligent sensors face many security threats, particularly from malware attacks. Identifying and classifying malware is crucial for preventing such attacks. As the number of sensors and their applications grow, malware targeting sensors proliferates. Processing massive malware samples is challenging due to limited bandwidth and resources in IoT environments. Therefore, compressing malware samples before transmission and classification can improve efficiency. Additionally, sharing malware samples between classification participants poses security risks, necessitating methods that prevent sample exploitation. Moreover, the complex network environments also necessitate robust classification methods. To address these challenges, this paper proposes CSMC (Compressed Sensing Malware Classification), an efficient malware classification method based on compressed sensing. This method compresses malware samples before sharing and classification, thus facilitating more effective sharing and processing. By introducing deep learning, the method can extract malware family features during compression, which classical methods cannot achieve. Furthermore, the irreversibility of the method enhances security by preventing classification participants from exploiting malware samples. Experimental results demonstrate that for malware targeting Windows and Android operating systems, CSMC outperforms many existing methods based on compressed sensing and machine or deep learning. Additionally, experiments on sample reconstruction and noise demonstrate CSMC's capabilities in terms of security and robustness. [ABSTRACT FROM AUTHOR]

The anti-detection capabilities of adversarial malware examples have drawn the attention of antivirus vendors and researchers. In black-box scenarios where internal information of the target model cannot be accessed, with the ability of the reinforcement learning (RL) agents to adjust strategies based on the feedback from the environment, existing RL-based methods enable evasion of Windows PE malware detectors. However, obtaining evasion rewards as positive feedback in the black-box setting proves challenging, resulting in low training efficiency. To address this issue, we introduce the intrinsic curiosity reward into the framework to motivate the agent to explore unknown state spaces and learn effective evasion strategies. Additionally, we employ the generative adversarial network (GAN) to obtain varying synthetic data, which replaces random or benign bytes as adversarial payloads for the agent's action content, improving attack capabilities and reducing the risk of hard-coded adversarial perturbations being anchored. We compare the attack performance with other RL-based baseline methods, and experimental results show that our framework is more flexible and effective, achieving a 63%-85% attack success rate against EMBER, FireEye and MalConv. Even if defensive measures are taken, the proposed method still has a certain attack capability, and the success rate remains between 48%-67%. [ABSTRACT FROM AUTHOR]

The encrypted or https traffic on Internet accounts for the safe and secure communication between users and servers. However, cyber attackers are also exploiting https traffic to disguise their malignant activities. Detection of network threats in https traffic is a tiresome task for security experts owing to the convoluted nature of encrypted traffic on the web. Conventional detection techniques decrypt the network content, check it for threats, re-encrypt the network content, and then send it to the server. But this approach jeopardizes the secrecy of data and user. In recent time, deep learning (DL) has emerged as one of the most fruitful AI methods that diminishes the manual resolution of features to enhance classification accuracy. A DL based strategy is suggested for recognition of threat in encrypted communication without using decryption. The three DL algorithms, as used by the proposed approach are, multilayer perceptron (MLP), long short-term memory (LSTM) and 1-D convolutional neural network (1-D CNN), which are experimented on the CTU-13 malware dataset containing flow-based attributes of network traffic. The outcome of the experiment exhibits that MLP based approach performs better in comparison to 1-D CNN and LSTM based ones and other existing approaches. Thus, the secrecy of the data is maintained and the capability of identifying threats in encrypted communication is augmented. [ABSTRACT FROM AUTHOR]

The rising awareness of cybersecurity among governments and the public underscores the importance of effectively managing security incidents, especially zero-day attacks that exploit previously unknown software vulnerabilities. These zero-day attacks are particularly challenging because they exploit flaws that neither the public nor developers are aware of. In our study, we focused on dynamic application security testing (DAST) to investigate cross-site scripting (XSS) attacks. We closely examined 23 popular WordPress plugins, especially those requiring user or admin interactions, as these are frequent targets for XSS attacks. Our testing uncovered previously unknown zero-day vulnerabilities in three of these plugins. Through controlled environment testing, we accurately identified and thoroughly analyzed these XSS vulnerabilities, revealing their mechanisms, potential impacts, and the conditions under which they could be exploited. One of the most concerning findings was the potential for admin-side attacks, which could lead to multi-site insider threats. Specifically, we found vulnerabilities that allow for the insertion of malicious scripts, creating backdoors that unauthorized users can exploit. We demonstrated the severity of these vulnerabilities by employing a keylogger-based attack vector capable of silently capturing and extracting user data from the compromised plugins. Additionally, we tested a zero-click download strategy, allowing malware to be delivered without any user interaction, further highlighting the risks posed by these vulnerabilities. The National Institute of Standards and Technology (NIST) recognized these vulnerabilities and assigned them CVE numbers: CVE-2023-5119 for the Forminator plugin, CVE-2023-5228 for user registration and contact form issues, and CVE-2023-5955 for another critical plugin flaw. Our study emphasizes the critical importance of proactive security measures, such as rigorous input validation, regular security testing, and timely updates, to mitigate the risks posed by zero-day vulnerabilities. It also highlights the need for developers and administrators to stay vigilant and adopt strong security practices to defend against evolving threats. [ABSTRACT FROM AUTHOR]

