Ekta Gandotra, Divya Bansal, Sanjeev Sofat · International Journal of Advanced Intelligence Paradigms · 2019
A number of malware samples are available online but a little research has attempted to thoroughly analyse these for obtaining insights or intelligence about their behavioural trends, which can further be used to issue early warnings about future threats. In this paper, we have performed an in-depth analysis of about 0.1 million historical malware specimens in a sandbox environment to generate their attributes and behaviour. Afterwards, the intelligent information is mined using statistical analysis to study their behavioural trends and capabilities. The information so obtained can help to gain insight into the future measures that malware authors can use to design their programs. The paper also highlights the challenges evolving out of these trends which provide the future research directions to malware analysts and security researchers. Furthermore, this type of analysis facilitates research community in selecting the parameters/factors for building faster and improved techniques for detecting unknown malware.
Cited by 9
Bulletin of Miscellaneous Information (Royal Gardens Kew)
Cited by 0
Adrian Elie · Zenodo (CERN European Organization for Nuclear Research) · 2024
Cited by 0Open access
Adam Tilmar Jakobsen · 2024
This chapter delves into the realm of malware analysis, a crucial discipline within cybersecurity. Malware analysis involves comprehending the behaviour of malicious software, with a primary focus on understanding its intricacies to develop effective countermeasures. The analysis is conducted in isolated environments to prevent unintended network infections. The chapter discusses the acquisition of malware samples from various online repositories, emphasizing the need for caution due to their potential harm. Detailed attention is given to the creation of secure analysis environments, utilizing virtual machines, such as Windows and Linux setups. The significance of network simulation tools like Fakeneting and INetSim is highlighted to deceive malware samples and allow controlled analysis. In summary, the chapter equips readers with foundational knowledge and practical insights into malware analysis, showcasing a holistic approach encompassing sample acquisition, secure environments, dynamic analysis, and code analysis.
Cited by 1Open access
Seferiadis, Christos, Σεφεριάδης, Χρήστος · Dione (University of Piraeus) · 2025
Cited by 0Open access
Saffaf, Mohammad Nour · Theseus (Ammattikorkeakoulujen) · 2009
The number of computer viruses in circulation has reached one million for the first time, according to a report by Symantec, a leading security firm. The Internet has become an \nessential part of everyday life. As a result sensitive, personal and credit cards information are examples of monetary gains to virus writers. \n \nThe main objective of this thesis was to present a technical overview of existing malware mechanisms and protections and how the malware forensics counter-attack techniques can be applied. Likewise, the limitations of anti-virus programs and the current computer security was discussed. \n \nBesides with the theoretical study of the methods of malware forensics that can be used against malware attacks, a practical case study was carried out to attain better understanding of malware internals and current forensics tools. \n \nThe result of this thesis highlighted the importance and the limitations of the forensics techniques for fighting current and future malware. Malware uses advanced techniques to protect and hide itself from both protection and forensics tools. Therefore, achieving efficient software security is difficult and absolute protection is impossible under the \ncurrent computer architecture.
Cited by 0Open access
Elsevier eBooks · 2009
Cited by 1
Nikita Patil, A.K. Singh, Sushil Kumar · 2023
Currently, the Internet has become an indispensable aspect of many individuals’ daily lives. Countless online services are readily available, and their numbers continue to grow steadily. A growing number of people are utilizing these services, such as web-based banking and advertising, which exemplify the business applications of the Internet. However, just like in the physical world, there are individuals on the Internet with malicious intentions, seeking to exploit real users whenever financial transactions are involved. This research paper delves into the analysis of malware from an experimental standpoint.
