Academic literature on the topic 'Malware persistence'

Create a spot-on reference in APA, MLA, Chicago, Harvard, and other styles

Select a source type:

Consult the lists of relevant articles, books, theses, conference reports, and other scholarly sources on the topic 'Malware persistence.'

Next to every source in the list of references, there is an 'Add to bibliography' button. Press on it, and we will generate automatically the bibliographic reference to the chosen work in the citation style you need: APA, MLA, Harvard, Chicago, Vancouver, etc.

You can also download the full text of the academic publication as pdf and read online its abstract whenever available in the metadata.

Journal articles on the topic "Malware persistence"

1

Gittins, Zane, and Michael Soltys. "Malware Persistence Mechanisms." Procedia Computer Science 176 (2020): 88–97. http://dx.doi.org/10.1016/j.procs.2020.08.010.

Full text
APA, Harvard, Vancouver, ISO, and other styles
2

Shang, Yilun. "Optimal Control Strategies for Virus Spreading in Inhomogeneous Epidemic Dynamics." Canadian Mathematical Bulletin 56, no. 3 (2013): 621–29. http://dx.doi.org/10.4153/cmb-2012-007-2.

Full text
Abstract:
Abstract.In this paper, we study the spread of virus/worm in computer networks with a view to addressing cyber security problems. Epidemic models have been applied extensively to model the propagation of computer viruses, which characterize the fact that infected machines may spread malware to other hosts connected to the network. In our framework, the dynamics of hosts evolves according to a modified inhomogeneous Susceptible-Infectious-Susceptible (SIS) epidemic model with time-varying transmission rate and recovery rate. The infection of computers is subject to direct attack as well as propagation among hosts. Based on optimal control theory, optimal attack strategies are provided by minimizing the cost (equivalently maximizing the profit) of the attacker. We present a threshold function of the fraction of infectious hosts, which captures the dynamically evolving strategies of the attacker and reflects the persistence of virus spreading. Moreover, our results indicate that if the infectivity of a computer worm is low and the computers are installed with antivirus software with high reliability, the intensity of attacks incurred will likely be low. This agrees with our intuition.
APA, Harvard, Vancouver, ISO, and other styles
3

Xiao, Kaiming, Cheng Zhu, Junjie Xie, Yun Zhou, Xianqiang Zhu, and Weiming Zhang. "Dynamic Defense against Stealth Malware Propagation in Cyber-Physical Systems: A Game-Theoretical Framework." Entropy 22, no. 8 (2020): 894. http://dx.doi.org/10.3390/e22080894.

Full text
Abstract:
Stealth malware is a representative tool of advanced persistent threat (APT) attacks, which poses an increased threat to cyber-physical systems (CPS) today. Due to the use of stealthy and evasive techniques, stealth malwares usually render conventional heavy-weight countermeasures inapplicable. Light-weight countermeasures, on the other hand, can help retard the spread of stealth malwares, but the ensuing side effects might violate the primary safety requirement of CPS. Hence, defenders need to find a balance between the gain and loss of deploying light-weight countermeasures, which normally is a challenging task. To address this challenge, we model the persistent anti-malware process as a shortest-path tree interdiction (SPTI) Stackelberg game with both static version (SSPTI) and multi-stage dynamic version (DSPTI), and safety requirements of CPS are introduced as constraints in the defender’s decision model. The attacker aims to stealthily penetrate the CPS at the lowest cost (e.g., time, effort) by selecting optimal network links to spread, while the defender aims to retard the malware epidemic as much as possible. Both games are modeled as bi-level integer programs and proved to be NP-hard. We then develop a Benders decomposition algorithm to achieve the Stackelberg equilibrium of SSPTI, and design a Model Predictive Control strategy to solve DSPTI approximately by sequentially solving an 1+δ approximation of SSPTI. Extensive experiments have been conducted by comparing proposed algorithms and strategies with existing ones on both static and dynamic performance metrics. The evaluation results demonstrate the efficiency of proposed algorithms and strategies on both simulated and real-case-based CPS networks. Furthermore, the proposed dynamic defense framework shows its advantage of achieving a balance between fail-secure ability and fail-safe ability while retarding the stealth malware propagation in CPS.
APA, Harvard, Vancouver, ISO, and other styles
4

Bibi, Iram, Adnan Akhunzada, Jahanzaib Malik, Muhammad Khurram Khan, and Muhammad Dawood. "Secure Distributed Mobile Volunteer Computing with Android." ACM Transactions on Internet Technology 22, no. 1 (2022): 1–21. http://dx.doi.org/10.1145/3428151.