Timely detection of self-replicating malware in the high market share Windows operating system can effectively prevent personal or corporate financial losses. The form and characteristics of malware are constantly evolving, leading to a concept drift issue that gradually decreases the effectiveness of traditional detection methods. Therefore, we propose WinMDet, a Windows malware detection method based on malicious tendency image and ResNet algorithm. First, to tackle the complexity and difficulty in accurately characterizing malware features, WinMDet retains detailed malware features and encodes them into malicious tendency images to better describe malware across different periods. Secondly, WinMDet utilizes previously generated malicious tendency images to train the initial detection model. Then, to alleviate the issue of malware concept drift, WinMDet employs Local Maximum Mean Discrepancy (LMMD) as the criterion for model transfer, enhancing the initial detection model's ability to distinguish between malware and benign software. We conducted a comprehensive evaluation of WinMDet using common metrics such as accuracy, precision and recall. The results indicate that WinMDet performs remarkably well in terms of accuracy, exceeding 82%. Additionally, significant improvements were observed in precision and recall, surpassing 82.42% and 82.06%, respectively. After employing our LMMD-based transfer method, the initial detection model improved the detection accuracy of malware in 2021 and 2022 by approximately 4.22% to 8.06%. The false negative rate decreased by at most 4.34%, and the false positive rate decreased by at most 4.61%. [ABSTRACT FROM AUTHOR]

For malicious purposes, attackers hide malware in the software used by their victims. New malware is continuously being shared on the Internet, which differs both in terms of the type of malware and method of damage. When new malware is discovered, it is possible to check whether there has been similar malware in the past and to use the old malware to counteract the new malware; however, it is difficult to check the maliciousness and similarity of all software. Thus, deep learning technology can be used to efficiently detect and classify malware. This study improves this technology's accuracy by converting static features, which are binary data, into images and by converting time-series data, such as API call sequences, which are dynamic data with different lengths for each datum, into data with fixed lengths. We propose a system that combines AI-based malware detection and classification systems trained on both static and dynamic features. The experimental results showed a detection accuracy of 99.34%, a classification accuracy of 95.1%, and a prediction speed of approximately 0.1 s. [ABSTRACT FROM AUTHOR]

Cybercrime threat intelligence enables proactive measures against threat actors and informed, data-driven security decisions. This study proposes a practical implementation of cybercrime threat intelligence in the Arab world by integrating Indicators of Compromise and collecting security alerts from honeypot systems and open-source intelligence. The data collected are stored on the Malware Information Sharing Platform, an open-source platform used to create and share Indicators of Compromise. This study highlights the intuitive interface of the Malware Information Sharing Platform for data analysis, threat identification, and the correlation of Indicators of Compromise. In addition, machine learning techniques are applied to improve predictive accuracy and identify patterns in the data. The decision tree classifier achieves a high accuracy of 99.79%, and the results reveal significant potential cyber-threats, demonstrating the effectiveness of the platform in providing actionable information to prevent, detect, and respond to cybercrime. This approach aims to improve the security posture of the Arab region. [ABSTRACT FROM AUTHOR]