Cited by 0
Meghana, V., Reddy, I. Pratham, Kumar, J. Revanth et al. · Zenodo (CERN European Organization for Nuclear Research) · 2024
<p>Malware is a major threat to computer systems and networks. Traditional malware detection methods, such as signature-based detection, are becoming –increasingly ineffective due to the ever-increasing sophistication of malware. Deep learning methods, such as convolutional neural networks (CNNs) and convolutional neural networks with long short-term memory (LSTM) units, have shown promise in malware detection. In this project, we propose a novel malware detection system that uses a CNN with LSTM units. The CNN is used to extract features from the malware code, while the LSTM is used to model the temporal relationships between these features. The system is trained on a dataset of malware and benign code. We evaluate the system on a test dataset of malware and benign code and show that it can achieve high accuracy in detecting malware. Our results show that deep learning methods can be used to effectively detect malware. The proposed system is a promising new approach to malware detection and can be used to protect computer systems and networks from malware attacks.</p>
Cited by 0Open access
Nitin Sukhija · Zenodo (CERN European Organization for Nuclear Research) · 2023
<strong>This slide deck lays out the differences between static and dynamic malware analysis methods. Relevant and valuable tools such as IDA Pro, PE Explorer, OllyDBG, WinDBG, and Procmon are covered in depth. For each tool there is an overview, a detailed description of the key features, and then a brief overview of other relevant features. Each tool's strengths and limitations are highlighted, and use cases are shown. After viewing, the reader will have a thorough understanding of several malware analysis tools, as well as the information necessary to choose the best tool for each specific use case. </strong>
Cited by 0Open access
Joakim Kävrestad · 2018
Cited by 0
Thomas S Hyslip · 2015
With the ever expanding use of the internet, and the availability of always on, high speed internet at the home, the threat of malware has never been greater. In the past viruses were passed from user to user through storage media, or as attachments to email. But today malicious software, or malware, is potentially on any website, or embedded in many files that appear harmless. In most instances, antivirus software or spyware removal software will detect the malware and protect the computer from infection, but not always. This paper examines the response needed when your computer is infected with malware, the effect of malware programs and how to determine the changes to an operating system. My research shows the different programs available to analyze malware and determine the effects of malware. This includes the methodology that should be used when analyzing malware, and will take the reader step by step through the process of responding to a malware infection, establishing a controlled environment, infecting a PC with malware and analyzing the results. This includes how to establish a baseline of the victim machine you intend to infect with the malware, and monitor pre-infection network traffic to isolate it from the malware inspired traffic. I discuss the process of examining the malware during your response to an infection, isolating the malware for future analysis in a lab, infecting a lab PC with the malware and monitoring the changes to the file system, registry, executables, open ports, and network traffic. This information is then compared with the baseline status to determine the effects of the malware on the operating system. The network traffic is also analyzed to identify any suspicious traffic, and possible remote sites the malware is attempting to communicate with. All the software used for this paper is free, and all sources of the software will be identified.
Cited by 0
Joseph Peppers · 2018
In tying together information learned in the Information Assurance program at Iowa State this paper goes over an introduction to malware, basic malware analysis, and setting up a manual malware analysis lab. Malware is malicious software that causes harm. The average malware will have 125 lines of code. Generally, malware consists of 3 components: a concealer, a replicator, and a bomb. Malware is classified based on its nature and functionality. The 3 most common we see are viruses, worms, and Trojans. Malware generally falls into two categories based on its target: mass malware and targeted malware. Four general stages of malware analysis are manual code reversing, interactive behavior analysis, static properties analysis, and automated analysis. The paper goes over basic static and basic dynamic analysis. It briefly touches on advanced static and advanced dynamic analysis to cover 3 of the stages above. Sandboxes are covered and Cuckoo is talked about to cover automated analysis. Setting up a malware analysis lab is talked about as a physical lab or a virtual lab can be set up. Steps are given to use VMWare Workstation Pro to set up a manual malware analysis lab, getting a Microsoft Windows virtual machine, and installing Fireeye’s flare-vm on it. In closing, some work that can be expanded on and done in the future is discussed.
Cited by 4
Saeed Ahmed Rid · Zenodo (CERN European Organization for Nuclear Research) · 2025
Cited by 0Open access
Md. Sadman Haque, Md Sakhawat Hossain, Robiul Awoul Robin et al. · Mendeley Data · 2026
The uploaded dataset (CIC-AndMal2017) contain curated information for Android malware analysis. The dataset is provided in CSV format and includes features selected for effective classification and detection of various malware families and benign applications. It is structured with clearly labeled columns for features and class labels, enabling straightforward use for research, analysis, and benchmarking in Android malware detection studies. This CSV dataset were generated from existing publicly available Android malware dataset. We extracted and organized the relevant features into CSV format to facilitate analysis and reproducibility.
