Information Security Commons^™

Identifying Bots On Twitter With Benford’S Law, Sanmesh Bhosale

Master's Projects

Over time Online Social Networks (OSNs) have grown exponentially in terms of active users and have now become an influential factor in the formation of public opinions. Due to this, the use of bots and botnets for spreading misinformation on OSNs has become a widespread concern. The biggest example of this was during the 2016 American Presidential Elections, where Russian bots on Twitter pumped out fake news to influence the election results.

Identifying bots and botnets on Twitter is not just based on visual analysis and can require complex statistical methods to score a profile based on multiple features and …

Generative Adversarial Networks For Classic Cryptanalysis, Deanne Charan

Master's Projects

The necessity of protecting critical information has been understood for millennia. Although classic ciphers have inherent weaknesses in comparison to modern ciphers, many classic ciphers are extremely challenging to break in practice. Machine learning techniques, such as hidden Markov models (HMM), have recently been applied with success to various classic cryptanalysis problems. In this research, we consider the effectiveness of the deep learning technique CipherGAN---which is based on the well- established generative adversarial network (GAN) architecture---for classic cipher cryptanalysis. We experiment extensively with CipherGAN on a number of classic ciphers, and we compare our results to those obtained using HMMs.

Clickbait Detection In Youtube Videos, Ruchira Gothankar

Master's Projects

YouTube videos often include captivating descriptions and intriguing thumbnails designed to increase the number of views, and thereby increase the revenue for the person who posted the video. This creates an incentive for people to post clickbait videos, in which the content might deviate significantly from the title, description, or thumbnail. In effect, users are tricked into clicking on clickbait videos. In this research, we consider the challenging problem of detecting clickbait YouTube videos. We experiment with logistic regression, random forests, and multilayer perceptrons, based on a variety of textual features. We obtain a maximum accuracy in excess of 94%.

Malware Classification With Bert, Joel Lawrence Alvares

Master's Projects

Malware Classification is used to distinguish unique types of malware from each other.

This project aims to carry out malware classification using word embeddings which are used in Natural Language Processing (NLP) to identify and evaluate the relationship between words of a sentence. Word embeddings generated by BERT and Word2Vec for malware samples to carry out multi-class classification. BERT is a transformer based pre- trained natural language processing (NLP) model which can be used for a wide range of tasks such as question answering, paraphrase generation and next sentence prediction. However, the attention mechanism of a pre-trained BERT model can …

Fake Malware Opcodes Generation Using Hmm And Different Gan Algorithms, Harshit Trehan

Master's Projects

Malware, or malicious software, is a program that is intended to harm systems. In the past decade, the number of malware attacks have grown and, more importantly, evolved. Many researchers have successfully integrated cutting edge Machine Learning techniques to combat this ever present and growing threat to cyber and information security. One big challenge faced by many researchers is the lack of enough data to train machine learning models and specifically deep neural networks properly. Generative modelling has proven to be very efficient at generating synthesized data that can match the actual data distribution.

In this project, we aim to …

Keystroke Dynamics Based On Machine Learning, Han-Chih Chang

Master's Projects

The development of active and passive biometric authentication and identification technology plays an increasingly important role in cybersecurity. Biometrics that utilize features derived from keystroke dynamics have been studied in this context. Keystroke dynamics can be used to analyze the way that a user types by monitoring various keyboard inputs. Previous work has considered the feasibility of user authentication and classification based on keystroke features. In this research, we analyze a wide variety of machine learning and deep learning models based on keystroke-derived features, we optimize the resulting models, and we compare our results to those obtained in related research. …

Malware Analysis With Auxiliary-Classifier Gan, Rakesh Nagaraju

Master's Projects

A generative adversarial network (GAN) is a powerful machine learning concept where both a generative and discriminative model are trained simultaneously. A recent trend in malware research consists of treating executables as images and employing image-based analysis techniques. In this research, we generate fake malware images using GANs, and we also consider the effectiveness of GANs for malware classification. Specifically, we consider auxiliary classifier GAN (AC-GAN), which enables us to work with multiclass data. We find that AC-GAN generates malware images that cannot be reliably distinguished from real malware images. In addition, we find that the detection capabilities of AC-GAN …