Malware classification stands as a crucial element in establishing robust computer security protocols, encompassing the segmentation of malware into discrete groupings. Recently, the emergence of machine learning has presented itself as an apt approach for addressing this challenge. Models can undergo training employing diverse malware attributes, such as opcodes and API calls, to distill valuable insights for effective classification. Within the realm of natural language processing, word embeddings assume a pivotal role by representing text in a manner that aligns closely with the proximity of similar words. These embeddings facilitate the quantification of word resemblances. This research embarks on a series of experiments that harness hybrid machine learning methodologies. We derive word vectors from dynamic API call logs associated with malware and integrate them as features in collaboration with diverse classifiers. Our methodology involves the utilization of Hidden Markov Models and Word2Vec to generate embeddings from API call logs. Additionally, we amalgamate renowned models like BERT and ELMo, noted for their capacity to yield contextualized embeddings. The resultant vectors are channeled into our classifiers, namely Support Vector Machines (SVMs), Random Forest (RF), k-Nearest Neighbors (kNNs), and Convolutional Neural Networks (CNNs). Through two distinct sets of experiments, our objective revolves around the classification of both malware families and categories. The outcomes achieved illuminate the efficacy of API call embeddings as a potent instrument in the domain of malware classification, particularly in the realm of identifying malware families. The best combination was RF and word embeddings generated by Word2Vec, ELMo, and BERT, achieving an accuracy between 0.91 and 0.93. This result underscores the potential of our approach in effectively classifying malware. [ABSTRACT FROM AUTHOR]

The proliferation of malware gravely threatens the security of computer systems and sensitive data. This work aims to improve malware detection by using advanced feature selection techniques. The study utilizes the Firefly Algorithm (FA) for feature selection in binary and multiclass classifications to enhance the discrimination capabilities of selected features. The selected features from the binary and multiclass classifications are combined to generate a comprehensive feature set. The Obfuscated-MalMem2022 dataset is employed in the experimental evaluation. The Random Forest (RF) method completes the classification problem. Remarkably, the results demonstrate that RF performs better with the combined feature set than with features chosen separately from the binary and multiclass classifications by the FA method. RF attains a remarkable 99.983% accuracy in binary classification, demonstrating the potency of the selected features in differentiating between malicious and benign data. Moreover, RF demonstrates an impressive accuracy of 87.304% in multiclass classification, highlighting the strength of the proposed methodology. [ABSTRACT FROM AUTHOR]

This paper attempts to examine the extent of cybersecurity awareness among college students and propose some effective measures to prevent them from cyber-attacks. In light of the pervasive integration of cutting-edge technologies in education and our daily life, College students faces various on-line threats. Given their active internet usage, college students are particularly susceptible to cyber-attacks through activities such as exploring e-content, engaging in social media platform, participating in online learning platforms, digital polls, quizzes, Kahoot, online debates and research work. This study holds significance for college students, who are particularly vulnerable. To protect them from cyber threats, understanding their level of cybersecurity consciousness regarding phishing scams, malware, ransomware, and other computer threats, as well as their knowledge of preventive measures, is extremely crucial. The escalating number of hackers and organized cybercriminals underscores the need for heightened cybersecurity awareness. These cybercriminals continually seek innovative techniques for cyber theft, including obtaining sensitive and confidential information from college students for potential blackmail or selling to others. This study involves an efficient online survey conducted among college students to gauge their cybersecurity awareness and preventive measures knowledge. Based on the survey findings, recommendations are provided to strengthen cybersecurity and encourage safer online practices among college students. [ABSTRACT FROM AUTHOR]

In recent years, with the development of the Internet, the attribution classification of APT malware remains an important issue in society. Existing methods have yet to consider the DLL link library and hidden file address during the execution process, and there are shortcomings in capturing the local and global correlation of event behaviors. Compared to the structural features of binary code, opcode features reflect the runtime instructions and do not consider the issue of multiple reuse of local operation behaviors within the same APT organization. Obfuscation techniques more easily influence attribution classification based on single features. To address the above issues, (1) an event behavior graph based on API instructions and related operations is constructed to capture the execution traces on the host using the GNNs model. (2) ImageCNTM captures the local spatial correlation and continuous long-term dependency of opcode images. (3) The word frequency and behavior features are concatenated and fused, proposing a multi-feature, multi-input deep learning model. We collected a publicly available dataset of APT malware to evaluate our method. The attribution classification results of the model based on a single feature reached 89.24% and 91.91%. Finally, compared to single-feature classifiers, the multi-feature fusion model achieves better classification performance. [ABSTRACT FROM AUTHOR]

