4.6 Review

A Review of State-of-the-Art Malware Attack Trends and Defense Mechanisms

Related references

Note: Only part of the references are listed.
Article Computer Science, Information Systems

A comprehensive survey on machine learning approaches for malware detection in IoT-based enterprise information system

Akshat Gaurav et al.

Summary: The Internet of Things has gained attention from academics and business information systems. It connects smart devices in an organizational information system and allows them to exchange data. However, the usage of Android apps in IoT devices makes them vulnerable to malware attacks. Researchers have proposed various attack mitigation approaches, and machine learning is considered the most promising strategy due to its accuracy and adaptability.

ENTERPRISE INFORMATION SYSTEMS (2023)

Review Computer Science, Theory & Methods

Deep Learning for Android Malware Defenses: A Systematic Literature Review

Yue Liu et al.

Summary: Malicious applications, especially those targeting Android, pose a serious threat to developers and end-users. Existing defense approaches based on manual rules or traditional machine learning may not be effective due to the rapid growth of Android malware and the advancement of evasion technologies. Deep learning (DL) techniques have shown promising performance in various domains, so applying DL to Android malware defenses has gained significant research attention. This article presents a systematic literature review that identifies 132 studies from 2014 to 2021, revealing the prevalence of DL-based Android malware detection and other defense approaches based on DL.

ACM COMPUTING SURVEYS (2023)

Article Chemistry, Analytical

An Insight into the Machine-Learning-Based Fileless Malware Detection

Osama Khalid et al.

Summary: In recent years, the malware industry has undergone massive development, leading to the emergence of fileless malware which poses a higher threat due to its ability to evade detection techniques. This paper presents a detection technique for fileless malware based on feature analysis using machine learning. The experiments show that the Random Forest algorithm outperforms other classifiers and achieves an overall accuracy of 93.33% in detecting fileless malware from widely used datasets.

SENSORS (2023)

Article Chemistry, Analytical

Dynamic Feature Dataset for Ransomware Detection Using Machine Learning Algorithms

Juan A. Herrera-Silva et al.

Summary: This research uses dynamic analysis and machine learning to identify evolving ransomware signatures for detecting current and new variants of the threat.

SENSORS (2023)

Article Computer Science, Information Systems

PowerDP: De-Obfuscating and Profiling Malicious PowerShell Commands With Multi-Label Classifiers

Meng-Han Tsai et al.

Summary: PowerShell has become a common tool for attackers to launch targeted attacks using living-off-the-land tactics and fileless attack techniques. Malicious PowerShell commands are often obfuscated to avoid detection and analysis. To address this challenge, we propose a hybrid framework that combines deep learning and program analysis for automatic de-obfuscation and behavioral profiling of PowerShell commands.

IEEE ACCESS (2023)

Article Computer Science, Interdisciplinary Applications

Machine Learning-based Intrusion Detection for Smart Grid Computing: A Survey

Nitasha Sahani et al.

Summary: ML-based IDS approaches have not been extensively explored in smart grid environments, despite the serious security threats. This article provides an extensive survey on the applications, dataset generation, various ML-based IDSs, evaluation metrics and testbeds, as well as future research directions in the smart grid.

ACM TRANSACTIONS ON CYBER-PHYSICAL SYSTEMS (2023)

Article Computer Science, Hardware & Architecture

SINN-RD: Spline interpolation-envisioned neural network-based ransomware detection scheme

Jaskaran Singh et al.

Summary: Multiple kinds of ransomware are a growing threat to Internet users. The ransomware encrypts important user data and requires payment of a ransom. The rise of ransomware attacks may be influenced by the trend of crypto-currencies. This article proposes a novel ransomware detection scheme based on Spline Interpolation envisioned Neural Network (SINN-RD) and demonstrates its effectiveness through security analysis and practical implementation, achieving a high accuracy value of 99.83% in comparative study.

COMPUTERS & ELECTRICAL ENGINEERING (2023)

Article Computer Science, Hardware & Architecture

AI-empowered malware detection system for industrial internet of things

Santosh K. Smmarwar et al.

COMPUTERS & ELECTRICAL ENGINEERING (2023)

Article Computer Science, Information Systems

A Comprehensive Survey for IoT Security Datasets Taxonomy, Classification and Machine Learning Mechanisms

Christin Alex et al.

Summary: This survey paper compares existing IoT related datasets found in the literature based on their characteristics, attributes, and machine learning techniques used. It provides a comprehensive comparison to help researchers in choosing the appropriate dataset for evaluating their machine learning techniques or designing an IoT security system. The limitations of existing datasets are identified, including the lack of documentation, realistic representation of IoT protocols and attack trends, and representative structures and topologies. To address these limitations, it is recommended to have a standard for dataset documentation and collect datasets from realistic IoT scenarios or real test-beds.

COMPUTERS & SECURITY (2023)

Article Automation & Control Systems

A novel deep learning-based approach for malware detection

Kamran Shaukat et al.

Summary: This paper proposes a novel deep learning-based approach for malware detection, which combines the advantages of static and dynamic analysis to achieve better performance than conventional methods. It converts portable executable (PE) files into colored images and extracts deep features using a fine-tuned deep learning model. Malware is then detected based on these deep features using support vector machines (SVM). The proposed method eliminates the need for intensive feature engineering tasks and domain knowledge, and it is scalable, cost-effective, and efficient.

ENGINEERING APPLICATIONS OF ARTIFICIAL INTELLIGENCE (2023)

Article Computer Science, Artificial Intelligence

An effective end-to-end android malware detection method

Huijuan Zhu et al.

