scholarly journals A Novel Immune-Inspired Shellcode Detection Algorithm Based on Hyperellipsoid Detectors

2018 ◽  
Vol 2018 ◽  
pp. 1-10 ◽  
Author(s):  
Tianliang Lu ◽  
Lu Zhang ◽  
Yixian Fu
Keyword(s):  
Dynamic Analysis ◽  
Static Analysis ◽  
Clonal Selection ◽  
Detection System ◽  
Detection Algorithm ◽  
Machine Language ◽  
Detection Accuracy ◽  
Clonal Selection Algorithm ◽  
Selection Algorithm ◽  
Negative Selection Algorithm

Shellcodes are machine language codes injected into target programs in the form of network packets or malformed files. Shellcodes can trigger buffer overflow vulnerability and execute malicious instructions. Signature matching technology used by antivirus software or intrusion detection system has low detection rate for unknown or polymorphic shellcodes; to solve such problem, an immune-inspired shellcode detection algorithm was proposed, named ISDA. Static analysis and dynamic analysis were both applied. The shellcodes were disassembled to assembly instructions during static analysis and, for dynamic analysis, the API function sequences of shellcodes were obtained by simulation execution to get the behavioral features of polymorphic shellcodes. The extracted features of shellcodes were encoded to antigens based on n-gram model. Immature detectors become mature after immune tolerance based on negative selection algorithm. To improve nonself space coverage rate, the immune detectors were encoded to hyperellipsoids. To generate better antibody offspring, the detectors were optimized through clonal selection algorithm with genetic mutation. Finally, shellcode samples were collected and tested, and result shows that the proposed method has higher detection accuracy for both nonencoded and polymorphic shellcodes.

scholarly journals Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems

2021 ◽  
Vol 11 (22) ◽  
pp. 10976
Author(s):  
Rana Almohaini ◽  
Iman Almomani ◽  
Aala AlKhayer
Keyword(s):  
Dynamic Analysis ◽  
Static Analysis ◽  
Hybrid System ◽  
State Of The Art ◽  
Detection System ◽  
Detection Accuracy ◽  
Accuracy Rate ◽  
Hybrid Detection ◽  
Dynamic Analyses ◽  
Data Files

Android ransomware is one of the most threatening attacks that is increasing at an alarming rate. Ransomware attacks usually target Android users by either locking their devices or encrypting their data files and then requesting them to pay money to unlock the devices or recover the files back. Existing solutions for detecting ransomware mainly use static analysis. However, limited approaches apply dynamic analysis specifically for ransomware detection. Furthermore, the performance of these approaches is either poor or often fails in the presence of code obfuscation techniques or benign applications that use cryptography methods for their APIs usage. Additionally, most of them are unable to detect ransomware attacks at early stages. Therefore, this paper proposes a hybrid detection system that effectively utilizes both static and dynamic analyses to detect ransomware with high accuracy. For the static analysis, the proposed hybrid system considered more than 70 state-of-the-art antivirus engines. For the dynamic analysis, this research explored the existing dynamic tools and conducted an in-depth comparative study to find the proper tool to integrate it in detecting ransomware whenever needed. To evaluate the performance of the proposed hybrid system, we analyzed statically and dynamically over one hundred ransomware samples. These samples originated from 10 different ransomware families. The experiments’ results revealed that static analysis achieved almost half of the detection accuracy—ranging around 40–55%, compared to the dynamic analysis, which reached a 100% accuracy rate. Moreover, this research reports some of the high API classes, methods, and permissions used in these ransomware apps. Finally, some case studies are highlighted, including failed running apps and crypto-ransomware patterns.

scholarly journals A Clone Selection Based Real-Valued Negative Selection Algorithm

Complexity ◽  
2018 ◽  
Vol 2018 ◽  
pp. 1-20
Author(s):  
Ruirui Zhang ◽  
Xin Xiao
Keyword(s):  
Negative Selection ◽  
Immune Cell ◽  
Clonal Selection ◽  
Space Distribution ◽  
Small Radius ◽  
Clonal Selection Algorithm ◽  
Selection Algorithm ◽  
Immune Cell Population ◽  
Negative Selection Algorithm ◽  
Selection Algorithms