Presentation Attack Detection In Facial Biometric Authentication, Hardik Kumar

Master's Projects

Biometric systems are referred to those structures that enable recognizing an individual, or specifically a characteristic, using biometric data and mathematical algorithms. These are known to be widely employed in various organizations and companies, mostly as authentication systems. Biometric authentic systems are usually much more secure than a classic one, however they also have some loopholes. Presentation attacks indicate those attacks which spoof the biometric systems or sensors. The presentation attacks covered in this project are: photo attacks and deepfake attacks. In the case of photo attacks, it is observed that interactive action check like Eye Blinking proves efficient in …

Machine Learning To Detect Malware Evolution, Lolitha Sresta Tupadha

Master's Projects

Malware evolves over time and anti-virus must adapt to such evolution. Hence, it is critical to detect those points in time where malware has evolved so that appro-priate countermeasures can be undertaken. In this research, we perform a variety of experiments to determine when malware evolution is likely to have occurred. All of the evolution detection techniques that we consider are based on machine learning and can be fully automated—in particular, no reverse engineering or other labor-intensive manual analysis is required. Specifically, we consider analysis based on hidden Markov models and various word embedding techniques, among other machine learning based …

Hidden Markov Model-Based Clustering For Malware Classification, Shamli Singh

Master's Projects

Automated techniques to classify malware samples into their respective families are critical in cybersecurity. Previously research applied ��-means clustering to scores generated by hidden Markov models (HMM) as a means of dealing with the malware classification problem. In this research, we follow a somewhat similar approach, but instead of using HMMs to generate scores, we directly cluster the HMMs themselves. We obtain good results on a challenging malware dataset.

Data Augmentation With Malware As Images, Aditi Walia

Master's Projects

Machine learning and deep learning techniques for malware detection and classifi- cation play an important role in the mitigation of cybersecurity threats. However, such techniques are often limited by a lack of data. Previous research has shown promising classification results by treating malware executables as images. In this research, we consider data augmentation using noise addition, geometric transforma- tions, and Auxiliary Classifier Generative Adversarial Networks (AC-GAN) for data augmentation of malware images. We train convolution neural networks (CNN) to verify that our generated images accurately model the original malware samples.

Classifying Illegal Advertisements On The Darknet Using Nlp, Karan Shashin Shah

Master's Projects

The Darknet has become a place to conduct various illegal activities like child labor, contract murder, drug selling while staying anonymous. Traditionally, international and government agencies try to control these activities, but most of those actions are manual and time-consuming. Recently, various researchers developed Machine Learning (ML) approaches trying to aid in the process of detecting illegal activities. The above problem can benefit by using different Natural Language Processing (NLP) techniques. More specifically, researchers have used various classical topic modeling techniques like bag of words, N-grams, Term Frequency, Term Frequency Inverse Document Frequency (TF-IDF) to represent features and train machine …

Fake Malware Classification With Cnn Via Image Conversion: A Game Theory Approach, Yash Sahasrabuddhe

Master's Projects

Improvements in malware detection techniques have grown significantly over the past decade. These improvements have resulted in better security for systems from various forms of malware attacks. However, it is also the reason for continuous evolution of malware which makes it harder for current security mechanisms to detect them. Hence, there is a need to understand different malwares and study classification techniques using the ever-evolving field of machine learning. The goal of this research project is to identify similarities between malware families and to improve on classification of malwares within different malware families by implementing Convolutional Neural Networks (CNNs) on …

Keystroke Dynamics For User Authentication With Fixed And Free Text, Jianwei Li

Master's Projects

YouTube videos often include captivating descriptions and intriguing thumbnails designed to increase the number of views, and thereby increase the revenue for the person who posted the video. This creates an incentive for people to post clickbait videos, in which the content might deviate significantly from the title, description, or thumbnail. In effect, users are tricked into clicking on clickbait videos. In this research, we consider the challenging problem of detecting clickbait YouTube videos. We experiment with multiple state of the art machine learning techniques and a variety of textual features.

Defending Vehicles Against Cyberthreats: Challenges And A Detection-Based Solution, Qilin Liu

Master's Projects

The lack of concern with security when vehicular network protocols were designed some thirty years ago is about to take its toll as vehicles become more connected and smart. Today as demands for more functionality and connectivity on vehicles continue to grow, a plethora of Electronic Control Units (ECUs) that are able to communicate to external networks are added to the automobile networks. The proliferation of ECU and the increasing autonomy level give drivers more control over their vehicles and make driving easier, but at the same time they expand the attack surface, bringing more vulnerabilities to vehicles that might …