Full text
Abstract:
Volunteer Computing provision of seamless connectivity that enables convenient and rapid deployment of greener and cheaper computing infrastructure is extremely promising to complement next-generation distributed computing systems. Undoubtedly, without tactile Internet and secure VC ecosystems, harnessing its full potentials and making it an alternative viable and reliable computing infrastructure is next to impossible. Android-enabled smart devices, applications, and services are inevitable for Volunteer computing. Contrarily, the progressive developments of sophisticated Android malware may reduce its exponential growth. Besides, Android malwares are considered the most potential and persistent cyber threat to mobile VC systems. To secure Android-based mobile volunteer computing, the authors proposed MulDroid, an efficient and self-learning autonomous hybrid (Long-Short-Term Memory, Convolutional Neural Network, Deep Neural Network) multi-vector Android malware threat detection framework. The proposed mechanism is highly scalable with well-coordinated infrastructure and self-optimizing capabilities to proficiently tackle fast-growing dynamic variants of sophisticated malware threats and attacks with 99.01% detection accuracy. For a comprehensive evaluation, the authors employed current state-of-the-art malware datasets (Android Malware Dataset, Androzoo) with standard performance evaluation metrics. Moreover, MulDroid is compared with our constructed contemporary hybrid DL-driven architectures and benchmark algorithms. Our proposed mechanism outperforms in terms of detection accuracy with a trivial tradeoff speed efficiency. Additionally, a 10-fold cross-validation is performed to explicitly show unbiased results.
APA, Harvard, Vancouver, ISO, and other styles
5

Waliulu, Raditya Faisal, and Teguh Hidayat Iskandar Alam. "Reverse Engineering Analysis Statis Forensic Malware Webc2-Div." Insect (Informatics and Security): Jurnal Teknik Informatika 4, no. 1 (2019): 15. http://dx.doi.org/10.33506/insect.v4i1.223.

Full text
Abstract:
At this paper focus on Malicious Software also known as Malware APT1 (Advance Persistent Threat) codename WEBC2-DIV the most variants malware has criteria consists of Virus, Worm, Trojan, Adware, Spyware, Backdoor either Rootkit. Although, malware could avoidance scanning antivirus but reverse engineering could be know how dangerous malware infect computer client. Lately, malware attack as a form espionage (cyberwar) one of the most topic on security internet, because of has massive impact. Forensic malware becomes indicator successful user to realized about malware infect. This research about reverse engineering. A few steps there are scanning, suspected packet in network and analysis of malware behavior and disassembler body malware.
APA, Harvard, Vancouver, ISO, and other styles
6

Laurenza, Giuseppe, Riccardo Lazzeretti, and Luca Mazzotti. "Malware Triage for Early Identification of Advanced Persistent Threat Activities." Digital Threats: Research and Practice 1, no. 3 (2020): 1–17. http://dx.doi.org/10.1145/3386581.

Full text
APA, Harvard, Vancouver, ISO, and other styles
7

Hofer-Schmitz, Katharina, Ulrike Kleb, and Branka Stojanović. "The Influences of Feature Sets on the Detection of Advanced Persistent Threats." Electronics 10, no. 6 (2021): 704. http://dx.doi.org/10.3390/electronics10060704.

Full text
Abstract:
This paper investigates the influences of different statistical network traffic feature sets on detecting advanced persistent threats. The selection of suitable features for detecting targeted cyber attacks is crucial to achieving high performance and to address limited computational and storage costs. The evaluation was performed on a semi-synthetic dataset, which combined the CICIDS2017 dataset and the Contagio malware dataset. The CICIDS2017 dataset is a benchmark dataset in the intrusion detection field and the Contagio malware dataset contains real advanced persistent threat (APT) attack traces. Several different combinations of datasets were used to increase variety in background data and contribute to the quality of results. For the feature extraction, the CICflowmeter tool was used. For the selection of suitable features, a correlation analysis including an in-depth feature investigation by boxplots is provided. Based on that, several suitable features were allocated into different feature sets. The influences of these feature sets on the detection capabilities were investigated in detail with the local outlier factor method. The focus was especially on attacks detected with different feature sets and the influences of the background on the detection capabilities with respect to the local outlier factor method. Based on the results, we could determine a superior feature set, which detected most of the malicious flows.
APA, Harvard, Vancouver, ISO, and other styles
8

