Proceedings of the 2016 ACM on International Workshop on Security And Privacy Analytics最新文献

Towards Automatic Identification of JavaScript-oriented Machine-Based Tracking 面向javascript的机器跟踪自动识别研究

Proceedings of the 2016 ACM on International Workshop on Security And Privacy Analytics Pub Date : 2016-03-11 DOI: 10.1145/2875475.2875479

Andrew J. Kaizer, Minaxi Gupta

引用次数: 16

Detecting Advanced Persistent Threats using Fractal Dimension based Machine Learning Classification 基于分形维数的机器学习分类检测高级持续威胁

Proceedings of the 2016 ACM on International Workshop on Security And Privacy Analytics Pub Date : 2016-03-11 DOI: 10.1145/2875475.2875484

S. Siddiqui, Muhammad Salman Khan, K. Ferens, W. Kinsner

{"title":"Detecting Advanced Persistent Threats using Fractal Dimension based Machine Learning Classification","authors":"S. Siddiqui, Muhammad Salman Khan, K. Ferens, W. Kinsner","doi":"10.1145/2875475.2875484","DOIUrl":"https://doi.org/10.1145/2875475.2875484","url":null,"abstract":"Advanced Persistent Threats (APTs) are a new breed of internet based smart threats, which can go undetected with the existing state of-the-art internet traffic monitoring and protection systems. With the evolution of internet and cloud computing, a new generation of smart APT attacks has also evolved and signature based threat detection systems are proving to be futile and insufficient. One of the essential strategies in detecting APTs is to continuously monitor and analyze various features of a TCP/IP connection, such as the number of transferred packets, the total count of the bytes exchanged, the duration of the TCP/IP connections, and details of the number of packet flows. The current threat detection approaches make extensive use of machine learning algorithms that utilize statistical and behavioral knowledge of the traffic. However, the performance of these algorithms is far from satisfactory in terms of reducing false negatives and false positives simultaneously. Mostly, current algorithms focus on reducing false positives, only. This paper presents a fractal based anomaly classification mechanism, with the goal of reducing both false positives and false negatives, simultaneously. A comparison of the proposed fractal based method with a traditional Euclidean based machine learning algorithm (k-NN) shows that the proposed method significantly outperforms the traditional approach by reducing false positive and false negative rates, simultaneously, while improving the overall classification rates.","PeriodicalId":393015,"journal":{"name":"Proceedings of the 2016 ACM on International Workshop on Security And Privacy Analytics","volume":"81 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-03-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115326865","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 64

Acquiring and Analyzing App Metrics for Effective Mobile Malware Detection 获取和分析有效移动恶意软件检测的应用参数

Proceedings of the 2016 ACM on International Workshop on Security And Privacy Analytics Pub Date : 2016-03-11 DOI: 10.1145/2875475.2875481

G. Canfora, Eric Medvet, F. Mercaldo, C. A. Visaggio

{"title":"Acquiring and Analyzing App Metrics for Effective Mobile Malware Detection","authors":"G. Canfora, Eric Medvet, F. Mercaldo, C. A. Visaggio","doi":"10.1145/2875475.2875481","DOIUrl":"https://doi.org/10.1145/2875475.2875481","url":null,"abstract":"Android malware is becoming very effective in evading detection techniques, and traditional malware detection techniques are demonstrating their weaknesses. Signature based detection shows at least two drawbacks: first, the detection is possible only after the malware has been identified, and the time needed to produce and distribute the signature provides attackers with window of opportunities for spreading the malware in the wild. For solving this problem, different approaches that try to characterize the malicious behavior through the invoked system and API calls emerged. Unfortunately, several evasion techniques have proven effective to evade detection based on system and API calls. In this paper, we propose an approach for capturing the malicious behavior in terms of device resource consumption (using a thorough set of features), which is much more difficult to camouflage. We describe a procedure, and the corresponding practical setting, for extracting those features with the aim of maximizing their discriminative power. Finally, we describe the promising results we obtained experimenting on more than 2000 applications, on which our approach exhibited an accuracy greater than 99%.","PeriodicalId":393015,"journal":{"name":"Proceedings of the 2016 ACM on International Workshop on Security And Privacy Analytics","volume":"42 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-03-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124411346","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 56