A Neat Approach To Malware Classification, Jason Do

Master's Projects

Current malware detection software often relies on machine learning, which is seen as an improvement over signature-based techniques. Problems with a machine learning based approach can arise when malware writers modify their code with the intent to evade detection. This leads to a cat and mouse situation where new models must constantly be trained to detect new malware variants. In this research, we experiment with genetic algorithms as a means of evolving machine learning models to detect malware. Genetic algorithms, which simulate natural selection, provide a way for models to adapt to continuous changes in a malware families, and thereby …

Malware Classification With Gaussian Mixture Model-Hidden Markov Models, Jing Zhao

Master's Projects

Discrete hidden Markov models (HMM) are often applied to the malware detection and classification problems. However, the continuous analog of discrete HMMs, that is, Gaussian mixture model-HMMs (GMM-HMM), are rarely considered in the field of cybersecurity. In this study, we apply GMM-HMMs to the malware classification problem and we compare our results to those obtained using discrete HMMs. As features, we consider opcode sequences and entropy-based sequences. For our opcode features, GMM-HMMs produce results that are comparable to those obtained using discrete HMMs, whereas for our entropy-based features, GMM-HMMs generally improve on the classification results that we can attain with …

Malware Classification Using Lstms, Dennis Dang

Master's Projects

Signature and anomaly based detection have long been quintessential techniques used in malware detection. However, these techniques have become increasingly ineffective as malware becomes more complex. Researchers have therefore turned to deep learning to construct better performing models. In this project, we create four different long-short term memory (LSTM) models and train each model to classify malware by family type. Our data consists of opcodes extracted from malware executables. We employ techniques used in natural language processing (NLP) such as word embedding and bidirection LSTMs (biLSTM). We also use convolutional neural networks (CNN). We found that our model consisting of …

Is The Transit Industry Prepared For The Cyber Revolution? Policy Recommendations To Enhance Surface Transit Cyber Preparedness, Scott Belcher, Terri Belcher, Eric Greenwald, Brandon Thomas

Mineta Transportation Institute

The intent of this study is to assess the readiness, resourcing, and structure of public transit agencies to identify, protect from, detect, respond to, and recover from cybersecurity vulnerabilities and threats. Given the multitude of connected devices already in use by the transit industry and the vast amount of data generated (with more coming online soon), the transit industry is vulnerable to malicious cyber-attack and other cybersecurity-related threats. This study reviews the state of best cybersecurity practices in public surface transit; outlines U.S. public surface transit operators’ cybersecurity operations; assesses U.S. policy on cybersecurity in public surface transportation; and provides …

Malware Classification Based On Hidden Markov Model And Word2vec Features, Aparna Sunil Kale

Master's Projects

Malware classification is an important and challenging problem in information security. Modern malware classification techniques rely on machine learning models that can be trained on a wide variety of features, including opcode sequences, API calls, and byte ��-grams, among many others. In this research, we implement hybrid machine learning techniques, where we train hidden Markov models (HMM) and compute Word2Vec encodings based on opcode sequences. The resulting trained HMMs and Word2Vec embedding vectors are then used as features for classification algorithms. Specifically, we consider support vector machine (SVM), ��-nearest neighbor

(��-NN), random forest (RF), and deep neural network (DNN) classifiers. …

Detection And Analysis Of Malware Evolution, Sunhera Barunkumar Paul

Master's Projects

Malware is a malicious software that causes disruption, allows access to unapproved resources, or performs other unauthorized activity. Developing effective malware detection techniques is a critical aspect of information security. One difficulty that arises is that malware often evolves over time, due to changing goals of malware developers, or to counter advances in detection. This evolution can occur through various modifications in malware code. To maintain effective malware detection, it is necessary to detect and analyze malware evolution so that appropriate countermeasures can be taken. We perform a variety of experiments to detect points in time where a malware family …

Word Embedding Techniques For Malware Classification, Aniket Chandak

Master's Projects

Word embeddings are often used in natural language processing as a means to quantify relationships between words. More generally, these same word embedding techniques can be used to quantify relationships between features. In this paper, we conduct a series of experiments that are designed to determine the effectiveness of word embedding in the context of malware classification. First, we conduct experiments where hidden Markov models (HMM) are directly applied to opcode sequences. These results serve to establish a baseline for comparison with our subsequent word embedding experiments. We then experiment with word embedding vectors derived from HMMs— a technique that …

Sentiment Analysis For Troll Activity Detection On Sina Weibo, Zidong Jiang

Master's Projects

The impact of social media on the modern world is difficult to overstate. Virtually all companies and public figures have social media accounts on popular platforms such as Twitter and Facebook. In China, the micro-blogging service provider Sina Weibo is the most popular such service. To overcome negative publicity, Weibo trolls the so called Water Army can be hired to post deceptive comments.