Summary: Android has become the most popular mobile operating system due to its open source nature, wide hardware compatibility, and vast application ecosystem. However, its open source nature also makes it a prime target for malware. Existing manual feature-based malware detection methods lack effectiveness and code coverage. To address this, we propose an automated extraction method that characterizes crucial parts of the Dalvik executable into RGB images. Additionally, we introduce MADRF-CNN, a novel CNN variant that incorporates multi-scale context information to capture dependencies between different parts of the image derived from the Dex file. Experimental results demonstrate that our method achieves an accuracy of 96.9%, outperforming state-of-the-art solutions.

EXPERT SYSTEMS WITH APPLICATIONS (2023)

Article Computer Science, Artificial Intelligence

Fileless malware threats: Recent advances, analysis approach through memory forensics and research challenges

Ilker Kara

Summary: This research explores the latest advancements in fileless malware prevention and detection and proposes an analytical approach based on attack strategies and selected sample attributes. The method simplifies feature extraction and reduces processing load, providing advantages for fileless malware detection and system protection against cyber threats.

EXPERT SYSTEMS WITH APPLICATIONS (2023)

Article Computer Science, Information Systems

IoT malware: An attribute-based taxonomy, detection mechanisms and challenges

Princy Victor et al.

Summary: During the past decade, the Internet of Things (IoT) has played a significant role in digitizing society, improving supply chains, and enhancing daily lives. However, the diverse nature of IoT devices has made them vulnerable to malware attacks. In this study, a comprehensive taxonomy of IoT malware is presented, including categories, attack types, distribution architecture, victim devices, characteristics, and more. Additionally, existing works on IoT malware detection are reviewed to provide insights for future researchers.

PEER-TO-PEER NETWORKING AND APPLICATIONS (2023)

Article Multidisciplinary Sciences

A Malware Detection Approach Based on Deep Learning and Memory Forensics

Shuhui Zhang et al.

Summary: As cyber attacks become more complex, fileless malware has become a dangerous and challenging threat. This paper proposes a malware detection approach using convolutional neural network and memory forensics, which can effectively detect malicious code, especially in fileless attacks. By collecting and analyzing executable static samples in memory, the method achieves a high prediction accuracy of up to 97.48%.

SYMMETRY-BASEL (2023)

Article

Advanced Persistent Threats (APT): evolution, anatomy, attribution and countermeasures

Amit Sharma et al.

Journal of Ambient Intelligence and Humanized Computing (2023)

Article Computer Science, Hardware & Architecture

An efficient edge computing management mechanism for sustainable smart cities

Quy Vu Khanh et al.

Summary: This study proposes an efficient edge computing management mechanism for IoT applications in smart cities. By establishing a small database (information map), edge computing servers can store edge service information and exchange it when mobile end-users move to a new edge server's managed coverage. The experimental results have shown that our proposed mechanism significantly improves service response time and energy consumption compared to the traditional mechanism. We hope that this mechanism will be widely applied to sustainable smart cities in the future.

SUSTAINABLE COMPUTING-INFORMATICS & SYSTEMS (2023)

Article Computer Science, Information Systems

On the prevalence of software supply chain attacks: Empirical study and investigative framework

Anthony Andreoli et al.

Summary: This paper presents an empirical study of software supply chain attacks (SSCAs) and proposes an investigative framework for identifying and evaluating their characteristic behaviors. Using a large scale dataset of malware, benign software, and Windows 10 binaries, the authors develop a query system to match behaviors and assess the probability of malicious intent. The analysis reveals that the presence of an SSCA behavior within a binary indicates malware with 86-100% probability.

FORENSIC SCIENCE INTERNATIONAL-DIGITAL INVESTIGATION (2023)

Article Computer Science, Information Systems

Clustere d fe derate d learning architecture for network anomaly detection in large scale heterogeneous IoT networks

Xabier Saez-de-Camara et al.

Summary: There is an increasing trend of cyberattacks against Internet of Things (IoT) devices, which are becoming more sophisticated and motivated. Traditional IT security mechanisms struggle to integrate with IoT due to its vast scale, diverse hardware and software, and uncontrolled environments. Machine learning methods provide faster response to emerging threats, but face challenges in IoT settings. This work presents an architecture for training unsupervised models for network intrusion detection in distributed IoT and Industrial IoT (IIoT) deployments, leveraging Federated Learning (FL) to reduce isolation and network overhead problems.

COMPUTERS & SECURITY (2023)

Article Computer Science, Information Systems

A new deep boosted CNN and ensemble learning based IoT malware detection

Saddam Hussain Khan et al.

Summary: This paper proposes a new malware detection framework for timely detection of increasingly complex malware attacks in the IoT environment. The framework utilizes innovative convolutional neural networks and ensemble learning to effectively capture global malicious patterns and improve the generalization of hybrid learning. Evaluation on the IOT_Malware dataset demonstrates the robustness and performance of the framework.

COMPUTERS & SECURITY (2023)

Article Computer Science, Information Systems

A system call-based android malware detection approach with homogeneous & heterogeneous ensemble machine learning

Parnika Bhat et al.

Summary: This paper proposes a precise dynamic analysis approach to identify a variety of malicious attacks. The proposed method focuses on behavioral analysis of malware and uses features such as system calls, binders, and complex Android objects. By employing feature selection and stacking machine learning algorithms, efficient malware detection and classification with an accuracy rate of 98.08% is achieved.

COMPUTERS & SECURITY (2023)

Article Computer Science, Artificial Intelligence

SwiftR: Cross-platform ransomware fingerprinting using hierarchical neural networks on hybrid features

ElMouatez Billah Karbab et al.

Summary: To address the issue of ransomware attacks, we propose a new portable framework called SwiftR, which can perform cross-platform ransomware detection and fingerprinting. SwiftR uses advanced deep learning techniques and special feature extraction methods to accurately detect ransomware in both static and dynamic analysis. Extensive evaluation shows that SwiftR achieves excellent performance in ransomware detection, segregation, and family attribution.

