Using static analysis for Ajax intrusion detection

This article describes how honeypots and intrusion detection systems serve as major mechanisms for security administrators to collect a variety of sample viruses and malware for further analysis, classification, and system protection. However, increased variety and complexity of malware makes the analysis and classification challenging, especially when efficiency and timely response are two contradictory yet equally significant criteria in malware classification. Besides, similarity-based classifications exhibit insufficiency because the mutation and fuzzification of malware exacerbate classification difficulties. In order to improve malware classification speed and attend to mutation, this research proposes the ameliorated progressive classification that integrates static analysis and improved k-means algorithm. This proposed classification aims at assisting network administrators to have a malware classification preprocess and make efficient malware classifications upon the capture of new malware, thus enhancing the defense against malware.

Download Full-text

Malware detection using static analysis in Android: a review of FeCO (features, classification, and obfuscation)

PeerJ Computer Science ◽

10.7717/peerj-cs.522 ◽

2021 ◽

Vol 7 ◽

pp. e522

Author(s):

Rosmalissa Jusoh ◽

Ahmad Firdaus ◽

Shahid Anwar ◽

Mohd Zamri Osman ◽

Mohd Faaizie Darmawan ◽

...

Keyword(s):

Operating System ◽

Intrusion Detection ◽

Open Source ◽

Mobile Devices ◽

Static Analysis ◽

Malware Detection ◽

Research Issue ◽

Reverse Engineer ◽

Smart Glasses ◽

Free Open Source

Android is a free open-source operating system (OS), which allows an in-depth understanding of its architecture. Therefore, many manufacturers are utilizing this OS to produce mobile devices (smartphones, smartwatch, and smart glasses) in different brands, including Google Pixel, Motorola, Samsung, and Sony. Notably, the employment of OS leads to a rapid increase in the number of Android users. However, unethical authors tend to develop malware in the devices for wealth, fame, or private purposes. Although practitioners conduct intrusion detection analyses, such as static analysis, there is an inadequate number of review articles discussing the research efforts on this type of analysis. Therefore, this study discusses the articles published from 2009 until 2019 and analyses the steps in the static analysis (reverse engineer, features, and classification) with taxonomy. Following that, the research issue in static analysis is also highlighted. Overall, this study serves as the guidance for novice security practitioners and expert researchers in the proposal of novel research to detect malware through static analysis.

Download Full-text

Advancing Malware Classification With an Evolving Clustering Method

Cognitive Analytics ◽

10.4018/978-1-7998-2460-2.ch096 ◽

2020 ◽

pp. 1882-1894

Author(s):

Chia-Mei Chen ◽

Shi-Hao Wang

Keyword(s):

Intrusion Detection ◽

Static Analysis ◽

Intrusion Detection Systems ◽

Clustering Method ◽

System Protection ◽

Detection Systems ◽

Malware Classification ◽

Timely Response ◽

Network Administrators

This article describes how honeypots and intrusion detection systems serve as major mechanisms for security administrators to collect a variety of sample viruses and malware for further analysis, classification, and system protection. However, increased variety and complexity of malware makes the analysis and classification challenging, especially when efficiency and timely response are two contradictory yet equally significant criteria in malware classification. Besides, similarity-based classifications exhibit insufficiency because the mutation and fuzzification of malware exacerbate classification difficulties. In order to improve malware classification speed and attend to mutation, this research proposes the ameliorated progressive classification that integrates static analysis and improved k-means algorithm. This proposed classification aims at assisting network administrators to have a malware classification preprocess and make efficient malware classifications upon the capture of new malware, thus enhancing the defense against malware.

Download Full-text