Recently, person identification has been a prerequisite in many applications of the Internet of Things. As a new biometric identification technology, gait recognition has a wide application prospect with the advantages of long-distance recognition and difficulty to forge. However, the existing gait recognition methods have some problems, such as complex algorithm calculation, high user participation, and large equipment overhead. In this paper, we propose RF-Gait, a method that identifies a person through unobtrusive gait perception with COTS RFID. The key insight is that wireless signal fluctuation can be exploited to distinguish each person’s unique gait behavior. To this end, we first collect and preprocess the gait-induced data composed of multiple RFID tags. Furthermore, multivariate variational mode decomposition is utilized to extract the intrinsic features in the spatial multichannels cooperatively. By developing a support vector machine model, we identify a person via the intrinsic walking pattern. Finally, extensive experiments show that our method can identify a person with an average accuracy of 96.3% from a group of twenty persons in a complex indoor environment.

Because of the rapid increasing of malware, one of the main challenges in malware detection is how to do malware classification automatically. Although there are many automatic classification methods recently, their results still get high false positive rate. Since the base number of malware samples is huge, a very small false positive can cause a big number of false alarms. Essentially, high false positive rate is usually caused by the adoption of obfuscation and evasion technology by malware. As a result, one or more features would be disguised. In this paper, we propose one method using multi-features to mitigate the effect of disguised features. Through this method, each kind of features is extracted independently, and used to train one classifier respectively. The system adopts the prediction if and only if the output of each classifier is the same. To test our method, we use both static and dynamic features to classify 282 samples. The experiment result shows that this method could improve the accuracy of malware classification and achieve nearly no false positive.

In view of the great threat posed by malware and the rapid growing trend about malware variants, it is necessary to determine the category of new samples accurately for further analysis and taking appropriate countermeasures. The network behavior based classification methods have become more popular now. However, the behavior profiling models they used usually only depict partial network behavior of samples or require specific traffic selection in advance, which may lead to adverse effects on categorizing advanced malware with complex activities. In this paper, to overcome the shortages of traditional models, we raise a comprehensive behavior model for profiling the behavior of malware network activities. And we also propose a corresponding malware classification method which can extract and compare the major behavior of samples. The experimental and comparison results not only demonstrate our method can categorize samples accurately in both criteria, but also prove the advantage of our profiling model to two other approaches in accuracy performance, especially under scenario based criteria.

Nowadays, most botnets utilize domain generation algorithms (DGAs) to build resilient and agile command and control (C&C) channels. Specifically, botmasters employ DGAs to dynamically produce a large number of random domains and only register a small subset for their actual C&C servers with the purpose to defend them from takeovers and blacklisting attempts. While many approaches and models have been developed to detect DGA-based botnets, they suffer from several limitations, such as difficulties of DNS traffic collection, low feasibility and scalability, and so forth. In this paper, we present BotCensor, a new system that can determine if a host is infected with certain DGA malware with two-stage anomaly detection. In the first stage, we preliminarily attempt to identify malicious domains using a Markov model, and in the second stage, we re-examine the hosts that requested aforementioned malicious domains using novelty detection algorithms. Our experimental results show that our approach performs very well on identifying previously unknown DGA-generated domains and detects DGA bots with high efficiency and efficacy. Our approach not only can be regarded as security forensics tools, but also can be used to prevent malware infections and spread.

In order to evade the detection of mobile security products, Android malware has become more and more complex, meanwhile, new variants grow rapidly. Facing variant malware, traditional detection methods ignore the complex interrelationships between Apps, and the purity of the detection is insufficient, hence cannot accurately and efficiently detect their complex behaviors, even difficult to detect. To combat the evolving Android malware attacks, we proposed method HeterSupervise which can analyze Android malware from an essential perspective. Firstly, We extracting various static and dynamic features from Apps using HSandroguard. To model different types of entities (i.e., code regions, sensitive API, package, signature) and rich relations among them, we present a heterogeneous graph for modeling. Secondly, in order to get the feature representation of each node, we design the HGN-embedding method to obtain the embedding of nodes belong to different types. Thirdly, we build HG-CNN classifiers based on various typical CNNs to detect unknown Android Apps. We integrate the above methods as a system Heter-Supervisor. Comprehensive experiments show that HeterSupervisor achieves more than 97% accuracy, and outperforms the state-of-the-art methods in efficiency with 60% improvement.