EXPERT SYSTEMS WITH APPLICATIONS (2023)

Article Computer Science, Information Systems

Effective Multitask Deep Learning for IoT Malware Detection and Identification Using Behavioral Traffic Analysis

Sajid Ali et al.

Summary: Despite the increasing threat of IoT-specific malware, assessing IoT systems' security and developing mitigation measures are critical. This study proposes a multitask DL model using LSTM for detecting IoT malware, achieving high accuracy in tasks of determining benign/malicious traffic and identifying malware types. Traffic data from 18 IoT devices were used for training and feature selection enhanced the model's performance.

IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT (2023)

Article Computer Science, Information Systems

The Age of Ransomware: A Survey on the Evolution, Taxonomy, and Research Directions

Salwa Razaulla et al.

Summary: The proliferation of ransomware has become a significant threat to cybersecurity, causing extensive financial, reputational, and operational damage. This paper provides a comprehensive overview of ransomware's evolution, taxonomy, and state-of-the-art research contributions. It highlights the origins and milestones of ransomware, proposes a taxonomy to categorize different types, and reviews existing research on detection, prevention, mitigation, and prediction techniques. The study reveals a lack of emphasis on predicting ransomware and identifies shortcomings in real-time protection and detecting zero-day ransomware, as well as under-researched areas in adversarial machine learning exploitation and concept drift.

IEEE ACCESS (2023)

Article Computer Science, Information Systems

Malware Threat on Edge/Fog Computing Environments From Internet of Things Devices Perspective

Ibrahim Gulatas et al.

Summary: Developing a secure information processing environment requires securing all layers and devices, including Edge/Fog computing environments that rely on securing IoT devices. Recent attacks initiated by IoT malware have had a significant impact on compromised systems due to the large number of infected IoT devices. This study focuses on understanding IoT malware behaviors in the vulnerable layer of Edge/Fog computing environments. A total of 64 IoT malware families have been identified and characterized based on various aspects, providing insights for future research.

IEEE ACCESS (2023)

Article Computer Science, Theory & Methods

A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions

Harun Oz et al.

Summary: This paper presents a comprehensive survey on ransomware and ransomware defense research with respect to PCs/workstations, mobile devices, and IoT/CPS platforms. It covers 137 studies from 1990 to 2020, providing a detailed overview of ransomware evolution, key building blocks, notable ransomware families, and defense research. The paper also identifies open issues for future research, aiming to motivate further research in the field of ransomware.

ACM COMPUTING SURVEYS (2022)

Article Computer Science, Hardware & Architecture

Federated learning for malware detection in IoT devices

Valerian Rey et al.

Summary: With the increasing number of IoT devices and the growing importance of data privacy and security, researching the application and security issues of federated learning in IoT malware detection becomes crucial. This study explores the use of federated learning to detect malware while preserving data privacy and finds that it has the capability to detect malware, but further efforts are needed to enhance its robustness.

COMPUTER NETWORKS (2022)

Article Computer Science, Information Systems

FeSA: Feature selection architecture for ransomware detection under concept drift

Damien Warren Fernando et al.

Summary: This paper investigates the operation of different genetic and nature-inspired feature selection algorithms in systems where the prediction model changes over time in unforeseen ways. The study proposes a feature selection architecture, FeSA, that is independent of the underlying classification algorithm and aims to improve the longevity of the machine learning classifier. The performance of FeSA is evaluated by introducing concept drift to the trained model, and the results show that the generated feature set remains robust and maintains high detection rates of ransomware malware.

COMPUTERS & SECURITY (2022)

Article Computer Science, Hardware & Architecture

Conan: A Practical Real-Time APT Detection System With High Accuracy and Efficiency

Chunlin Xiong et al.

Summary: Advanced Persistent Threat (APT) attacks pose serious security threats and financial losses globally. To tackle the accuracy and efficiency issues in APT detection mechanisms, a novel and accurate detection model is proposed, along with a state-based framework. Experimental results demonstrate that this design can accurately and efficiently detect all attacks in real-world scenarios.

IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING (2022)

Article Computer Science, Information Systems

LinRegDroid: Detection of Android Malware Using Multiple Linear Regression Models-Based Classifiers

Durmus Ozkan Sahin et al.

Summary: This study presents a framework for Android malware detection based on permissions, using multiple linear regression methods. Application permissions, critical for the security of the Android operating system, are extracted through static analysis, and machine learning techniques are employed for security analysis. Two classifiers are proposed for permission-based Android malware detection, which are compared with basic machine learning techniques on different datasets. The bagging method is utilized to increase classification performance. The results show remarkable performances with classification algorithms based on linear regression models without the need for complex algorithms.

IEEE ACCESS (2022)

Article Computer Science, Information Systems

SETTI: A Self-supervised AdvErsarial Malware DeTection ArchiTecture in an IoT Environment

Marjan Golmaryami et al.

Summary: This article proposes an adversarial self-supervised architecture called SETTI for detecting malware in IoT networks. It introduces three self-supervised attack techniques and a defense method to mitigate these attacks. Experimental results show the impact of different attack methods on malicious sample injection.

ACM TRANSACTIONS ON MULTIMEDIA COMPUTING COMMUNICATIONS AND APPLICATIONS (2022)

Article Computer Science, Artificial Intelligence

A new approach for APT malware detection based on deep graph network for endpoint systems

Cho Do Xuan et al.

Summary: This research proposes a method of detecting APT malware on workstations based on deep learning graph networks, analyzing and evaluating the behavioral characteristics of malware using graph networks to improve detection efficiency.