Márquez Díaz, Jairo Eduardo. "Armas cibernéticas. Malware inteligente para ataques dirigidos." Ingenierías USBMed 8, no. 2 (2017): 48–57. http://dx.doi.org/10.21500/20275846.2955.

Full text
Abstract:
En este artículo se muestra un análisis sobre el malware denominado Amenaza Persistente Avanzada o APT, el cual se ha clasificado por autoridades internacionales, como una de las primeras ciberarmas que puede comprometer seriamente las infraestructuras críticas de una nación. Esto se debe en gran parte, a los nuevos desarrollos de sistemas intrusivos más avanzados, que incorporan tecnologías y algoritmos dinámicos, que buscan integrar la inteligencia artificial y los algoritmos genéticos, entre otros, para hacer mucho más complejos y completos los programas a la hora de efectuar un escaneo de los protocolos de red y/o registros, robo de información, espionaje o ataques dirigidos, donde el sigilo y la furtividad son factores clave para ello, haciéndolos indetectables, y cuya permanencia puede ser indefinida al interior de un sistema informático o red. Dicho esto, las diversas técnicas de ataque de este tipo de malware, pone entre dicho las barreras y sistemas de protección actuales, tanto lógicas como físicas, y además, con la futura incorporación de algoritmos neuroevolutivos en sus código fuente, las herramientas, protocolos y políticas de seguridad de la información van a requerir ser revaluadas muy pronto.
APA, Harvard, Vancouver, ISO, and other styles
9

Li, Shudong, Qianqing Zhang, Xiaobo Wu, Weihong Han, and Zhihong Tian. "Attribution Classification Method of APT Malware in IoT Using Machine Learning Techniques." Security and Communication Networks 2021 (September 6, 2021): 1–12. http://dx.doi.org/10.1155/2021/9396141.

Full text
Abstract:
In recent years, the popularity of IoT (Internet of Things) applications and services has brought great convenience to people's lives, but ubiquitous IoT has also brought many security problems. Among them, advanced persistent threat (APT) is one of the most representative attacks, and its continuous outbreak has brought unprecedented security challenges for the large-scale deployment of the IoT. However, important research on analyzing the attribution of APT malware samples is still relatively few. Therefore, we propose a classification method for attribution organizations with APT malware in IoT using machine learning. It aims to mark the real attacking organization entities to better identify APT attack activity and protect the security of IoT. This method performs feature representation and feature selection based on APT behavior data obtained from devices in the Internet of Things and selects the features with a high degree of differentiation among organizations. Then, it trains a multiclass model named SMOTE-RF that can better deal with imbalance and multiclassification problems. Our experiments on real dynamic behavior data are combined to verify the effectiveness of the method proposed in this paper for attribution analysis of APT malware samples and achieve good performance. Our method could identify the organization behind complex APT attacks in IoT devices and services.
APA, Harvard, Vancouver, ISO, and other styles
10

LIU, Jing, Pei Dai XIE, Meng Zhu LIU, and Yong Jun WANG. "Having an Insight into Malware Phylogeny: Building Persistent Phylogeny Tree of Families." IEICE Transactions on Information and Systems E101.D, no. 4 (2018): 1199–202. http://dx.doi.org/10.1587/transinf.2017edl8172.

Full text
APA, Harvard, Vancouver, ISO, and other styles
More sources

Dissertations / Theses on the topic "Malware persistence"

1

Webb, Matthew S. "Evaluating tool based automated malware analysis through persistence mechanism detection." Thesis, Kansas State University, 2018. http://hdl.handle.net/2097/38783.