NSO Group is an Israeli cyber surveillance firm notorious for Pegasus – an intrusive malware capable of covertly taking control of smartphones and remotely extracting their contents. In 2019, after a series of unflattering reports on governments' use of Pegasus to infiltrate the phones of activists and journalists, NSO embarked on an uncharacteristically public legitimation campaign. This article focuses on this campaign and explores how this otherwise secretive spyware company publicly legitimizes its surveillance. Based on an empirical analysis of hundreds of public documents across various media, we explore NSO's legitimacy management practices and identify the audiences and contexts of this legitimation. Our analysis identified four legitimation practices: securitization, Zionist patriotism, ethics washing, and normalization. We argue that these legitimation strategies operate across two interrelated axes of legitimation: a local axis that echoes a particularly Israeli 'security-driven populism'; and a universal axis that follows Silicon Valley's ethics washing. We show that these legitimation axes are designed to simultaneously ensure the company's survivability and to sustain surveillance realism – the perception of surveillance as the only viable option This article contributes to the emerging literature on cyber surveillance firms and to the burgeoning research on the legitimation of surveillance by shedding light on the discursive infrastructures behind contemporary cyber espionage. Moreover, while surveillance is often understood as a global phenomenon, this article highlights the need to focus on the local contexts from which surveillance originates to understand its sustainability, expansion, and vulnerabilities. [ABSTRACT FROM AUTHOR]

Binary code similarity detection plays a crucial role in various applications within binary security, including vulnerability detection, malicious software analysis, etc. However, existing methods suffer from limited differentiation in binary embedding representations across different compilation environments, lacking dynamic high-level semantics. Moreover, current approaches often neglect multi-level semantic feature extraction, thereby failing to acquire precise semantic information about the binary code. To address these limitations, this paper introduces a novel detection solution called BinBcla. This method employs an enhanced pre-training model to generate instruction embeddings with dynamic semantics for binary functions. Subsequently, multi-feature fusion technique is utilized to extract local semantic information and long-distance global features from the code, respectively, employing self-attention to comprehend the structure information of the code. Finally, an improved cosine similarity method is employed to learn relationships among all elements of the distance vectors, thereby enhancing the model's robustness to new sample functions. Experiments are conducted across different architectures, compilers, and optimization levels. The results indicate that BinBcla achieves higher accuracy, precision and F1 score compared to existing methods. [ABSTRACT FROM AUTHOR]

The rapid growth of Android devices has led to increased security concerns, especially from malicious software. This study extensively compares machinelearning algorithms for effective Android malware detection. Traditional models, such as random forest (RF) and support vector machines (SVM), alongside advanced approaches, such as convolutional neural networks (CNN) and XGBoost, were evaluated. Leveraging the NATICUSdroid dataset containing 29,332 records and 86 traces, the results highlight the superiority of RF with 97.1% and XGBoost with 97.2% accuracy. However, evolving malware and real-world unpredictability require a cautious interpretation. Promising as they are, our findings stress the need for continuous innovation in malware detection to ensure robust Android user security and data integrity. [ABSTRACT FROM AUTHOR]

A dynamical model is constructed to depict the spatial-temporal evolution of malware in mobile wireless sensor networks (MWSNs). Based on such a model, we design a hybrid control scheme combining parameter perturbation and state feedback to effectively manipulate the spatiotemporal dynamics of malware propagation. The hybrid control can not only suppress the Turing instability caused by diffusion factor but can also adjust the occurrence of Hopf bifurcation induced by time delay. Numerical simulation results show that the hybrid control strategy can efficiently manipulate the transmission dynamics to achieve our expected desired properties, thus reducing the harm of malware propagation to MWSNs. [ABSTRACT FROM AUTHOR]

Smart Autonomous Vehicles (AVSs) are networks of Cyber-Physical Systems (CPSs) in which they wirelessly communicate with other CPSs sub-systems (e.g., smart -vehicles and smart-devices) to efficiently and securely plan safe travel. Due to unreliable wireless communication among them, such vehicles are an easy target of malware attacks that may compromise vehicles' autonomy, increase inter-vehicle communication latency, and drain vehicles' power. Such compromises may result in traffic congestion, threaten the safety of passengers, and can result in financial loss. Therefore, real-time detection of such attacks is key to the safe smart transportation and Intelligent Transport Systems (ITSs). Current approaches either employ static analysis or dynamic analysis techniques to detect such attacks. However, these approaches may not detect malware in real-time because of zero-day attacks and huge computational resources. Therefore, we introduce a hybrid approach that combines the strength of both analyses to efficiently detect malware for the privacy of smart-cities. [ABSTRACT FROM AUTHOR]