APPLIED INTELLIGENCE (2022)

Article Computer Science, Artificial Intelligence

Behavior-based ransomware classification: A particle swarm optimization wrapper-based approach for feature selection

Muhammad Shabbir Abbasi et al.

Summary: Ransomware is a type of malware that encrypts data and demands ransom. Behavior-based ransomware detection is challenging due to a large number of system calls in the analysis output. This study presents an automated feature selection method using particle swarm optimization for behavior-based ransomware detection and classification.

APPLIED SOFT COMPUTING (2022)

Article Computer Science, Hardware & Architecture

SmartDefense: A distributed deep defense against DDoS attacks with edge computing

Sowmya Myneni et al.

Summary: The growing number of IoT edge devices have caused a change in the cyber-attack landscape, particularly with the significant increase in magnitude and intensity of DDoS attacks. This paper proposes a distributed DDoS detection and mitigation framework, SmartDefense, based on edge computing approaches, to detect and mitigate DDoS attacks at and near the source.

COMPUTER NETWORKS (2022)

Article Computer Science, Information Systems

Deep learning based cross architecture internet of things malware detection and classification

Rajasekhar Chaganti et al.

Summary: In this paper, a deep learning model is proposed to detect and classify IoT malware using ELF binary file byte sequences as input features. The model achieves high accuracy in malware detection and family classification according to the performance evaluation.

COMPUTERS & SECURITY (2022)

Article Computer Science, Artificial Intelligence

The rise of ransomware: Forensic analysis for windows based ransomware attacks

Ilker Kara et al.

Summary: As information technologies continue to evolve, malware has become more efficient in attacking information systems. Attackers are now utilizing ransomware as a profitable method of cyberattack, encrypting files and demanding ransom for access. Existing security mechanisms have struggled to combat this threat, highlighting the need for more effective detection and analysis methods.

EXPERT SYSTEMS WITH APPLICATIONS (2022)

Article Computer Science, Theory & Methods

Android malware obfuscation variants detection method based on multi-granularity opcode features

Junwei Tang et al.

Summary: Android malware poses a serious security threat, and obfuscation technology can generate variants that bypass existing detection methods. The proposed MGOPDroid system combines opcode feature extraction, TFIDF algorithm, and deep learning detection model for efficient anti-obfuscation Android malware detection. Experimental results show that the detection accuracy for both unobfuscated and obfuscated malware samples is over 90% with MGOPDroid.

FUTURE GENERATION COMPUTER SYSTEMS-THE INTERNATIONAL JOURNAL OF ESCIENCE (2022)

Article Computer Science, Information Systems

A Right Transfer Access Control Model of Internet of Things Based on Smart Contract

Jiuru Wang et al.

Summary: This paper studies the combination of Attribute-Based Access Control model (ABAC) and blockchain technology, and builds a flexible access control model for right transfer. By using transfer contracts and access control contracts, the massive and dynamic problems of sensor nodes are solved. The idea of Rollup is used to address on-chain storage problems and ensure transparency of operations.

SECURITY AND COMMUNICATION NETWORKS (2022)

Article Chemistry, Multidisciplinary

Detecting Cryptojacking Web Threats: An Approach with Autoencoders and Deep Dense Neural Networks

Aldo Hernandez-Suarez et al.

Summary: With the popularity of cryptocurrencies, there is a growing interest in cryptomining services. However, malicious actors have taken advantage of this and illegally mine data. Current solutions have limitations in accurately characterizing network and host samples.

APPLIED SCIENCES-BASEL (2022)

Article Computer Science, Artificial Intelligence

Crypto-ransomware detection using machine learning models in file-sharing network scenarios with encrypted traffic

Eduardo Berrueta et al.

Summary: This study proposes a tool to detect and block crypto-ransomware activity based on file-sharing traffic analysis, which can effectively differentiate between ransomware behavior and benign applications, with high detection accuracy and success rate.

EXPERT SYSTEMS WITH APPLICATIONS (2022)

Article Chemistry, Analytical

On Detecting Cryptojacking on Websites: Revisiting the Use of Classifiers

Fredy Andres Aponte-Novoa et al.

Summary: Cryptojacking is a form of malware that secretly mines cryptocurrencies using the victim's computer resources. This attack has become increasingly prevalent due to the profitability of cryptocurrencies and the difficulty in detecting it. In this study, various machine learning classification models are explored to detect cryptojacking on websites, and feature selection methods are used to improve predictive accuracy.

SENSORS (2022)

Article Computer Science, Information Systems

Uncovering APT malware traffic using deep learning combined with time sequence and association analysis

Weina Niu et al.

Summary: This paper proposes a deep-learning-based malware classification approach that combines time sequence features and association rules features to cope with the increasing number of malware variants. Experimental results demonstrate the effectiveness of the proposed method in accuracy and loss decline rate.

COMPUTERS & SECURITY (2022)

Article Computer Science, Information Systems

MFMCNS: a multi-feature and multi-classifier network-based system for ransomworm detection

Ahmad O. Almashhadani et al.

Summary: This study conducts a behavioral analysis of ransomworm network traffic, using WannaCry and NotPetya as case studies, and proposes a reliable and highly accurate multi-feature and multi-classifier network-based system, MFMCNS.

COMPUTERS & SECURITY (2022)

Article Computer Science, Theory & Methods

HCL-Classifier: CNN and LSTM based hybrid malware classifier for Internet of Things (IoT)

Muhammed Amin Abdullah et al.

Future Generation Computer Systems-The International Journal of eScience (2022)

Review Chemistry, Multidisciplinary

Malware Detection Issues, Challenges, and Future Directions: A Survey

Faitouri A. Aboaoja et al.

