English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Sophisticated malware authors can sneak hidden malicious code into portableexecutable files, and this code can be hard to detect, especially if encryptedor compressed. However, when an executable file switches between code regimes(e.g. native, encrypted, compressed, text, and padding), there arecorresponding shifts in the file's representation as an entropy signal. In thispaper, we develop a method for automatically quantifying the extent to whichpatterned variations in a file's entropy signal make it "suspicious." InExperiment 1, we use wavelet transforms to define a Suspiciously StructuredEntropic Change Score (SSECS), a scalar feature that quantifies thesuspiciousness of a file based on its distribution of entropic energy acrossmultiple levels of spatial resolution. Based on this single feature, it waspossible to raise predictive accuracy on a malware detection task from 50.0% to68.7%, even though the single feature was applied to a heterogeneous corpus ofmalware discovered "in the wild." In Experiment 2, we describe howwavelet-based decompositions of software entropy can be applied to a parasiticmalware detection task involving large numbers of samples and features. Byextracting only string and entropy features (with wavelet decompositions) fromsoftware samples, we are able to obtain almost 99% detection of parasiticmalware with fewer than 1% false positives on good files. Moreover, theaddition of wavelet-based features uniformly improved detection performanceacross plausible false positive rates, both in a strings-only model (e.g., from80.90% to 82.97%) and a strings-plus-entropy model (e.g. from 92.10% to 94.74%,and from 98.63% to 98.90%). Overall, wavelet decomposition of software entropycan be useful for machine learning models for detecting malware based onextracting millions of features from executable files.

Wavelet decomposition of software entropy reveals symptoms of malicious code