Android is the most targeted mobile operating system for malware attacks. Most modern anti-malware solutions largely incorporate deep learning or machine learning techniques to detect malwares. In this paper, we conduct a comprehensive analysis on 10 deep learning and 5 machine learning classifiers in their abilities to identify Android malware applications. We used 1-gram dataset, 2-gram dataset and image dataset generated from the system call co-occurrence matrix for our experiments. Among the machine learning classifiers, XGBoost with 2-gram dataset showed the highest F1-score of 0.98. Also, the deep learning classifiers such as extreme learning machine with the system call images demonstrated the best F1-score of 0.952. We experimented using Gabor filters to investigate classifier performance on textures extracted from system call images. We observed an F1-score of 0.953 using the extreme learning machine with the Gabor images. We generated the Gabor image dataset by combining the images generated by passing system call images through 25 different Gabor configurations. In addition, to enhance the performance of the baseline classifiers, we considered the combination of autoencoders with machine learning classifiers. We observed that the amalgam of autoencoder with Random Forest displayed the best F1-score of 0.98. To evaluate the effectiveness of the aforesaid classifiers with diverse features on adversarial examples, we simulated a black-box based attack using a Generative Adversarial Network. The True Positive Rate of XGBoost on the 1-gram dataset, Random Forest on the 2-gram dataset and the Extreme Learning Machine on the system call image dataset significantly dropped to 0 from 0.98, 0.001 from 0.99 and 0 from 0.984 after the attack. Our experiments exposed a crucial vulnerability in classifiers used in modern anti-malware systems. A similar event in a real-world system could potentially render grave catastrophes. To defend against such probable attacks, we should continue further research and develop adequate security mechanisms. [ABSTRACT FROM AUTHOR]

For Years, Experts have expressed growing concerns that critical infrastructures are vulnerable to cyberattacks. Remotely transmitted malware and viruses can compromise interconnected power systems, airports, hospitals, military systems, and any Internet-connected computers used to manage critical functions. As the world becomes more digitalized, integrating new communication technologies offers unlimited possibilities for the accumulation of information, creating a fundamental dependence on proper functioning in all areas of society. As such reliance could offer great opportunities for a smart and efficient world, it also poses significant threats to the operation of critical infrastructures and vital facilities. Specifically, safety issues from illegal acts that violate the integrity, availability, and confidentiality of information in cyberspace are expected to be the central theme in the digitalized world. Exploitation of cyberspace to advance political, social, and military agendas is of particular concern. [ABSTRACT FROM AUTHOR]

The first Android-ready "G1" phone debuted in late October 2008. Since then, the growth of Android malware has been explosive, analogous to the rise in the popularity of Android. The major positive aspect of Android is its open-source nature, which empowers app developers to expand their work. However, authors with malicious intentions pose grave threats to users. In the presence of such threats, Android malware detection is the need of an hour. Consequently, researchers have proposed various techniques involving static, dynamic, and hybrid analysis to address such threats to numerous features in the last decade. However, the feature that most researchers have extensively used to perform malware analysis and detection in Android security is Android permission. Hence, to provide a clarified overview of the latest and past work done in Android malware analysis and detection, we perform a comprehensive literature review using permissions as a central feature or in combination with other components by collecting and analyzing 205 studies from 2009 to 2023. We extracted information such as the choice opted by researchers between analysis or detection, techniques used to select or rank the permissions feature set, features used along with permissions, detection models employed, malware datasets used by researchers, and limitations and challenges in the field of Android malware detection to propose some future research directions. In addition, on the basis of the information extracted, we answer the six research questions designed considering the above factors. [ABSTRACT FROM AUTHOR]

Ransomware, particularly crypto ransomware, has emerged as the go-to malware for threat actors aiming to compromise data on Android devices as well as in general. In this paper, we present a ransomware detection technique based on behaviours observed in the system calls performed by the malware. We first describe our repeatable and extensible methodology for extracting the system call log and patterns. We then identify and present some common high-level system call behavioural patterns exhibited by crypto ransomware, and evaluate these patterns. We further describe the implementation of a streaming implementation that utilises regular expressions for modelling malware behaviours and finite state machines for detecting crypto ransomware behaviours in real time. The success of our proof of concept evaluation allows us to envision our proposed technique applied as part of a self-protection system on Android phones against malware. [ABSTRACT FROM AUTHOR]

This study propose the use of AI enabled machine learning algorithms with the Bag‐of‐Word (BoW) methods for the detection of intrusions by analysing the system call patterns. Host based Intrusion Detection System can make use of system call patterns to differentiate between normal and anomalous program behaviours. First, the system call patterns are pre‐processed with different approaches like BoW, BoW with Boolean value, BoW with Probability value and BoW with TF‐IDF. Next machine learning algorithms are used to evaluate the performance of classifier models. We used J48 (C4.5), Random Forrest, RIPPER, KNN, SVM, and NaiveBayes ML algorithms. This process was carried out on ADFA‐LD and on our proposed virtual machine monitor (VMM) malware attack data set for analysis. The proposed work is evaluated based on detection accuracy and false alarm rate metrics. Random Forrest algorithm performs better compared with other ML algorithms in terms of intrusion detection accuracy and false alarm rate on ADFA and VMM malware data set. The proposed data set provide better results compared with ADFA‐LD analysed using ML algorithms. The classifier model trained with ADFA and VMM malware system call data sets may do predictive analytics in detecting security issues for Industry 4.0 systems. [ABSTRACT FROM AUTHOR]