Summary: The increasing use of digital services has led to the evolution of malicious software, resulting in a higher probability of malware attacks that can corrupt data, steal information, or conduct other cybercrimes. Researchers have proposed various malware detection solutions, but they face challenges in effectively detecting different types of malware, especially zero-day attacks, due to the obfuscation and evasion techniques employed. This survey paper aims to bridge the gap by providing a comprehensive review of malware detection models, introducing a feature representation taxonomy, and linking each detection approach with commonly used data types.

APPLIED SCIENCES-BASEL (2022)

Article Computer Science, Interdisciplinary Applications

Deceiving AI-based malware detection through polymorphic attacks

C. Catalano et al.

Summary: The study critically analyzes the strengths and weaknesses of using CNN for static malware detection, starting from the conversion of binary executable files to pixel images. It aims to achieve fast and accurate malware classification by relying solely on the binary content of the file.

COMPUTERS IN INDUSTRY (2022)

Article Computer Science, Information Systems

How Do Organizations Seek Cyber Assurance? Investigations on the Adoption of the Common Criteria and Beyond

Nan Sun et al.

Summary: Cyber assurance is essential for organizations facing numerous security threats. Utilizing security standards and certifications is an effective strategy for risk management. Through surveying organizations from various countries and sectors, we identified barriers to adoption of Common Criteria and provided recommendations for promoting cybersecurity standards and certifications.

IEEE ACCESS (2022)

Article Computer Science, Information Systems

Utilizing Cyber Threat Hunting Techniques to Find Ransomware Attacks: A Survey of the State of the Art

Fatimah Aldauiji et al.

Summary: Ransomware is a highly harmful form of cyber attack that poses major concerns globally. It continues to evolve with advanced techniques, making it difficult for anti-malware detection systems to identify. Cyber threat hunting is a proactive malware detection approach that requires effective threat intelligence and data analysis techniques to enhance detection capabilities.

IEEE ACCESS (2022)

Article Computer Science, Information Systems

An Efficient Security Solution for Industrial Internet of Things Applications

Alaa Omran Almagrabi

Summary: The Industrial Internet of Things (IIoT) has been widely used in the industry, but security has become a concern. To address this issue, a blockchain-based endpoint protection platform is proposed to validate network policies and reduce latency. Experimental results show that the method performs well in trust management and adapting to hostile environments.

CMC-COMPUTERS MATERIALS & CONTINUA (2022)

Review Computer Science, Theory & Methods

Ransomware Mitigation in the Modern Era: A Comprehensive Review, Research Challenges, and Future Directions

Timothy McIntosh et al.

Summary: Although ransomware has evolved aggressively over the years, there is a lack of up-to-date and comprehensive studies evaluating its mitigation techniques. This survey examines the current concept of ransomware, reveals the inadequacies in current research, proposes unified metrics, and evaluates 118 studies to compare their strengths and weaknesses. Future trends and research directions are also forecasted to address the ongoing evolution of ransomware.

ACM COMPUTING SURVEYS (2022)

Article Computer Science, Information Systems

Decepticon: a Theoretical Framework to Counter Advanced Persistent Threats

Rudra P. Baksi et al.

Summary: Deception is proposed as an effective defense mechanism against Advanced Persistent Threats (APT) in the literature. This paper introduces Decepticon, a defense framework based on Hidden Markov Model using indicators of compromise for detection, to combat APTs in a networked system. The effectiveness of the framework is demonstrated through a real APT ransomware scenario.

INFORMATION SYSTEMS FRONTIERS (2021)

Article Computer Science, Information Systems

Ransomware: Recent advances, analysis, challenges and future research directions

Craig Beaman et al.

Summary: The COVID-19 pandemic has led to a significant increase in ransomware attacks targeting various institutions. Working remotely in less secure home environments may be a reason for the surge in attacks. Cybercriminals are constantly exploring new approaches, such as social engineering attacks, to spread ransomware.

COMPUTERS & SECURITY (2021)

Article Computer Science, Interdisciplinary Applications

Multi-scenario multi-objective robust optimization under deep uncertainty: A posteriori approach

Babooshka Shavazipour et al.

Summary: This paper introduces a novel optimization approach for multi-scenario multi-objective robust decision making, and provides an alternative method for scenario discovery and identifying vulnerable scenarios. Testing the approach on the classic shallow lake problem, it is shown that the novel approach ensures feasibility and robust efficiency of solutions under all scenarios while reducing computation cost and addressing scenario-dependency issues. The study also points out the need for novel benchmark problems to properly evaluate novel approaches in reflecting trade-offs and Pareto optimality.

ENVIRONMENTAL MODELLING & SOFTWARE (2021)

Article Computer Science, Information Systems

Real-Time Malware Process Detection and Automated Process Killing

Matilda Rhode et al.

Summary: Traditional perimeter-based detection is no longer effective against malicious software, with the need for endpoint detection and response products for real-time automated response to combat the rapid spread and destructive nature of malware. The proposed model in the study combines statistical filtering and machine learning dynamic behavioral detection model to detect and terminate malicious processes in real-time.

SECURITY AND COMMUNICATION NETWORKS (2021)

Article Computer Science, Software Engineering

On the Impact of Sample Duplication in Machine-Learning-Based Android Malware Detection

Yanjie Zhao et al.

Summary: Machine learning techniques play a crucial role in malware detection in the Android realm, but datasets may contain duplicated samples which can skew experimental results. Research shows that sample duplication has a limited impact on supervised learning models, but significantly affects unsupervised learning models.

ACM TRANSACTIONS ON SOFTWARE ENGINEERING AND METHODOLOGY (2021)

Article Computer Science, Information Systems

Catch them alive: A malware detection approach through memory forensics, manifold learning and computer vision

Ahmet Selman Bozkir et al.

