Cloud computing is one of today's most popular and important IT trends. Currently, most organizations use cloud computing services (public or private) as part of their computer infrastructure. Virtualization technology is at the core of cloud computing, and virtual resources, such as virtual servers, are commonly used to provide services to the entire organization. Due to their importance and prevalence, virtual servers in an organizational cloud are constantly targeted by cyber-attackers who try to inject malicious code or malware into the server (e.g., ransomware). Many times, server administrators are not aware that the server has been compromised, despite the presence of detection solutions on the server (e.g., antivirus engine). In other cases, the breach is detected after a long period of time when significant damage has already occurred. Thus, detecting that a virtual server has been compromised is extremely important for organizational security. Existing security solutions that are installed on the server (e.g., antivirus) are considered untrusted, since malware (particularly sophisticated ones) can evade them. Moreover, these tools are largely incapable of detecting new unknown malware. Machine learning (ML) methods have been shown to be effective at detecting malware in various domains. In this paper, we present a novel methodology for trusted detection of ransomware in virtual servers on an organization's private cloud. We conducted trusted analysis of volatile memory dumps taken from a virtual machine (memory forensics), using the Volatility framework, and created general descriptive meta-features. We leveraged these meta-features, using machine learning algorithms, for the detection of unknown ransomware in virtual servers. We evaluated our methodology extensively in five comprehensive experiments of increasing difficulty, on two different popular servers (IIS server and an email server). We used a collection of real-world, professional, and notorious ransomware and a collection of legitimate programs. The results show that our methodology is able to detect anomalous states of a virtual machine, as well as the presence of both known and unknown ransomware, obtaining the following results: TPR  = 1, FPR  = 0.052, F-measure  = 0.976, and AUC  = 0.966, using the Random Forest classifier. Finally, we showed that our proposed methodology is also capable of detecting an additional type of malware known as a remote access Trojan (RAT), which is used to attack organizational VMs.

Trusted detection of ransomware in a private cloud using machine learning methods leveraging meta-features from volatile memory

With the evolution of cybersecurity countermeasures, the threat landscape has also evolved, especially in malware from traditional file-based malware to sophisticated and multifarious fileless malware. Fileless malware does not use traditional executables to carry-out its activities. So, it does not use the file system, thereby evading signature-based detection system. The fileless malware attack is catastrophic for any enterprise because of its persistence, and power to evade any anti-virus solutions. The malware leverages the power of operating systems, trusted tools to accomplish its malicious intent. To analyze such malware, security professionals use forensic tools to trace the attacker, whereas the attacker might use anti-forensics tools to erase their traces. This survey makes a comprehensive analysis of fileless malware and their detection techniques that are available in the literature. We present a process model to handle fileless malware attacks in the incident response process. In the end, the specific research gaps present in the proposed process model are identified, and associated challenges are highlighted.

/pdf/an-emerging-threat-fileless-malware-a-survey-and-research-1f29bpv876.pdf

An emerging threat Fileless malware: a survey and research challenges

Wireless sensor networks (WSNs) and the Internet of Things (IoT) are increasingly making an impact in a wide range of domain-specific applications. In IoT-integrated WSNs, nodes generally function with limited battery units and, hence, energy efficiency is considered as the main design challenge. For homogeneous WSNs, several routing techniques based on clusters are available, but only a few of them are focused on energy-efficient heterogeneous WSNs (HWSNs). However, security provisioning in end-to-end communication is the main design challenge in HWSNs. This research work presents an energy optimizing secure routing scheme for IoT application in heterogeneous WSNs. In our proposed scheme, secure routing is established for confidential data of the IoT through sensor nodes with heterogeneous energy using the multipath link routing protocol (MLRP). After establishing the secure routing, the energy and network lifetime is improved using the hybrid-based TEEN (H-TEEN) protocol, which also has load balancing capacity. Furthermore, the data storage capacity is improved using the ubiquitous data storage protocol (U-DSP). This routing protocol has been implemented and compared with two other existing routing protocols, and it shows an improvement in performance parameters such as throughput, energy efficiency, end-to-end delay, network lifetime and data storage capacity.