Full text
Abstract:
Master of Science<br>Department of Computer Science<br>Eugene Vasserman<br>Since 2014 there have been over 120 million new malicious programs registered every year. Due to the amount of new malware appearing every year, analysts have automated large sections of the malware reverse engineering process. Many automated analysis systems are created by re-implementing analysis techniques rather than automating existing tools that utilize the same techniques. New implementations take longer to create and do not have the same proven quality as a tool that evolved alongside malware for many years. The goal of this study is to assess the efficiency and effectiveness of using existing tools for the application of automated malware analysis. This study focuses on the problem of discovering how malware persists on an infected system. Six tools are chosen based on their usefulness in manual analysis for revealing different persistence techniques employed by malware. The functions of these tools are automated in a fashion that emulates how they can be manually utilized, resulting in information about a tested sample. These six tools are tested against a collection of actual malware samples, pulled from malware families that are known for employing various persistence techniques. The findings are then scanned for indicators of persistence. The results of these tests are used to determine the smallest tool subset that discovers the largest range of persistence mechanisms. For each tool, implementation difficulty is compared to the number of indicators discovered to reveal the effectiveness of similar tools for future analysis applications. The conclusion is that while the tools covered a wide range of persistence mechanisms, the standalone tools that were designed with scripting in mind were more effective than those with multiple system requirements or those with only a graphical interface. It was also discovered that the automation process limits functionality of some tools, as they are designed for analyst interaction. Regaining the tools’ functionality lost from automation to use them for other reverse engineering applications could be cumbersome and could require necessary implementation overhauls. Finally, the more successful tools were able to detect a broader range of techniques, while some less successful tools could only detect a portion of the same techniques. This study concludes that while an analysis system can be created by automating existing tools, the characteristics of the tools chosen impact the workload required to automate them. A well-documented tool that is controllable through a command line interface that offers many configuration options will require less work for an analyst to automate than a tool with little documentation that can only be controlled through a graphical interface.
APA, Harvard, Vancouver, ISO, and other styles
2

Loreti, Ludovico. "Pass The Hash attack. Panoramica, sperimentazione ed analisi." Bachelor's thesis, Alma Mater Studiorum - Università di Bologna, 2018. http://amslaurea.unibo.it/17297/.

Full text
Abstract:
La tesi è incentrata sul noto attacco informatico Pass The Hash e sul suo sviluppo all'interno di un sistema Microsoft Active Directory. Viene descritta una panoramica dell'attacco accennando la sua storia ed evoluzione fino ad oggi, alcuni dei tanti attacchi informatici ad esso propedeutici ed un background tecnico in cui vengono spiegate le sue componenti principali: il tool che viene utilizzato oggigiorno per sperimentare questa tecnica (Mimikatz), le funzioni di hash, i sistemi Single Sign-On, la suddivisione in domini, alberi e foreste di Active Directory. In seguito viene mostrato l'ambiente di test in cui l'attacco è stato sperimentato, specificando i software ed i computer utilizzati. L'ultima parte della tesi è incentrata sulla realizzazione dell'attacco informatico in modo sperimentale in quanto l'attacco teoricamente si ferma alla versione di Windows 8 e Windows Server 2012. Qui è realizzato su sistemi aventi Windows 10 e Windows Server 2016 aggiornati al momento in cui si scrive. Nel capitolo conclusivo vengono ripresi i punti salienti dell'attacco realizzato poc'anzi e vengono descritte alcune tecniche pensate ad hoc per la mitigazione del Pass The Hash.
APA, Harvard, Vancouver, ISO, and other styles
3

Ghafir, Ibrahim, M. Hammoudeh, V. Prenosil, et al. "Detection of advanced persistent threat using machine-learning correlation analysis." 2018. http://hdl.handle.net/10454/17614.

Full text
Abstract:
Yes<br>As one of the most serious types of cyber attack, Advanced Persistent Threats (APT) have caused major concerns on a global scale. APT refers to a persistent, multi-stage attack with the intention to compromise the system and gain information from the targeted system, which has the potential to cause significant damage and substantial financial loss. The accurate detection and prediction of APT is an ongoing challenge. This work proposes a novel machine learning-based system entitled MLAPT, which can accurately and rapidly detect and predict APT attacks in a systematic way. The MLAPT runs through three main phases: (1) Threat detection, in which eight methods have been developed to detect different techniques used during the various APT steps. The implementation and validation of these methods with real traffic is a significant contribution to the current body of research; (2) Alert correlation, in which a correlation framework is designed to link the outputs of the detection methods, aims to identify alerts that could be related and belong to a single APT scenario; and (3) Attack prediction, in which a machine learning-based prediction module is proposed based on the correlation framework output, to be used by the network security team to determine the probability of the early alerts to develop a complete APT attack. MLAPT is experimentally evaluated and the presented system is able to predict APT in its early steps with a prediction accuracy of 84.8%.
APA, Harvard, Vancouver, ISO, and other styles