Cited by 0Open access
Thomas A. Woolman, Philip Lunsford · 2023
This article explores the application of anomaly detection models from network flow data using multi-layer perceptron autoencoding neural networks, for the purpose of self-supervised detection of novel network intrusion events and malware classes over unrestrained internet connections. The authors utilized network flows rather than more detailed (and larger) packet capture logs in order to create a more cost-effective and potentially faster anomaly detection tool that could more easily scale enterprise class network traffic analysis. Unsupervised/self-supervised deep learning anomaly detection was used against this less-granular dataset to maximize the likelihood of detecting novel network activities within the less-detailed dataset without relying on pre-defined rules and training data. The authors conclude with a test of statistical significance against known threat classes (unknown to the anomaly detection model) that the proposed methodology results were statistically significant for detecting threat classes in unrestrained internet networks using network flow data.
Cited by 0Open access
Md. Sadman Haque, Md Sakhawat Hossain, Robiul Awoul Robin et al. · Mendeley Data · 2026
The uploaded dataset (CIC-AndMal2017) contain curated information for Android malware analysis. The dataset is provided in CSV format and includes features selected for effective classification and detection of various malware families and benign applications. It is structured with clearly labeled columns for features and class labels, enabling straightforward use for research, analysis, and benchmarking in Android malware detection studies. This CSV dataset were generated from existing publicly available Android malware dataset. We extracted and organized the relevant features into CSV format to facilitate analysis and reproducibility.
Cited by 0Open access
Md. Sadman Haque, Md Sakhawat Hossain, Robiul Awoul Robin et al. · Mendeley Data · 2026
The uploaded dataset (CIC-AndMal2017) contain curated information for Android malware analysis. The dataset is provided in CSV format and includes features selected for effective classification and detection of various malware families and benign applications. It is structured with clearly labeled columns for features and class labels, enabling straightforward use for research, analysis, and benchmarking in Android malware detection studies. This CSV dataset were generated from existing publicly available Android malware dataset. We extracted and organized the relevant features into CSV format to facilitate analysis and reproducibility.
Cited by 0Open access
Haque, Md Sadman, Hossain, Md Sakhawat, Robin, Robiul Awoul et al. · Mendeley Data · 2026
The uploaded dataset (CIC-AndMal2017) contain curated information for Android malware analysis. The dataset is provided in CSV format and includes features selected for effective classification and detection of various malware families and benign applications. It is structured with clearly labeled columns for features and class labels, enabling straightforward use for research, analysis, and benchmarking in Android malware detection studies. This CSV dataset were generated from existing publicly available Android malware dataset. We extracted and organized the relevant features into CSV format to facilitate analysis and reproducibility.
Cited by 0Open access
Král, Benjamin · Brno University of Technology Digital Library (Brno University of Technology) · 2018
Tato diplomová práce popisuje metody a postupy používané při forenzní analýze malware, včetně metod statické i dynamické analýzy malware. S využitím popisovaných metod je poté navrhnut nástroj určený k užívání bezpečnostními týmy CSIRT, jež vyšetřovateli bezpečnostního incidentu umožní rychle analyzovat a rozhodnout roli vzorku malware s nímž se setká při šetření bezpečnostního incidentu. Tento nástroj je v rámci práce podrobně popsán v odborném technickém návrhu založeném na specifických požadavcích bezpečnostních týmů CSIRT specifikovaných taktéž v obsahu práce. Na základě tohoto návrhu je implementován nástroj ForensIRT, jež je následně otestován analýzou vzorku malware Cridex. Konečně výsledky této analýzy jsou porovnány s výsledky ostatních srovnatelných nástrojů určených k forenzní analýze malware.
Cited by 0