Excessive detectors, high time complexity, and loopholes are main problems which current negative selection algorithms have face and greatly limit the practical applications of negative selection algorithms. This paper proposes a real-valued negative selection algorithm based on clonal selection. Firstly, the algorithm analyzes the space distribution of the self set and gets the set of outlier selves and several classification clusters. Then, the algorithm considers centers of clusters as antigens, randomly generates initial immune cell population in the qualified range, and executes the clonal selection algorithm. Afterwards, the algorithm changes the limited range to continue the iteration until the non-self space coverage rate meets expectations. After the algorithm terminates, mature detector set and boundary self set are obtained. The main contributions lie in (1) introducing the clonal selection algorithm and randomly generating candidate detectors within the stratified limited ranges based on clustering centers of self set; generating big-radius candidate detectors first and making them cover space far from selves, which reduces the number of detectors; then generating small-radius candidate detectors and making them gradually cover boundary space between selves and non-selves, which reduces the number of holes; (2) distinguishing selves and dividing them into outlier selves, boundary selves, and internal selves, which can adapt to the interference of noise data from selves; (3) for anomaly detection, using mature detector set and boundary self set to test at the same time, which can effectively improve the detection rate and reduce the false alarm rate. Theoretical analysis and experimental results show that the algorithm has better time efficiency and detector generation quality according to classic negative selection algorithms.

scholarly journals Anomaly Detection in Wireless Sensor Networks Using Immune-Based Bioinspired Mechanism

2015 ◽  
Vol 2015 ◽  
pp. 1-10 ◽  
Author(s):  
Ramsha Rizwan ◽  
Farrukh Aslam Khan ◽  
Haider Abbas ◽  
Sajjad Hussain Chauhdary
Keyword(s):  
Clonal Selection ◽  
Wireless Sensor ◽  
Clonal Selection Algorithm ◽  
Selection Algorithm ◽  
Biologically Inspired ◽  
Data Packets ◽  
Negative Selection Algorithm ◽  
Bee Colony ◽  
Anomalous Data ◽  
Network Intrusion

During the past few years, we have seen a tremendous increase in various kinds of anomalies in Wireless Sensor Network (WSN) communication. Recently, researchers have shown a lot of interest in applying biologically inspired systems for solving network intrusion detection problems. Several solutions have been proposed using Artificial Immune System (AIS), Ant Colony Optimization (ACO), Artificial Bee Colony (ABC) algorithm, Genetic Algorithm (GA), Particle Swarm Optimization (PSO) and so forth. In this paper, we propose a bioinspired solution using Negative Selection Algorithm (NSA) of the AIS for anomalies detection in WSNs. For this purpose, we implement the enhanced NSA and make a detector set that holds anomalous packets only. Then the random packets are tested and matched with the detector set and anomalies are identified. Anomalous data packets are used for further processing to identify specific anomalies. In this way, the number of wormholes, packets delayed, and packets dropped are calculated and identified. Simulations are performed on a large dataset and the results show high accuracy of the proposed algorithm in detecting anomalies. The proposed NSA is also compared with Clonal Selection Algorithm (CSA) for the same dataset. The results show significant improvement of the proposed NSA over CSA in most of the cases.

scholarly journals Gait Phase Detection Based on Muscle Deformation with Static Standing-Based Calibration

Sensors ◽  
2021 ◽  
Vol 21 (4) ◽  
pp. 1081
Author(s):  
Tamon Miyake ◽  
Shintaro Yamamoto ◽  
Satoshi Hosono ◽  
Satoshi Funabashi ◽  
Zhengxue Cheng ◽  
...  
Keyword(s):  
Learning Algorithm ◽  
Detection System ◽  
Calibration Method ◽  
Detection Algorithm ◽  
Video Data ◽  
Detection Accuracy ◽  
Phase Detection ◽  
Gait Phase ◽  
Logistic Regression Algorithm ◽  
Short Time

Gait phase detection, which detects foot-contact and foot-off states during walking, is important for various applications, such as synchronous robotic assistance and health monitoring. Gait phase detection systems have been proposed with various wearable devices, sensing inertial, electromyography, or force myography information. In this paper, we present a novel gait phase detection system with static standing-based calibration using muscle deformation information. The gait phase detection algorithm can be calibrated within a short time using muscle deformation data by standing in several postures; it is not necessary to collect data while walking for calibration. A logistic regression algorithm is used as the machine learning algorithm, and the probability output is adjusted based on the angular velocity of the sensor. An experiment is performed with 10 subjects, and the detection accuracy of foot-contact and foot-off states is evaluated using video data for each subject. The median accuracy is approximately 90% during walking based on calibration for 60 s, which shows the feasibility of the static standing-based calibration method using muscle deformation information for foot-contact and foot-off state detection.

Sign in / Sign up

Export Citation Format

Share Document