Book chapters on the topic "Malware persistence"

1

O’Leary, Mike. "Malware and Persistence." In Cyber Operations. Apress, 2019. http://dx.doi.org/10.1007/978-1-4842-4294-0_11.

Full text
APA, Harvard, Vancouver, ISO, and other styles
2

O’Leary, Mike. "Malware and Persistence." In Cyber Operations. Apress, 2015. http://dx.doi.org/10.1007/978-1-4842-0457-3_10.

Full text
APA, Harvard, Vancouver, ISO, and other styles
3

Mohanta, Abhijit, and Anoop Saldanha. "Persistence Mechanisms." In Malware Analysis and Detection Engineering. Apress, 2020. http://dx.doi.org/10.1007/978-1-4842-6193-4_8.

Full text
APA, Harvard, Vancouver, ISO, and other styles
4

Brierley, Calvin, Jamie Pont, Budi Arief, David J. Barnes, and Julio Hernandez-Castro. "Persistence in Linux-Based IoT Malware." In Secure IT Systems. Springer International Publishing, 2021. http://dx.doi.org/10.1007/978-3-030-70852-8_1.

Full text
APA, Harvard, Vancouver, ISO, and other styles
5

Leguesse, Yonas, Mark Vella, Christian Colombo, and Julio Hernandez-Castro. "Reducing the Forensic Footprint with Android Accessibility Attacks." In Security and Trust Management. Springer International Publishing, 2020. http://dx.doi.org/10.1007/978-3-030-59817-4_2.

Full text
Abstract:
Abstract Android accessibility features include a robust set of tools allowing developers to create apps for assisting people with disabilities. Unfortunately, this useful set of tools can also be abused and turned into an attack vector, providing malware with the ability to interact and read content from third-party apps. In this work, we are the first to study the impact that the stealthy exploitation of Android accessibility services can have on significantly reducing the forensic footprint of malware attacks, thus hindering both live and post-incident forensic investigations. We show that through Living off the Land (LotL) tactics, or by offering a malware-only substitute for attacks typically requiring more elaborate schemes, accessibility-based malware can be rendered virtually undetectable. In the LotL approach, we demonstrate accessibility-enabled SMS and command and control (C2) capabilities. As for the latter, we show a complete cryptocurrency wallet theft, whereby the accessibility trojan can hijack the entire withdrawal process of a widely used app, including two-factor authentication (2FA). In both cases, we demonstrate how the attacks result in significantly diminished forensic evidence when compared to similar attacks not employing accessibility tools, even to the extent of maintaining device take-over without requiring malware persistence.
APA, Harvard, Vancouver, ISO, and other styles
6

Steffens, Timo. "Analysis of Malware." In Attribution of Advanced Persistent Threats. Springer Berlin Heidelberg, 2020. http://dx.doi.org/10.1007/978-3-662-61313-9_3.

Full text
APA, Harvard, Vancouver, ISO, and other styles
7

Sai Charan, P. V., P. Mohan Anand, and Sandeep K. Shukla. "DMAPT: Study of Data Mining and Machine Learning Techniques in Advanced Persistent Threat Attribution and Detection." In Artificial Intelligence. IntechOpen, 2021. http://dx.doi.org/10.5772/intechopen.99291.

