KMITL

Permanent URI for this communityhttps://dspace.kmitl.ac.th/handle/123456789/1

Browse

Settings

Access type: UnknownSubject: search.filters.subject.Malware

Search Results

Now showing 1 - 5 of 5
  • Loading...
    Thumbnail Image
    Some of the metrics are blocked by your 
    consent settings
    Item type:Publication,
    Malware Developing Guide: Encryption and Decryption
    (2022-01-01)
    Chatsomsanga, Jutiphat
    ;
    Benjangkaprasert, Chawalit
    This research aims to understand malware from malware author's view. Starting from Ransomware, we attempt to develop ransomware written in python and encrypt all files in Windows platform without doing harm to crucial system files. In this research we use Asus K550J laptop with Windows 10 education (Build 19042) as a victim machine. We ran encryption and decryption program with different privilege and observe the results as well as time takes to encrypt and decrypt files. Results show that encryption process is much slower than decryption process and both encryption and decryption work slower in the bigger file size.
  • Loading...
    Thumbnail Image
    Some of the metrics are blocked by your 
    consent settings
    Item type:Publication,
    Malware Developing Guide: Encryption and Decryption
    (2021-02-07)
    Chatsomsanga, Jutiphat
    ;
    Benjangkaprasert, Chawalit
    This research aims to understand malware from malware author's view. Starting from Ransomware, we attempt to develop ransomware written in python and encrypt all files in Windows platform without doing harm to crucial system files. In this research we use Asus K550J laptop with Windows 10 education (Build 19042) as a victim machine. We ran encryption and decryption program with different privilege and observe the results as well as time takes to encrypt and decrypt files. Results show that encryption process is much slower than decryption process and both encryption and decryption work slower in the bigger file size.
  • Loading...
    Thumbnail Image
    Some of the metrics are blocked by your 
    consent settings
    Item type:Publication,
    Time zone correlation analysis of malware/bot downloads
    (2013-01-01)
    Sisaat, Khamphao
    ;
    Kikuchi, Hiroaki
    ;
    Matsuo, Shunji
    ;
    Terada, Masato
    ;
    Fujiwara, Masashi
    A botnet attacks any Victim Hosts via the multiple Command and Control (C and C) Servers, which are controlled by a botmaster. This makes it more difficult to detect the botnet attacks and harder to trace the source country of the botmaster due to the lack of the logged data about the attacks. To locate the C and C Servers during malware/bot downloading phase, we have analyzed the source IP addresses of downloads to more than 90 independent Honeypots in Japan in the CCC (Cyber Clean Center) dataset 2010 comprising over 1 million data records and almost 1 thousand malware names. Based on GeoIP services, a Time Zone Correlation model has been proposed to determine the correlation coefficient between bot downloads from Japan and other source countries. We found a strong correlation between active malware/bot downloads and time zone of the C and C Servers. As a result, our model confirms that malware/bot downloads are synchronized with time zone (country) of the corresponding C and C Servers so that the botmaster can be possibly traced. © 2013 The Institute of Electronics, Information and Communication Engineers.
  • Loading...
    Thumbnail Image
    Some of the metrics are blocked by your 
    consent settings
    Item type:Publication,
    Analysis on the sequential behavior of malware attacks
    (2011-01-01)
    Rosyid, Nur Rohman
    ;
    Ohrui, Masayuki
    ;
    Kikuchi, Hiroaki
    ;
    Sooraksa, Pitikhate
    ;
    Terada, Masato
    Overcoming the highly organized and coordinated malware threats by botnets on the Internet is becoming increasingly difficult. A honeypot is a powerful tool for observing and catching malware and virulent activity in Internet traffic. Because botnets use systematic attack methods, the sequences of malware downloaded by honeypots have particular forms of coordinated pattern. This paper aims to discover new frequent sequential attack patterns in malware automatically. One problem is the difficulty in identifying particular patterns from full yearlong logs because the dataset is too large for individual investigations. This paper proposes the use of a data-mining algorithm to overcome this problem. We implement the PrefixSpan algorithm to analyze malware-attack logs and then show some experimental results. Analysis of these results indicates that botnet attacks can be characterized either by the download times or by the source addresses of the bots. Finally, we use entropy analysis to reveal how frequent sequential patterns are involved in coordinated attacks. Copyright © 2011 The Institute of Electronics, Information and Communication Engineers.
  • Loading...
    Thumbnail Image
    Some of the metrics are blocked by your 
    consent settings
    Item type:Publication,
    A discovery of sequential attack patterns of malware in botnets
    (2010-12-01)
    Rosyid, Nur Rohman
    ;
    Ohrui, Masayuki
    ;
    Kikuchi, Hiroaki
    ;
    Sooraksa, Pitikhate
    ;
    Terada, Masato
    More than 90 independent honeypots have observed malware traffic at the Japanese tier-1 backbone. Typical attacks were made by multiple servers, coordinating to send many kinds of malware. T his paper aims to discover some frequent new sequential attack patterns of malware. It is not easy to identify particular patterns logs of one year because the volume of dataset is too large to investigate one by one. To overcome the problem, this paper proposes data mining algorithm, the PrejixSpan method. We implement the PrejixSpan algorithm to analyze the malware footprints and show the experimental result. The result of analysis shows that the attacks are performed by multiple sequential attack patterns within a short amount of time. ©2010 IEEE.