Malware classification is a crucial step in defending against potential malware attacks. Despite the significance of a robust malware classifier, existing approaches reveal notable limitations in achieving high performance in malware classification. This study focuses on image-based malware detection, where malware binaries are transformed into visual representations to leverage image classification techniques. We propose a two-branch deep network designed to capture salient features from these malware images. The proposed network integrates faster asymmetric spatial attention to refine the extracted features of its backbone. Additionally, it incorporates an auxiliary feature branch to learn missing information about malware images. The feasibility of the proposed method has been thoroughly examined and compared with state-of-the-art deep learning-based classification methods. The experimental results demonstrate that the proposed method can surpass its counterparts across various evaluation metrics. [ABSTRACT FROM AUTHOR]

Android stands out as one of the most prevalent mobile operating systems globally, due to its widespread adoption and open-source nature. However, its susceptibility to malware attacks, facilitated by the ability to install third-party applications without centralized control, poses significant security challenges. Despite efforts to integrate security measures, the proliferation of malicious activities and vulnerabilities emphasizes the need for advanced detection techniques. This study implemented and optimized Long Short-Term Memory (LSTM) and Neural Network (NN) models for malware detection on the Android platform. Leveraging meticulous hyperparameter tuning and robust data preprocessing techniques, this study aimed to increase the efficacy of LSTM and NN models in identifying and mitigating various forms of malware. The results demonstrate remarkable performance, with the LSTM model achieving an accuracy of 99.24%, precision of 99.07%, recall of 98.79%, and F1-score of 98.93%, and the NN model attaining an accuracy of 99.18%, precision of 99.02%, recall of 98.84%, and F1-score of 98.93%. By addressing these challenges and achieving such high levels of accuracy and effectiveness, this study contributes significantly to the ongoing endeavor to fortify defenses against cyber threats, thus fostering a safer digital environment for users worldwide. [ABSTRACT FROM AUTHOR]

Cybercriminals motivated by malign purpose and financial gain are rapidly developing new variants of sophisticated malware using automated tools, and most of these malware target Windows operating systems. This serious threat demands efficient techniques to analyze and detect zero-day, polymorphic and metamorphic malware. This paper introduces two frameworks for Windows malware detection using random forest algorithms. The first scheme uses features obtained from static and dynamic analysis for training, and the second scheme uses features obtained from static, dynamic, malware image analysis, location-sensitive hashing and file format inspections. We carried out an extensive experiment on two feature sets, and the proposed schemes are evaluated using seven standard evaluation metrics. The experiment results demonstrate that the second scheme recognizes unseen malware better than the first scheme and three state-of-the-art works. The findings show that the second scheme's multi-view feature set contributes to its 99.58% accuracy and lowers false positive rate of 0.54%. [ABSTRACT FROM AUTHOR]

Malware analysis is essential for detecting and mitigating the effects of malicious software. This study introduces a novel hybrid approach using a combination of long short-term memory (LSTM) and convolutional neural networks (CNN) to enhance malware analysis. The proposed work uses a malware classification method combining image processing and machine learning. Malware binaries are converted into grayscale images and analyzed with CNN-LSTM networks. Dynamic features are extracted, ranked, and reduced via Principal Component Analysis (PCA). Various classifiers are used, with final classification by a voting scheme, providing a robust solution for accurate malware family classification. Our approach processes binary code inputs, with the LSTM capturing temporal dependencies and the CNN performing parallel feature extraction. PCA is employed for prominent feature selection, reducing computational time. The proposed approach was evaluated on a public malware dataset and captured through network traffic, demonstrating state-of-the-art performance in identifying various malware families. It significantly reduces the resources required for manual analysis and improves system security. Our approach achieved high precision, recall, accuracy, and F1 score, outperforming existing methods. Future research directions include improving feature extraction techniques and developing real-time detection models that offer a powerful malware detection and analysis tool with promising results and potential for further advancements. [ABSTRACT FROM AUTHOR]