Malware Detection Using Dynamic Birthmarks 恶意软件检测使用动态胎记

Proceedings of the 2016 ACM on International Workshop on Security And Privacy Analytics Pub Date : 2016-03-11 DOI: 10.1145/2875475.2875476

Swapna Vemparala, Fabio Di Troia, C. A. Visaggio, Thomas H. Austin, M. Stamp

引用次数: 42

Session details: Keynote Session 会议详情:主题会议

Proceedings of the 2016 ACM on International Workshop on Security And Privacy Analytics Pub Date : 2016-03-11 DOI: 10.1145/3255947

Rakesh M. Verma

引用次数: 0

Session details: Industrial Session 会话详细信息:Industrial Session

Proceedings of the 2016 ACM on International Workshop on Security And Privacy Analytics Pub Date : 2016-03-11 DOI: 10.1145/3255948

Lila Ghemri

引用次数: 0

Data Driven Data Center Network Security 数据驱动的数据中心网络安全

Proceedings of the 2016 ACM on International Workshop on Security And Privacy Analytics Pub Date : 2016-03-11 DOI: 10.1145/2875475.2875490

V. Jeyakumar, Omid Madani, Ali ParandehGheibi, Navindra Yadav

引用次数: 5

Clone or Relative?: Understanding the Origins of Similar Android Apps 克隆还是亲戚?:了解类似Android应用的起源

Proceedings of the 2016 ACM on International Workshop on Security And Privacy Analytics Pub Date : 2016-03-11 DOI: 10.1145/2875475.2875480

Y. Ishii, Takuya Watanabe, Mitsuaki Akiyama, Tatsuya Mori

{"title":"Clone or Relative?: Understanding the Origins of Similar Android Apps","authors":"Y. Ishii, Takuya Watanabe, Mitsuaki Akiyama, Tatsuya Mori","doi":"10.1145/2875475.2875480","DOIUrl":"https://doi.org/10.1145/2875475.2875480","url":null,"abstract":"Since it is not hard to repackage an Android app, there are many cloned apps, which we call clones in this work. As previous studies have reported, clones are generated for bad purposes by malicious parties, e.g., adding malicious functions, injecting/replacing advertising modules, and piracy. Besides such clones, there are legitimate, similar apps, which we call \"relatives\" in this work. These relatives are not clones but are similar in nature; i.e., they are generated by the same app-building service or by the same developer using a same template. Given these observations, this paper aims to answer the following two research questions: (RQ1) How can we distinguish between clones and relatives? (RQ2) What is the breakdown of clones and relatives in the official and third-party marketplaces? To answer the first research question, we developed a scalable framework called APPraiser that systematically extracts similar apps and classifies them into clones and relatives. We note that our key algorithms, which leverage sparseness of the data, have the time complexity of O(n) in practice. To answer the second research question, we applied the APPraiser framework to the over 1.3 millions of apps collected from official and third-party marketplaces. Our analysis revealed the following findings: In the official marketplace, 79% of similar apps were attributed to relatives while, in the third-party marketplace, 50% of similar apps were attributed to clones. The majority of relatives are apps developed by prolific developers in both marketplaces. We also found that in the third-party market, of the clones that were originally published in the official market, 76% of them are malware.To the best of our knowledge, this is the first work that clarified the breakdown of \"similar\" Android apps, and quantified their origins using a huge dataset equivalent to the size of official market.","PeriodicalId":393015,"journal":{"name":"Proceedings of the 2016 ACM on International Workshop on Security And Privacy Analytics","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-03-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125613233","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 11

Security Analytics in the Context of Adversarial Machine Learning 对抗性机器学习背景下的安全分析

Proceedings of the 2016 ACM on International Workshop on Security And Privacy Analytics Pub Date : 2016-03-11 DOI: 10.1145/2875475.2875488

J. D. Tygar

引用次数: 0

Countering Phishing from Brands' Vantage Point 从品牌的制高点打击网络钓鱼

Proceedings of the 2016 ACM on International Workshop on Security And Privacy Analytics Pub Date : 2016-03-11 DOI: 10.1145/2875475.2875478

V. Bulakh, Minaxi Gupta

引用次数: 6