Full text
Abstract:
Modern-day malware is intelligent enough to hide its presence and perform stealthy operations in the background. Advance Persistent Threat (APT) is one such kind of malware attack on sensitive corporate and banking networks to stay there for a long time undetected. In real-time corporate networks, identifying the presence of intruders is a big challenging task for security experts. Recent APT attacks like Carbanak, The Big Bang, and Red Echo attack (targeting the Indian power sector) are ringing alarms globally. New data exfiltration methods and advancements in malware techniques are the two main reasons for rapid and robust APT evolution. Although many traditional and hybrid methods are available to detect this stealthy malware, the number of target-specific attacks are increasing rapidly at global level. Attackers have been crafting payloads resistant to malware sandbox environments so that traditional sandboxing techniques may not work with these APT malware detection. In this paper, we shed light on various Data Mining, Machine Learning techniques and frameworks used in both Attribution and Detection of APT malware. Added to this, our work highlight GAP analysis and need for paradigm shift in existing techniques to deal with evolving modern APT malware.
APA, Harvard, Vancouver, ISO, and other styles
8

Nishani, Lediona. "Review on Security Threats for Mobile Devices and Significant Countermeasures on Securing Android Mobiles." In Advances in Business Information Systems and Analytics. IGI Global, 2016. http://dx.doi.org/10.4018/978-1-4666-8841-4.ch001.

Full text
Abstract:
Security nowadays is not a “nice to have,” but a must-have. Cybercriminals have started a new way of encouraging their activities by selling their services on the deep dark web. They are becoming day by day more persistent and smarter than ever. Therefore, the companies have to be smarter in order to face the diversity of new threats every day. The increase of botnets is responsible for an emerging ransomware attacks through cryptolocker. Another modern malware are APT (Advanced persistent threats, sophisticated threats that undertake missions in cyber space). This chapter is about a summary of the most prominent attacks on security threats regarding android mobile devices. In this review chapter we will disclose and analyze chronicles of attack, which cover researching period from 2004 when was discovered the first mobile malware, until 2014. Our research will narrow down just in the two last years because of tremendous surge of android malware that has emerged just in this short period. We have chosen this small research sample in order to provide insights and give significant evidence that in a short period we have to investigate and analyze so many miscellaneous malware and vulnerabilities techniques. In subsequent proceedings, this chapter points out the main threats category we have thought to be more notable or significant to be investigated in this review chapter. Later on, it discusses future trends and some strong recommendation on facing and dealing with the internet technology based area.
APA, Harvard, Vancouver, ISO, and other styles

Conference papers on the topic "Malware persistence"

1

Botacin, Marcus, André Grégio та Paulo De Geus. "Malware Variants Identification in Practice". У Simpósio Brasileiro de Segurança da Informação e de Sistemas Computacionais. Sociedade Brasileira de Computação, 2019. http://dx.doi.org/10.5753/sbseg.2019.13960.

Full text
Abstract:
Malware are persistent threats to computer systems and analysis procedures allow developing countermeasures to them. However, as samples are spreading on growing rates, malware clustering techniques are required to keep analysis procedures scalable. Current clustering approaches use Call Graphs (CGs) to identify polymorphic samples, but they consider only individual functions calls, thus failing to cluster malware variants created by replacing sample&amp;apos;s original functions by semantically-equivalent ones. To solve this problem, we propose a behavior-based classification procedure able to group functions on classes, thus reducing analysis procedures costs. We show that classifying samples according their behaviors (via function call semantics) instead by their pure API invocation is a more effective way to cluster malware variants. We also show that using a continence metric instead of a similarity metric helps to identify malware variants when a sample is embedded in another.
APA, Harvard, Vancouver, ISO, and other styles
2

Li, Frankie, Anthony Lai, and Ddl Ddl. "Evidence of Advanced Persistent Threat: A case study of malware for political espionage." In 2011 6th International Conference on Malicious and Unwanted Software (MALWARE). IEEE, 2011. http://dx.doi.org/10.1109/malware.2011.6112333.

Full text
APA, Harvard, Vancouver, ISO, and other styles
3

Vogl, Sebastian, Jonas Pfoh, Thomas Kittel, and Claudia Eckert. "Persistent Data-only Malware: Function Hooks without Code." In Network and Distributed System Security Symposium. Internet Society, 2014. http://dx.doi.org/10.14722/ndss.2014.23019.

Full text
APA, Harvard, Vancouver, ISO, and other styles
4

Kohout, Jan, and Tomas Pevny. "Unsupervised detection of malware in persistent web traffic." In ICASSP 2015 - 2015 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2015. http://dx.doi.org/10.1109/icassp.2015.7178272.

Full text
APA, Harvard, Vancouver, ISO, and other styles
We offer discounts on all premium plans for authors whose works are included in thematic literature selections. Contact us to get a unique promo code!