The escalating sophistication of malware poses a formidable security challenge, as it evades traditional protective measures. Static analysis, an initial step in malware investigation, involves code scrutiny without actual execution. One static analysis approach employs the conversion of executable files into image representations, harnessing the potency of deep learning models. Convolutional neural networks (CNNs), particularly adept at image classification, have potential for malware detection. However, their inclination towards structured data requires a preprocessing phase to convert software into image-like formats. This paper outlines a methodology for malware detection that involves applying deep learning models to image-converted executable files. Experimental evaluations have been performed by using CNN models, autoencoder-based models, and pre-trained counterparts, all of which have exhibited commendable performance. Consequently, employing deep learning for imageconverted executable analysis emerges as a fitting strategy for the static analysis of software. This research is significant because it utilized the largest dataset to date and encompassed a wide range of deep learning models, many of which have not previously been tested together. [ABSTRACT FROM AUTHOR]

Technological advancement in communication leading to 5G, motivates everyone to get connected to the internet including 'Devices', a technology named Web of Things (WoT). The community benefits from this large-scale network which allows monitoring and controlling of physical devices. But many times, it costs the security as MALicious softWARE (MalWare) developers try to invade the network, as for them, these devices are like a 'backdoor' providing them easy 'entry'. To stop invaders from entering the network, identifying malware and its variants is of great significance for cyberspace. Traditional methods of malware detection like static and dynamic ones, detect the malware but lack against new techniques used by malware developers like obfuscation, polymorphism and encryption. A machine learning approach to detect malware, where the classifier is trained with handcrafted features, is not potent against these techniques and asks for efforts to put in for the feature engineering. The paper proposes a malware classification using a visualization methodology wherein the disassembled malware code is transformed into grey images. It presents the efficacy of Granulometry texture analysis technique for improving malware classification. Furthermore, a Semi Eager (SemiE) classifier, which is a combination of eager learning and lazy learning technique, is used to get robust classification of malware families. The outcome of the experiment is promising since the proposed technique requires less training time to learn the semantics of higher-level malicious behaviours. Identifying the malware (testing phase) is also done faster. A benchmark database like malimg and Microsoft Malware Classification challenge (BIG-2015) has been utilized to analyse the performance of the system. An overall average classification accuracy of 99.03 and 99.11% is achieved, respectively. [ABSTRACT FROM AUTHOR]

Malware remains a big threat to cyber security, calling for machine learning-based malware detection. Malware variations exhibit common behavioral patterns indicative of their source and intended use to enhance the existing framework's usefulness. Here we present a novel model, i.e., African Vulture Optimization-based Decision Tree (AVO-DT) to increase the overall optimization. The datasets from Android apps and malware software train the AVO-DT model. After training, the datasets are pre-processed by removing training errors. The DT algorithm is used by the developed AVO model to carry out the detection procedure and predict malware activity. To detect malware activities and improve accuracy, such an AVO-DT model technique employs both static and dynamic methodologies. The other measurements on Android applications might be either malicious or benign. Here we also developed malware prevention and detection systems to address ambiguous search spaces in multidimensionality difficulties and resolve optimization challenges. [ABSTRACT FROM AUTHOR]

Persistent malware use techniques, such as obfuscation, process injection, and system call abuse to evade security mechanisms and avoid detection throughout their compromise. Malware analysis and memory forensics must have proper skill for fighting them. To show the limitation of current memory forensics, we introduce an adversarial technique to remove the forensics evidence required to identify malware, called parent process termination (PPT). PPT neither creates a new malware nor does it manipulate the features of a running process like malware obfuscation techniques, which abuse the parent–child relationship. In PPT, the malware process creates child processes for a malicious purpose and then terminates. This termination, letting the operating system (OS) reuses the parent process's resources and thus erases all trace of it, while leaving its children to perform anomalous activities. To show PPT's applicability in Windows OS, we run and analyze selected malware samples in a controlled environment. We implement PPT and show how this technique benefits from current memory forensics tools being unable to identify the exited processes. The forensics analysis proves behaviour of the PPT adversarial technique run in different malware executions. Our experiments show PPT successfully removes forensics evidence to identify the source of malicious activity. We hope these results can shed light on the future design of memory forensics tools and better-informed choices by users. [ABSTRACT FROM AUTHOR]

