On the security of machine learning in malware c&c detection: A survey

J Gardiner, S Nagaraja - ACM Computing Surveys (CSUR), 2016 - dl.acm.org
One of the main challenges in security today is defending against malware attacks. As
trends and anecdotal evidence show, preventing these attacks, regardless of their …

Log2vec: A heterogeneous graph embedding based approach for detecting cyber threats within enterprise

F Liu, Y Wen, D Zhang, X Jiang, X **ng… - Proceedings of the 2019 …, 2019 - dl.acm.org
Conventional attacks of insider employees and emerging APT are both major threats for the
organizational information system. Existing detections mainly concentrate on users' behavior …

Realtime robust malicious traffic detection via frequency domain analysis

C Fu, Q Li, M Shen, K Xu - Proceedings of the 2021 ACM SIGSAC …, 2021 - dl.acm.org
Machine learning (ML) based malicious traffic detection is an emerging security paradigm,
particularly for zero-day attack detection, which is complementary to existing rule based …

Detection of malicious web activity in enterprise computer networks

AM Oprea, Z Li, R Norris, KD Bowers - US Patent 9,838,407, 2017 - Google Patents
A processing device in one embodiment comprises a processor coupled to a memory and is
configured to obtain internal log data of a computer network of an enterprise, to extract …

Measuring and modeling the label dynamics of online {Anti-Malware} engines

S Zhu, J Shi, L Yang, B Qin, Z Zhang, L Song… - 29th USENIX Security …, 2020 - usenix.org
VirusTotal provides malware labels from a large set of anti-malware engines, and is heavily
used by researchers for malware annotation and system evaluation. Since different engines …

The Circle of life: A {large-scale} study of the {IoT} malware lifecycle

O Alrawi, C Lever, K Valakuzhy, K Snow… - 30th USENIX Security …, 2021 - usenix.org
Our current defenses against IoT malware may not be adequate to remediate an IoT
malware attack similar to the Mirai botnet. This work seeks to investigate this matter by …

Detection of early-stage enterprise infection by mining large-scale log data

A Oprea, Z Li, TF Yen, SH Chin… - 2015 45th Annual IEEE …, 2015 - ieeexplore.ieee.org
Recent years have seen the rise of sophisticated attacks including advanced persistent
threats (APT) which pose severe risks to organizations and governments. Additionally, new …

Cruparamer: Learning on parameter-augmented api sequences for malware detection

X Chen, Z Hao, L Li, L Cui, Y Zhu… - IEEE Transactions on …, 2022 - ieeexplore.ieee.org
Learning on execution behaviour, ie, sequences of API calls, is proven to be effective in
malware detection. In this paper, we present CruParamer, a deep neural network based …

Detecting unknown encrypted malicious traffic in real time via flow interaction graph analysis

C Fu, Q Li, K Xu - arxiv preprint arxiv:2301.13686, 2023 - arxiv.org
In this paper, we propose HyperVision, a realtime unsupervised machine learning (ML)
based malicious traffic detection system. Particularly, HyperVision is able to detect unknown …

Optimized invariant representation of network traffic for detecting unseen malware variants

K Bartos, M Sofka, V Franc - 25th USENIX Security Symposium (USENIX …, 2016 - usenix.org
New and unseen polymorphic malware, zero-day attacks, or other types of advanced
persistent threats are usually not detected by signature-based security devices, firewalls, or …