Summary: The increasing usage of information systems and online services has led to the emergence of new, more dangerous and harder-to-detect malware. This study proposes a novel approach to identify malware by capturing memory dumps and applying manifold learning schemes to improve detection of unknown malware files.

COMPUTERS & SECURITY (2021)

Article Computer Science, Artificial Intelligence

A novel approach for APT attack detection based on combined deep learning model

Cho Do Xuan et al.

Summary: APT attacks are malicious attacks with intentional and clear targets, posing challenges to the information security systems of organizations, governments, and businesses. In recent years, the use of machine learning or deep learning algorithms to analyze abnormal behaviors in network traffic for detecting and preventing APT attacks has become popular. However, the lack of typical attack data makes the detection approach using behavior analysis and evaluation techniques difficult.

NEURAL COMPUTING & APPLICATIONS (2021)

Article Computer Science, Theory & Methods

A Survey on Windows-based Ransomware Taxonomy and Detection Mechanisms: Case Closed?

Routa Moussaileb et al.

Summary: Ransomware is a concerning threat in the 21st century, with attackers shifting towards targeted attacks. Numerous detection mechanisms have been proposed, with the article providing a systematic review of countermeasures, defining four stages of the attack and proposing a roadmap for combating ransomware.

ACM COMPUTING SURVEYS (2021)

Article Computer Science, Information Systems

Differential area analysis for ransomware attack detection within mixed file datasets

Simon R. Davies et al.

Summary: The threat of ransomware is growing, leading to increased costs for victims. This paper presents a technique to identify when encrypted files are being generated, using an enhanced mixed data set. By developing a file classification model based on the differential area between the entropy curves of files under analysis and random data, the model achieved a high success rate in accurately detecting encrypted files.

COMPUTERS & SECURITY (2021)

Review Chemistry, Analytical

Influence of Human Factors on Cyber Security within Healthcare Organisations: A Systematic Review

Sokratis Nifakos et al.

Summary: With the increasing concern of cybersecurity in healthcare, it is crucial for healthcare organizations to enhance staff awareness and training to strengthen cyber defense strategies. The literature highlights the evolving nature of cyber threats and the importance of adopting cybersecurity practices among healthcare professionals.

SENSORS (2021)

Article Chemistry, Multidisciplinary

Visualized Malware Multi-Classification Framework Using Fine-Tuned CNN-Based Transfer Learning Models

Walid El-Shafai et al.

Summary: The continuous growth in malicious software development poses significant security threats, prompting researchers to explore efficient malware detection methods using Transfer Learning and Fine-Tuning. By utilizing fine-tuned Convolutional Neural Network models, a visualized multi-classification framework is proposed to address challenges with false positives and imbalanced datasets, achieving high accuracy in detecting malware types.

APPLIED SCIENCES-BASEL (2021)

Article Computer Science, Information Systems

Malware classification and composition analysis: A survey of recent developments

Adel Abusitta et al.

Summary: The detection and classification of malware are becoming increasingly challenging due to the complexity of malware design and advancements in communication and computing infrastructure. Existing approaches and new analysis methods enable reverse engineers to better understand the functionality and behavior of malware samples, helping them discern intent and attackers' objectives. This survey categorizes and compares findings in malware classification and composition analyses, discussing evasion techniques, feature extraction methods, strengths, limitations, and future research directions.

JOURNAL OF INFORMATION SECURITY AND APPLICATIONS (2021)

Article Engineering, Multidisciplinary

Defense Against Advanced Persistent Threat Through Data Backup and Recovery

Lu-Xing Yang et al.

Summary: The paper introduces a novel APT defense mechanism based on DBAR techniques, aiming to address the shortcomings of the conventional DAR-based APT defense mechanism and demonstrate efficiency in practical implementation.

IEEE TRANSACTIONS ON NETWORK SCIENCE AND ENGINEERING (2021)

Article Computer Science, Information Systems

Enhancing File Entropy Analysis to Improve Machine Learning Detection Rate of Ransomware

Chia-Ming Hsu et al.

Summary: Cybersecurity, especially the prevalence of ransomware like crypto-ransomware, is a growing concern that requires continuous research in detection methods and the development of new defense strategies. Studies focusing on machine learning for building detection models and analyzing different encryption techniques are being conducted to address the rising threat of ransomware attacks.

IEEE ACCESS (2021)

Article Computer Science, Theory & Methods

TRACE: Enterprise-Wide Provenance Tracking for Real-Time APT Detection

Hassaan Irshad et al.

Summary: TRACE is a comprehensive provenance tracking system for scalable, real-time, enterprise-wide APT detection. It utilizes static analysis to identify program unit structures and dependencies, enabling construction of a distributed enterprise-wide causal graph. The system has evolved over a four-year period with improvements focused on performance, scalability, and fidelity, resulting in increased system call coverage and reduced time and space overhead.

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY (2021)

Article Computer Science, Information Systems

Enhanced Metamorphic Techniques-A Case Study Against Havex Malware

Zainub Mumtaz et al.

Summary: The study focuses on malware construction and various obfuscation techniques, with particular emphasis on garbage code insertion, instruction substitution, and subroutine reordering. The aim is to make detection difficult by implementing techniques that bypass detection, with Hidden Markov Models used to test the effectiveness of code morphing.

IEEE ACCESS (2021)

Article Computer Science, Information Systems

Intelligent Behavior-Based Malware Detection System on Cloud Computing Environment

Omer Aslan et al.

Summary: In a cloud environment, an intelligent behavior-based malware detection system has been proposed, which can efficiently detect known and unknown malware with high detection and accuracy rates. The research results show that the proposed algorithms, along with machine learning (ML) classifiers, achieve a 99.8% detection rate, 0.4% false positive rate, and 99.7% accuracy.