Android phones are widely recognised as the most popular mobile phone operating system. Additionally, tasks like browsing the internet, taking pictures, making calls, and sending messages may be completed with ease in daily life because of the functionality that Android phones offer. The number of situations in which users are harmed by unauthorised access to data emerging from these processes is growing daily. Because the Android operating system is open source and generated applications are not thoroughly reviewed before being released onto the market, this scenario has been the primary focus of hackers. Therefore, technologies to distinguish between malware and benign Android applications are required. CNN-based techniques are proven to produce important and successful outcomes when applied to Android malware detection on images. The CICMalDroid 2020 dataset, which is currently utilised in the literature, was used for this purpose. The features of the apps in the dataset were obtained using the AndroPyTool tool, and faster analysis files of 17,089 Android applications were obtained using the parallel execution technique. Permissions, intents, receivers, and services were used as static analysis features in this article. After these features were obtained, as data preprocessing, the ones with a grand total equal to 1 for each feature in the whole dataset were excluded in order to exclude the features that were specially created by the applications themselves. For each of the features specified for each application, a comma-separated text was obtained according to the usage status of the application. The BERT method was used to digitise the pertinent texts in order to create a unique embedding vector for every feature. Following the digitisation of the vectors, picture files were produced based on the length of each feature. To create a single image file, these image files were combined side by side. Finally, these image files were classified with CNNs. Experimental results were obtained by applying CNNs to the dataset used in the study. As a result of the experiments, a CNN with two outputs provided the highest performance with an accuracy of 91%, an F1-score of 89%, a Recall of 90%, and a Precision of 91%. [ABSTRACT FROM AUTHOR]

Ransomware is a type of malicious software that encrypts or locks user files and demands a high ransom. It has become a major threat to cyberspace security, especially as it continues to be developed and updated at exponential rates. Ransomware detection technology has become a focus of research on information security risk detection methods. However, current ransomware detection techniques have high false positive and false negative rates, and traditional methods ignore global word co-occurrence and correlation information between key node steps in the entire process. This poses a significant challenge for accurately identifying and detecting ransomware. We propose a ransomware detection model based on co-occurrence information adaptive diffusion learning using a Text Graph Convolutional Network (ADC-TextGCN). Specifically, ADC-TextGCN first assign self-weights to word nodes based on sensitive API call functions and preserve co-occurrence information using Point Mutual Information Theory (COIR-PMI); then our model automatically learn the optimal neighborhood through an Adaptive Diffusion Convolution (ADC) strategy, thereby improving the ability to aggregate long-distance node information across layers and enhancing the network's ability to represent ransomware behavior. Experimental results show that our method achieves an accuracy of over 96.6% in ransomware detection, proving its effectiveness and superiority compared to traditional methods based on CNN and RNN in ransomware detection. [ABSTRACT FROM AUTHOR]

The recent advancements in generative adversarial networks have showcased their remarkable ability to create images that are indistinguishable from real ones. This has prompted both the academic and industrial communities to tackle the challenge of distinguishing fake images from genuine ones. We introduce a method to assess whether images generated by generative adversarial networks, using a dataset of real-world Android malware applications, can be distinguished from actual images. Our experiments involved two types of deep convolutional generative adversarial networks, and utilize images derived from both static analysis (which does not require running the application) and dynamic analysis (which does require running the application). After generating the images, we trained several supervised machine learning models to determine if these classifiers can differentiate between real and generated malicious applications. Our results indicate that, despite being visually indistinguishable to the human eye, the generated images were correctly identified by a classifier with an F-measure of approximately 0.8. While most generated images were accurately recognized as fake, some were not, leading them to be considered as images produced by real applications. [ABSTRACT FROM AUTHOR]

Speech emotion recognition (SER) systems leverage information derived from sound waves produced by humans to identify the concealed emotions in utterances. Since 1996, researchers have placed effort on improving the accuracy of SER systems, their functionalities, and the diversity of emotions that can be identified by the system. Although SER systems have become very popular in a variety of domains in modern life and are highly connected to other systems and types of data, the security of SER systems has not been adequately explored. In this paper, we conduct a comprehensive analysis of potential cyber-attacks aimed at SER systems and the security mechanisms that may prevent such attacks. To do so, we first describe the core principles of SER systems and discuss prior work performed in this area, which was mainly aimed at expanding and improving the existing capabilities of SER systems. Then, we present the SER system ecosystem, describing the dataflow and interactions between each component and entity within SER systems and explore their vulnerabilities, which might be exploited by attackers. Based on the vulnerabilities we identified within the ecosystem, we then review existing cyber-attacks from different domains and discuss their relevance to SER systems. We also introduce potential cyber-attacks targeting SER systems that have not been proposed before. Our analysis showed that only 30% of the attacks can be addressed by existing security mechanisms, leaving SER systems unprotected in the face of the other 70% of potential attacks. Therefore, we also describe various concrete directions that could be explored in order to improve the security of SER systems. [ABSTRACT FROM AUTHOR]