Multi-computer malware detection systems with metamorphic functionality

The subject matter of the article is methods and technologies of ensuring the cybersecurity of industrial and web-oriented systems and networks, training of cybersecurity specialists during the acquisition of professional knowledge. The purpose of the article is to ensure the cybersecurity of industrial and web-oriented systems and networks by developing and implementing appropriate methodologies (concepts, principles, set of models, methods) and technologies in the industry, as well as in training the cybersecurity specialists during the acquisition of professional knowledge. The problem of developing models, methods, and technologies for ensuring the cybersecurity of mobile systems, web-oriented systems based on content management systems, virtual networks that provide their interaction, and a methodology for training cybersecurity specialists are formulated. Based on the analysis the particular tasks of developing convolutional neural network model, information technology methods and models for ensuring the cybersecurity of web-oriented systems and networks, a methodological framework of creating information technology, and a model of digital knowledge platform for use in the field of cybersecurity specialists training and security of industrial systems were formulated. The basic theoretical decisions, which underlie the construction of real industrial and web-oriented systems and networks, were described in the article. The results of work are increased reliability value of detecting the malware in the Android operating system, reduced rates of false positives, provided an allowable value of the success rate of attacks at a minimum cost, reduced time spent on building and rebuilding the structure of the virtual network, increased efficiency of cybersecurity specialists training and security of industrial systems. From the above, it is possible to conclude that the obtained results can be used in a line of existing and prospective approaches at designing difficult, complex, hybrid, technical, cyber-physical systems with a web-oriented interface for users and administrators.

The paper presents methods for organizing decision-making and the functioning of deceptive multi-computer systems based on prior operational experience and multiple task execution options. A formal representation of system components and their interconnections is developed, distinguishing between the system center and the decision-making controller. The system center prepares possible task execution options, while the decision-making controller evaluates these options considering past performance and selects one. Analytical expressions are proposed to describe processes within multi-computer systems, enabling autonomous decision-making in task execution. A method is developed for organizing the decision-making controller’s operation to ensure the selection of a task option based on prior experience, component security levels, and system topology. This approach allows for the formation of polymorphic responses to external and internal actions in corporate networks. Additionally, a method for organizing system functioning enables systems to adapt their properties, structure, and interconnections in response to functional and cybersecurity conditions. This can be used especially in cybersecurity of critical infrastructure systems like electrical power grids, smart grid infrastructure, energy plants and industrial control systems. A prototype was developed and tested under two scenarios: choosing among five task options and having only one option. Results showed greater operational stability in the first case, confirming that incorporating prior experience enhances resilience and creates polymorphic responses that hinder attackers’ attempts to study and exploit corporate networks.

Independent restructuring of the architecture of multicomputer systems during their operation is a complex task, since such systems are distributed. One of the tasks in this restructuring is to change the architecture of system centers. That is, the system can be rebuilt without changes in its center. But the specifics of the tasks of systems for detecting malicious software and computer attacks require such an organization of systems that it is difficult for attackers to understand their behavior. Therefore, the current task considered in the work is the development of rules for ensuring the restructuring of system centers according to different types of architecture. The aim of the work is to develop criteria for evaluating potential options for centralization in the architecture of multicomputer systems with traps and decoys. To ensure such an assessment, the work analyzed known solutions and established the insufficiency of mathematical support for organizing the restructuring of system centers during their operation. Taking into account the specifics of the tasks for such systems, no parameters were determined that could be taken into account for the formation of the restructuring of system centers. The analyzed works establish the main types of centralization used in the architecture of systems: centralized, partially centralized, partially decentralized, decentralized. However, algorithms and methods for the transition of systems from one type to another in the process of their functioning are not provided. Subject. The work defines characteristic properties that can be used when synthesizing systems. They determine the number of potential variants of the system architecture to which it will switch at the next step when making a decision on restructuring the architecture. With an increase in the number of characteristic properties, the number of possible variants will increase. When approving the variants for the transition, it was necessary to evaluate them taking into account the previous experience of the systems' functioning. To evaluate potential centralization variants in the architecture of systems, evaluation criteria were developed. A feature of the evaluation criteria is that according to them, it is possible to take into account the experience of using the centralization variant in the case of repetition and evaluate the prepared variants that are offered for the first time. That is, the evaluation criteria include the previous experience of the functioning of multi-computer systems. This experience made it possible to evaluate the repeated option based on the results of its previous use. This made it possible to diversify the choice of system centers. Methods. The work developed an objective function for evaluating the next centralization option in the system architecture. The objective function takes into account four evaluation criteria for operational efficiency, stability, integrity and security. All these criteria are focused on evaluating potential options for system centers. New mathematical models were developed for the criteria for operational efficiency, stability, integrity and security in relation to the system center, which, unlike the known mathematical models for evaluating system centers for selecting the next options for centralization, are presented in analytical expressions that take into account the features of the types of centralization in the system architecture, indicators of operational efficiency, stability, integrity and security in relation to the system center and allow forming on their basis an objective function for evaluating options for centralization in systems, the feature of which is the hiding of components with the system center from detection by attackers. Results. The work analyzed the results of an experiment conducted with a prototype of the system. The convergence of the experimental results and the results obtained by the theoretical method has been established. Conclusion. The study introduces mathematical models for evaluating system centers based on operational efficiency, stability, integrity, and security criteria. Unlike existing models, these are presented as analytical expressions that account for various centralization types within system architectures. The models enable the creation of objective functions to evaluate centralization options, emphasizing the concealment of system center components from attackers. Experimental results with a system prototype confirm the theoretical models' validity, showing minimal deviations in function graphs. Significant deviations in specific time intervals are addressed to achieve optimal centralization options.

The paper presents an approach for the metamorphic viruses detec- tion based on its obfuscation features analysis. The obfuscation features were obtained on the basis of the equivalent functional block search in the suspicious program and its modified version. The results of the research demonstrated that the efficiency of metamorphic viruses detection based on the proposed obfusca- tion quantitative features depends on the choice of the similarity metric at the stages of the search and the choice refinement of the equivalent functional blocks. The adequate choice of similarity metrics at both stages allowed in- creasing the detection efficiency of the metamorphic viruses.

The paper presents a method for a malware’s signature generation based on API call tracing. Technique allows malware detection using a pro- posed form of signature. The main idea of proposed signature generation is a difference between frequency and interaction of a critical API calls performed by malicious program and benign applications in the process of their own exe- cution. Accordingly the program's behavior signature based on API call tracing consists of two components: the call frequency and the nature of the interaction of critical API calls. An analysis of the first component allows determining the distribution of the critical API calls by groups concerning theirs malicious ac- tivity and displays the quantitative component of the signature. An analysis of the second component of the signature provides an opportunity to distinguish malware from benign applications not only in the presence of critical API calls, but also in their interaction with each other. The experimental results showed that the effectiveness of the malware detection using proposed signatures is up to 96.56%.