In recent years, troll detection and sentiment analysis have been studied, but we are not aware of any research that considers troll detection based on sentiment analysis. In this research, we focus on troll detection via sentiment …

Real-Time Ad Click Fraud Detection, Apoorva Srivastava

Master's Projects

With the increase in Internet usage, it is now considered a very important platform for advertising and marketing. Digital marketing has become very important to the economy: some of the major Internet services available publicly to users are free, thanks to digital advertising. It has also allowed the publisher ecosystem to flourish, ensuring significant monetary incentives for creating quality public content, helping to usher in the information age. Digital advertising, however, comes with its own set of challenges. One of the biggest challenges is ad fraud. There is a proliferation of malicious parties and software seeking to undermine the ecosystem …

Network Traffic Based Botnet Detection Using Machine Learning, Anand Ravindra Vishwakarma

Master's Projects

The field of information and computer security is rapidly developing in today’s world as the number of security risks is continuously being explored every day. The moment a new software or a product is launched in the market, a new exploit or vulnerability is exposed and exploited by the attackers or malicious users for different motives. Many attacks are distributed in nature and carried out by botnets that cause widespread disruption of network activity by carrying out DDoS (Distributed Denial of Service) attacks, email spamming, click fraud, information and identity theft, virtual deceit and distributed resource usage for cryptocurrency mining. …

Implementing Tontinecoin, Prashant Pardeshi

Master's Projects

One of the alternatives to proof-of-work (PoW) consensus protocols is proof-of- stake (PoS) protocols, which address its energy and cost related issues. But they suffer from the nothing-at-stake problem; validators (PoS miners) are bound to lose nothing if they support multiple blockchain forks. Tendermint, a PoS protocol, handles this problem by forcing validators to bond their stake and then seizing a cheater’s stake when caught signing multiple competing blocks. The seized stake is then evenly distributed amongst the rest of validators. However, as the number of validators increases, the benefit in finding a cheater compared to the cost of monitoring …

Image-Based Malware Classification With Convolutional Neural Networks And Extreme Learning Machines, Mugdha Jain

Master's Projects

Research in the field of malware classification often relies on machine learning models that are trained on high level features, such as opcodes, function calls, and control flow graphs. Extracting such features is costly, since disassembly or code execution is generally required. In this research, we conduct experiments to train and evaluate machine learning models for malware classification, based on features that can be obtained without disassembly or execution of code. Specifically, we visualize malware samples as images and employ image analysis techniques. In this context, we focus on two machine learning models, namely, Convolutional Neural Networks (CNN) and Extreme …

Hot Fusion Vs Cold Fusion For Malware Detection, Snehal Bichkar

Master's Projects

A fundamental problem in malware research consists of malware detection, that is, dis- tinguishing malware samples from benign samples. This problem becomes more challeng- ing when we consider multiple malware families. A typical approach to this multi-family detection problem is to train a machine learning model for each malware family and score each sample against all models. The resulting scores are then used for classification. We refer to this approach as “cold fusion,” since we combine previously-trained models—no retraining of these base models is required when additional malware families are considered. An alternative approach is to train a single model …

Sql Injection Detection Using Machine Learning, Sonali Mishra

Master's Projects

Sharing information over the Internet over multiple platforms and web-applications has become a quite common phenomenon in the recent times. The web-based applications that accept critical information from users store this information in databases. These applications and the databases connected to them are susceptible to all kinds of information security threats due to being accessible through the Internet. The threats include attacks such as Cross Side Scripting (CSS), Denial of Service Attack (DoS0, and Structured Query Language (SQL) Injection attacks. SQL Injection attacks fall under the top ten vulnerabilities when we talk about web-based applications. Through this kind of attack, …

Intelligent Log Analysis For Anomaly Detection, Steven Yen

Master's Projects

Computer logs are a rich source of information that can be analyzed to detect various issues. The large volumes of logs limit the effectiveness of manual approaches to log analysis. The earliest automated log analysis tools take a rule-based approach, which can only detect known issues with existing rules. On the other hand, anomaly detection approaches can detect new or unknown issues. This is achieved by looking for unusual behavior different from the norm, often utilizing machine learning (ML) or deep learning (DL) models. In this project, we evaluated various ML and DL techniques used for log anomaly detection. We …