IEEE ACCESS (2021)

Article Computer Science, Information Systems

A Novel Method for Detecting Future Generations of Targeted and Metamorphic Malware Based on Genetic Algorithm

Danial Javaheri et al.

Summary: This paper presents a novel solution for detecting rare and mutating malware programs and provides a strategy to address the scarcity of datasets for modeling these types of malware. Through the use of genetic algorithms and an optimization strategy, selective generations of mutated elite malware samples are created. The results show a significant improvement in detection accuracy, especially for rare and metamorphic malware.

IEEE ACCESS (2021)

Article Computer Science, Information Systems

Deep Learning Approach for Detecting Malicious Activities Over Encrypted Secure Channels

Jiwon Yang et al.

Summary: The paper introduces a novel method for detecting malicious SSL traffic by reassembling SSL records and inspecting their characteristics using deep learning. The method shows great separability between benign and malicious traffic flows on an encrypted SSL channel.

IEEE ACCESS (2021)

Article Computer Science, Information Systems

Tight Arms Race: Overview of Current Malware Threats and Trends in Their Detection

Luca Caviglione et al.

Summary: Cyber attacks are on the rise, with malicious software being a major factor leading to successful compromises of targeted systems, posing challenges to existing detection techniques. Research indicates that machine learning techniques play a crucial role in malware detection, with future research focusing on development trends in the field and the application of new technologies.

IEEE ACCESS (2021)

Article Computer Science, Information Systems

Evaluating the Performance of NIST's Framework Cybersecurity Controls Through a Constructivist Multicriteria Methodology

Fernando Rocha Moreira et al.

Summary: This study conducted in a large Brazilian bank utilized the constructivist multicriteria method to address risk planning. The results highlighted the importance of Security Continuous Monitoring controls in cybersecurity risk management. It suggests the adoption of multicriteria methods for risk analysis.

IEEE ACCESS (2021)

Article Computer Science, Theory & Methods

Ransomware classification using patch-based CNN and self-attention network on embedded N-grams of opcodes

Bin Zhang et al.

FUTURE GENERATION COMPUTER SYSTEMS-THE INTERNATIONAL JOURNAL OF ESCIENCE (2020)

Article Computer Science, Theory & Methods

Malware Dynamic Analysis Evasion Techniques: A Survey

Amir Afianian et al.

ACM COMPUTING SURVEYS (2020)

Review Computer Science, Hardware & Architecture

The rise of machine learning for detection and classification of malware: Research developments, trends and challenges

Daniel Gibert et al.

JOURNAL OF NETWORK AND COMPUTER APPLICATIONS (2020)

Review Computer Science, Information Systems

APT datasets and attack modeling for automated detection methods: A review

Branka Stojanovic et al.

COMPUTERS & SECURITY (2020)

Article Computer Science, Software Engineering

VoterChoice: A ransomware detection honeypot with multiple voting framework

Chee Keong Ng et al.

CONCURRENCY AND COMPUTATION-PRACTICE & EXPERIENCE (2020)

Article Computer Science, Theory & Methods

Modeling and detection of the multi-stages of Advanced Persistent Threats attacks based on semi-supervised learning and complex networks characteristics

Aaron Zimba et al.

FUTURE GENERATION COMPUTER SYSTEMS-THE INTERNATIONAL JOURNAL OF ESCIENCE (2020)

Article Computer Science, Artificial Intelligence

APT attack detection based on flow network analysis techniques using deep learning

Cho Do Xuan et al.

JOURNAL OF INTELLIGENT & FUZZY SYSTEMS (2020)

Article Computer Science, Information Systems

Neural Network-Based Voting System with High Capacity and Low Computation for Intrusion Detection in SIEM/IDS Systems

Nabil Moukafih et al.

SECURITY AND COMMUNICATION NETWORKS (2020)

Article Automation & Control Systems

A Game-Theoretic Approach for Dynamic Information Flow Tracking to Detect Multistage Advanced Persistent Threats

Shana Moothedath et al.

IEEE TRANSACTIONS ON AUTOMATIC CONTROL (2020)

Review Computer Science, Information Systems

Review of Android Malware Detection Based on Deep Learning

Zhiqiang Wang et al.

IEEE ACCESS (2020)

Article Computer Science, Information Systems

An emerging threat Fileless malware: a survey and research challenges

Sudhakar et al.

CYBERSECURITY (2020)

Review Computer Science, Information Systems

A Comprehensive Review on Malware Detection Approaches

Omer Aslan et al.

IEEE ACCESS (2020)

Article Computer Science, Information Systems

A flow-based approach for Trickbot banking trojan detection

Ali Gezer et al.

COMPUTERS & SECURITY (2019)

Article Computer Science, Theory & Methods

A Multimodal Deep Learning Method for Android Malware Detection Using Various Features

TaeGuen Kim et al.

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY (2019)

Article Computer Science, Theory & Methods

Effective Repair Strategy Against Advanced Persistent Threat: A Differential Game Approach

Lu-Xing Yang et al.

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY (2019)

Article Computer Science, Hardware & Architecture

Ransomware protection using the moving target defense perspective

Suhyeon Lee et al.

COMPUTERS & ELECTRICAL ENGINEERING (2019)

Article Computer Science, Hardware & Architecture

SDNFV Based Threat Monitoring and Security Framework for Multi-Access Edge Computing Infrastructure

Prabhakar Krishnan et al.

MOBILE NETWORKS & APPLICATIONS (2019)

Article Computer Science, Theory & Methods

A machine learning framework for investigating data breaches based on semantic analysis of adversary's attack patterns in threat intelligence repositories

Umara Noor et al.

