Computer communications

Ransomware, a class of self-propagating malware that uses encryption to hold the victims’ data ransom, has emerged in recent years as one of the most dangerous cyber threats, with widespread damage; e.g., zero-day ransomware WannaCry has caused world-wide catastrophe, from knocking U.K. National Health Service hospitals offline to shutting down a Honda Motor Company in Japan [1]. Our close collaboration with security operations of large enterprises reveals that defense against ransomware relies on tedious analysis from high-volume systems logs of the first few infections. Sandbox analysis of freshly captured malware is also commonplace in operation. We introduce a method to identify and rank the most discriminating ransomware features from a set of ambient (non-attack) system logs and at least one log stream containing both ambient and ransomware behavior. These ranked features reveal a set of malware actions that are produced automatically from system logs, and can help automate tedious manual analysis. We test our approach using WannaCry and two polymorphic samples by producing logs with Cuckoo Sandbox during both ambient, and ambient plus ransomware executions. Our goal is to extract the features of the malware from the logs with only knowledge that malware was present. We compare outputs with a detailed analysis of WannaCry allowing validation of the algorithm’s feature extraction and provide analysis of the method’s robustness to variations of input data—changing quality/quantity of ambient data and testing polymorphic ransomware. Most notably, our patterns are accurate and unwavering when generated from polymorphic WannaCry copies, on which 63 (of 63 tested) antivirus (AV) products fail.

Automated Behavioral Analysis of Malware: A Case Study of WannaCry Ransomware

Through the Eyes of Students.

Ransomware, a class of self-propagating malware that uses encryption to hold the victims' data ransom, has emerged in recent years as one of the most dangerous cyber threats, with widespread damage; e.g., zero-day ransomware WannaCry has caused world-wide catastrophe, from knocking U.K. National Health Service hospitals offline to shutting down a Honda Motor Company in Japan[1]. Our close collaboration with security operations of large enterprises reveals that defense against ransomware relies on tedious analysis from high-volume systems logs of the first few infections. Sandbox analysis of freshly captured malware is also commonplace in operation. 
We introduce a method to identify and rank the most discriminating ransomware features from a set of ambient (non-attack) system logs and at least one log stream containing both ambient and ransomware behavior. These ranked features reveal a set of malware actions that are produced automatically from system logs, and can help automate tedious manual analysis. We test our approach using WannaCry and two polymorphic samples by producing logs with Cuckoo Sandbox during both ambient, and ambient plus ransomware executions. Our goal is to extract the features of the malware from the logs with only knowledge that malware was present. We compare outputs with a detailed analysis of WannaCry allowing validation of the algorithm's feature extraction and provide analysis of the method's robustness to variations of input data\textemdash changing quality/quantity of ambient data and testing polymorphic ransomware. Most notably, our patterns are accurate and unwavering when generated from polymorphic WannaCry copies, on which 63 (of 63 tested) anti-virus (AV) products fail.

Automated Behavioral Analysis of Malware A Case Study of WannaCry Ransomware

Today’s world is highly network interconnected owing to the pervasiveness of small personal devices (e.g., smartphones) as well as large computing devices or services (e.g., cloud computing or onli...

Machine learning in cybersecurity: a comprehensive survey:

With an enormous increase in number of mobile users, mobile threats are also growing rapidly. Mobile malwares can lead to several cybersecurity threats i.e. stealing sensitive information, installing backdoors, ransomware attacks and sending premium SMSs etc. Previous studies have shown that due to the sophistication of threats and tailored techniques to avoid detection, not every antivirus system is capable of detecting advance threats. However, an extra layer of security at the network side can protect users from these advanced threats by analyzing the traffic patterns. To detect these threats, this paper proposes and evaluates, a Machine Learning (ML) based model for Network based Intrusion Detection Systems (NIDS). In this research, several supervised ML classifiers were built using data-sets containing labeled instances of network traffic features generated by several malicious and benign applications. The focus of this research is on Android based malwares due to its global share in mobile malware and popularity among users. Based on the evaluation results, the model was able to detect known and unknown threats with the accuracy of up to 99.4%. This ML model can also be integrated with traditional intrusion detection systems in order to detect advanced threats and reduce false positives.

Machine learning classification model for Network based Intrusion Detection System

When a mobile node changes its point of attachment in the network, it experiences a time when it cannot receive or send any packets. This time, called handover delay, might also cause packet loss, resulting in undesired quality-of-service degradation for various types of applications. This issue remains a problem, although "Mobility Support in IPv6" has just reached IETF (Internet Engineering Task Force) RFC status. Earlier, we proposed a fast handover method called flow-based fast handover for Mobile IPv6 (FFHMIPv6) to speed up the L3 handover process. FFHMIPv6 employs flow-based information and IPv6-in-IPv6 tunneling for the fast redirection of flows during MIPv6 handover. The paper compares the performance of the FFHMIPv6 method to other fundamental handover methods with Network Simulator 2 (ns-2). Both UDP and TCP based applications are studied.

Performance evaluation of the flow-based fast handover method for Mobile IPv6 network

Mobile IPv6 provides comprehensive mobility management for the IPv6 protocol. It provides many benefits compared to Mobile IPv4, such as reroute optimization, protocol extensions and IP Security (IPSec). One problem still remains; the handover time is relatively long. This is a big problem at least in real-time connections. This paper presents a new method for faster handover in IPv6 networks, called Flow based Fast Handover for MIPv6 (FFHMIPv6), which uses the features of the IPv6 protocol and benefits from IPv6 traffic control.

Flow-based Fast Handover method for Mobile IPv6 network

Flow-based fast handover for mobile IPv6 environment - implementation and analysis

The pricing of future network services should comparable to the service quality. In this paper we present a packet scheduling scheme which ensures bandwidth as a quality of service (QoS) requirement and optimizes revenue of the network service provider. We derive a closed form formula for updating the adaptive weights of a packet scheduler from a revenue-based optimization problem. The weight updating procedure is fast and independent on any assumption of the connections' statistical behavior. The algorithm is simulated and compared to constant weights with and without a call admission control (CAC) mechanism. Also, a mechanism for guaranteeing a minimum mean bandwidth for different service classes is presented as supplement to the CAC procedure.

Ari Viinikainen

Papers

Machine learning classification model for Network based Intrusion Detection System

Performance evaluation of the flow-based fast handover method for Mobile IPv6 network

Flow-based Fast Handover method for Mobile IPv6 network

Flow-based fast handover for mobile IPv6 environment - implementation and analysis

Bandwidth allocation and pricing for telecommunications network