/pdf/secure-routing-based-energy-optimization-for-iot-application-2tqkf04x.pdf

Secure Routing-Based Energy Optimization for IoT Application with Heterogeneous Wireless Sensor Networks

Due to frequent use of Internet and with technological advancements, cyber and malware attacks over the digital devices have increased manifold. Activities performed electronically can be investigated by means of digital forensic analysis methodologies. Live digital forensic tools are used for digital evidence collection and investigations of malicious activities that occurred on a standalone system or networks. Since compromised system remains active while using these tools, some serious issues relating to malicious functionalities and policy violations could lead to serious damages like data theft or data loss. In this paper, we present a critical review of the triage in live forensic. This paper discusses several techniques being used for performing live forensic analysis and critically evaluate their efficacy in terms of their applicability and reliability. A brief anecdote about the pros and cons of these techniques are also discussed. We present the findings of our study in the critical section.

http://www.ijofcs.org/V08N1-PP05-TRIAGE-IN-LIVE-DIGITAL.pdf

Triage in Live Digital Forensic Analysis

Most organizations today employ cloud-computing environments and virtualization technology; Due to their prevalence and importance in providing services to the entire organization, virtual-servers are constantly targeted by cyber-attacks, and specifically by malware. Existing solutions, consisting of the widely-used antivirus (AV) software, fail to detect newly created and unknown-malware; moreover, by the time the AV is updated, the organization has already been attacked. In this paper, we present a during run-time analysis methodology for a trusted detection of unknown malware on virtual machines (VMs). We conducted trusted analysis of volatile memory dumps taken from a VM and focused on analyzing their system-calls using a sequential-mining-method. We leveraged the most informative system-calls by machine-learning algorithms for the efficient detection of malware in widely used VMs within organizations (i.e. IIS and Email server). We evaluated our methodology in a comprehensive set of experiments over a collections of real-world, advanced, and notorious malware (both ransomware and RAT), and legitimate programs. The results show that our suggested methodology is able to detect the presence of unknown malware, in an average of 97.9% TPR and 0% FPR. Such results and capabilities can form the ground for the development of practical detection-tools for both corporates and companies.

Trusted system-calls analysis methodology aimed at detection of compromised virtual machines using sequential mining

Since communications in the Underwater Wireless Sensor Networks (UWSNs) have limited resources and capabilities, designing an efficient and reliable Media Access Control (MAC) protocol for UWSNs faces many challenges. UWSNs have limited bandwidth, power, memory, long propagation delay, high Bit Error Rate (BER), and unreliable communication. Current MAC protocols that have been designed for Terrestrial Wireless Sensor Networks (TWSNs) are not suitable for UWSNs. While the software-based mechanisms promise many benefits to TWSN, few proposal designs introduced MAC protocols based on software-based mechanisms for UWSNs. The software-based approach is a flexible one that helps to change system parameters of all layers with no need for additional hardware. In this article, we focus on presenting a survey of the state of the art of the recent development of MAC protocols for UWSNs from recent literature followed by a discussion of the characteristics and limitations of each MAC protocol. This article also evaluates the channel transmission and compares the performance of four different MAC protocol approaches to identify the most suitable one for the underwater oil/gas pipelines application in terms of end-to-end delay, energy consumption, Packet Delivery Ratio (PDR), the total number of collisions, and throughput using different network loads.

A Survey on MAC Protocol Approaches for Underwater Wireless Sensor Networks

Traditionally, incident responders and digital forensic examiners have predominantly relied on live response for volatile data acquisition While this approach is popular, memory capacity has rapidly changed, making memory a valuable resource for digital investigation, by revealing not only running tasks, but also terminated and cached processes This research presents the impact and the limitations of the conventional volatile forensic method, live response, in comparison to the alternative method, memory image analysis The experiment's results demonstrate and we discuss the forensic effects of executing a live response toolkit, which alters the volatile data environment significantly in some cases and can overwrite potential evidence Memory image analysis is also leveraged as an alternative approach that helps mitigate the risk of losing volatile evidence such as terminated and cashed processes, which are ignored during live response This comparative analysis calls attention the capabilities of both methods in retrieving and recovering volatile data

Comparative Analysis of Volatile Memory Forensics: Live Response vs. Memory Imaging