FUTURE GENERATION COMPUTER SYSTEMS-THE INTERNATIONAL JOURNAL OF ESCIENCE (2019)

Article Computer Science, Theory & Methods

DRTHIS: Deep ransomware threat hunting and intelligence system at the fog layer

Sajad Homayoun et al.

FUTURE GENERATION COMPUTER SYSTEMS-THE INTERNATIONAL JOURNAL OF ESCIENCE (2019)

Article Computer Science, Theory & Methods

Classification of ransomware families with machine learning based on N-gram of opcodes

Hanqi Zhang et al.

FUTURE GENERATION COMPUTER SYSTEMS-THE INTERNATIONAL JOURNAL OF ESCIENCE (2019)

Article Computer Science, Theory & Methods

Crypto-ransomware early detection model using novel incremental bagging with enhanced semi-random subspace selection

Bander Ali Saleh Al-rimy et al.

FUTURE GENERATION COMPUTER SYSTEMS-THE INTERNATIONAL JOURNAL OF ESCIENCE (2019)

Article Computer Science, Information Systems

Transfer learning for detecting unknown network attacks

Juan Zhao et al.

EURASIP JOURNAL ON INFORMATION SECURITY (2019)

Article Computer Science, Information Systems

A Survey on Advanced Persistent Threats: Techniques, Solutions, Challenges, and Research Opportunities

Adel Alshamrani et al.

IEEE COMMUNICATIONS SURVEYS AND TUTORIALS (2019)

Proceedings Paper Telecommunications

Analyzing WannaCry Ransomware Considering the Weapons and Exploits

Da-Yu Kao et al.

2019 21ST INTERNATIONAL CONFERENCE ON ADVANCED COMMUNICATION TECHNOLOGY (ICACT): ICT FOR 4TH INDUSTRIAL REVOLUTION (2019)

Proceedings Paper Computer Science, Theory & Methods

Malware Evasion Attack and Defense

Yonghong Huang et al.

2019 49TH ANNUAL IEEE/IFIP INTERNATIONAL CONFERENCE ON DEPENDABLE SYSTEMS AND NETWORKS WORKSHOPS (DSN-W) (2019)

Review Computer Science, Information Systems

A Survey on malware analysis and mitigation techniques

S. Sibi Chakkaravarthy et al.

COMPUTER SCIENCE REVIEW (2019)

Proceedings Paper Computer Science, Information Systems

Just the Tip of the Iceberg: Internet-Scale Exploitation of Routers for Cryptojacking

Hugo L. J. Bijmans et al.

PROCEEDINGS OF THE 2019 ACM SIGSAC CONFERENCE ON COMPUTER AND COMMUNICATIONS SECURITY (CCS'19) (2019)

Proceedings Paper Computer Science, Software Engineering

RansomBlocker: a Low-Overhead Ransomware-Proof SSD

Jisung Park et al.

PROCEEDINGS OF THE 2019 56TH ACM/EDAC/IEEE DESIGN AUTOMATION CONFERENCE (DAC) (2019)

Article Computer Science, Information Systems

Hidden Markov Models and Alert Correlations for the Prediction of Advanced Persistent Threats

Ibrahim Ghafir et al.

IEEE ACCESS (2019)

Article Computer Science, Theory & Methods

Detection of advanced persistent threat using machine-learning correlation analysis

Ibrahim Ghafir et al.

FUTURE GENERATION COMPUTER SYSTEMS-THE INTERNATIONAL JOURNAL OF ESCIENCE (2018)

Article Computer Science, Information Systems

Zero-day malware detection using transferred generative adversarial networks based on deep autoencoders

Jin-Young Kim et al.

INFORMATION SCIENCES (2018)

Article Computer Science, Artificial Intelligence

DroidDet: Effective and robust detection of android malware using static analysis along with rotation forest model

Hui-Juan Zhu et al.

NEUROCOMPUTING (2018)

Proceedings Paper Computer Science, Theory & Methods

Tracking Ransomware End-to-end

Danny Yuxing Huang et al.

2018 IEEE SYMPOSIUM ON SECURITY AND PRIVACY (SP) (2018)

Article Computer Science, Information Systems

CLDSafe: An Efficient File Backup System in Cloud Storage against Ransomware

Joobeom Yun et al.

IEICE TRANSACTIONS ON INFORMATION AND SYSTEMS (2017)

Article Computer Science, Information Systems

CLDSafe: An Efficient File Backup System in Cloud Storage against Ransomware

Joobeom Yun et al.

IEICE TRANSACTIONS ON INFORMATION AND SYSTEMS (2017)

Article Multidisciplinary Sciences

Defending Against Advanced Persistent Threats Using Game-Theory

Stefan Rass et al.

PLOS ONE (2017)

Article Computer Science, Theory & Methods

A Survey on Malware Detection Using Data Mining Techniques

Yanfang Ye et al.

ACM COMPUTING SURVEYS (2017)

Proceedings Paper Computer Science, Information Systems

PAYBREAK : Defense Against Cryptographic Ransomware

Eugene Kolodenker et al.

PROCEEDINGS OF THE 2017 ACM ASIA CONFERENCE ON COMPUTER AND COMMUNICATIONS SECURITY (ASIA CCS'17) (2017)

Proceedings Paper Computer Science, Theory & Methods

SDN based scalable MTD solution in Cloud Network

Ankur Chowdhary et al.

MTD'16: PROCEEDINGS OF THE 2016 ACM WORKSHOP ON MOVING TARGET DEFENSE (2016)

Article Computer Science, Information Systems

Android Security: A Survey of Issues, Malware Penetration, and Defenses

Parvez Faruki et al.

IEEE COMMUNICATIONS SURVEYS AND TUTORIALS (2015)