In this technical world, the detection of malware variants is getting cumbersome day by day. Newer variants of malware make it even tougher to detect them. The enormous amount of diversified malware enforced us to stumble on new techniques like machine learning. In this work, we propose an incremental malware detection model for meta-feature API and system call sequence. We represent the host behaviour using a sequence of API calls and system calls. For the creation of sequential system calls, we use NITRSCT (NITR System call Tracer) and for sequential API calls, we generate a list of anomaly scores for each API call sequence using Numenta Hierarchical Temporal Memory (N-HTM). We have converted the API call sequence into six meta-features that narrates its influence. We do the feature selection using a correlation matrix with a heatmap to select the best meta-features. An incremental malware detection model is proposed to decide the label of the binary executable under study. We classify malware samples into their respective types and demonstrated via a case study that, our proposed model can reduce the effort required in STS-Tool(Socio-Technical Security Tool) approach and Abuse case. Theoretical analysis and real-life experiments show that our model is efficient and achieves 95.2% accuracy. The detection speed of our proposed model is 0.03s. We resolve the issue of limited precision and recall while detecting malware. User's requirement is also met by fixing the trade-off between accuracy and speed.
W artykule przedstawiono główne aspekty budowania logicznego punktu styku sieci między dwoma operatorami Voice over IP. Wskazano zalecany zakres negocjacji między operatorami. Zaproponowano kroki, które umożliwiają skuteczną współpracę oraz pozwalają wykrywać nadużycia. Omówiono najważniejsze sposoby zabezpieczania własnej sieci przed niepożądanymi działaniami osób trzecich. Wybrane mechanizmy zostały zbadane w środowisku laboratoryjnym złożonym z dwóch central Asterisk PBX. W artykule przedstawiono wnioski wynikające z tych badań.
EN
The paper presents the main aspects of building a logical point of network interface between two Voice over IP operators. The recommended range of negotiations between operators was indicated. Steps have been proposed to achieve effective cooperation and to detect abuse. The most important ways of protecting own network against unwanted activities of third parties were described. Selected mechanisms have been tested in a laboratory environment composed of two Asterisk PBX switches. The conclusions from these tests were presented in the paper.
JavaScript jest wyłączony w Twojej przeglądarce internetowej. Włącz go, a następnie odśwież stronę, aby móc w pełni z niej korzystać.