According to the standard paradigm, white box cryptographic primitives are used to block black box attacks and protect sensitive information. This is performed to safeguard the protected information and keys against black box assaults. An adversary in such a setting is aware of the method and can analyze many system inputs and outputs, but is blind to the specifics of how a critical instantiation primitive is implemented. This is the focus of white-box solutions, which are designed to withstand attacks that come from the execution environment. This is significant because an attacker may obtain unrestricted access to the program’s execution in this environment. The purpose of this article is to assess the efficiency of white-box implementations in terms of security. Our contribution is twofold: first, we explore the practical implementations of white-box approaches, and second, we analyze the theoretical foundations upon which these implementations are built. First, a research proposal is crafted that details white-box applications of DES and AES encryption algorithms. To begin, this preparation is necessary. The research effort planned for this project also includes cryptanalysis of these techniques. Once the general cryptanalysis results have been examined, the white-box design approaches will be covered. We have decided to launch an investigation into creating a theoretical model for white box, since no prior formal definitions have been offered, and suggested implementations have not been accompanied by any assurance of security. This is due to the fact that no formal definition of “white box” has ever been provided. In this way lies the explanation for why this is the situation. We define WBC to encompass the security requirements of WBC specified over a white box cryptography technology and a security concept by studying formal models of obfuscation and shown security. This definition is the product of extensive investigation. This state-of-the-art theoretical model provides a setting in which to investigate the security of white-box implementations, leading to a wide range of positive and negative conclusions. As a result, this paper includes the results of a Digital Signature Algorithm (DSA) study which may be put to use in the real world with signature verification. Possible future applications of White Box Cryptography (WBC) research findings are discussed in light of these purposes and areas of investigation.

https://www.mdpi.com/1424-8220/22/23/9444/pdf?version=1670296097

AES Based White Box Cryptography in Digital Signature Verification

In terms of growth, effect, and capability, the 5G-enabled Internet of Things (IoT) is incredible. The volume of data distributed and processed by IoT (Internet of Things) systems that trust connectivity and coverage raises some security problems. As IoT technology is directly used in our daily lives, the threats of present cyberspace may grow more prominent globally. Extended network life, coverage, and connectivity are all required for securing IoT-based 5G network devices. As a result of these failures, there are flaws that lead to security breaches. Because purposeful faults can quickly render the entire network dysfunctional, they are more difficult to identify than unexpected failures. Securing IoT-based 5G Network Device Connectivity and Coverage for expending Encryption and Authentication Scheme (EAS) framework is proposed in this study, which uses novel security flaws. In this research, we proposed a Boltzmann machine (BMKG)-based encryption algorithm for securing 5G-enabled IoT device network environment and compared various asymmetric algorithms for key exchange.

/pdf/securing-5g-iot-device-connectivity-and-coverage-using-49ankdemkj.pdf

Securing 5G-IoT Device Connectivity and Coverage Using Boltzmann Machine Keys Generation

Twitter is one of the most popular online social networks for spreading propaganda and words in the Arab region. Spammers are now creating rogue accounts to distribute adult content through Arabic tweets that Arabic norms and cultures prohibit. Arab governments are facing a huge challenge in the detection of these accounts. Researchers have extensively studied English spam on online social networks, while to date, social network spam in other languages has been completely ignored. In our previous study, we estimated that rogue and spam content accounted for approximately three quarters of all content with Arabic trending hashtags in Saudi Arabia. This alarming rate, supported by autonomous concurrent estimates, highlights the urgent need to develop adaptive spam detection methods. In this work, we collected a pure data set from spam accounts producing Arabic tweets. We applied lightweight feature engineering based on rogue content and user profiles. The 47 generated features were analyzed, and the best features were selected. Our performance results show that the random forest classification algorithm with 16 features performs best, with accuracy rates greater than 90%.

Amer Aljaedi

Papers

A Survey on MAC Protocol Approaches for Underwater Wireless Sensor Networks

Comparative Analysis of Volatile Memory Forensics: Live Response vs. Memory Imaging

AES Based White Box Cryptography in Digital Signature Verification

Securing 5G-IoT Device Connectivity and Coverage Using Boltzmann Machine Keys Generation

Predicting Rogue Content and Arabic Spammers on Twitter