As cyber attacks grow more complex and sophisticated, new types of malware become more dangerous and challenging to detect. In particular, fileless malware injects malicious code into the physical memory directly without leaving attack traces on disk files. This type of attack is well concealed, and it is difficult to find the malicious code in the static files. For malicious processes in memory, signature-based detection methods are becoming increasingly ineffective. Facing these challenges, this paper proposes a malware detection approach based on convolutional neural network and memory forensics. As the malware has many symmetric features, the saved training model can detect malicious code with symmetric features. The method includes collecting executable static malicious and benign samples, running the collected samples in a sandbox, and building a dataset of portable executables in memory through memory forensics. When a process is running, not all the program content is loaded into memory, so binary fragments are utilized for malware analysis instead of the entire portable executable (PE) files. PE file fragments are selected with different lengths and locations. We conducted several experiments on the produced dataset to test our model. The PE file with 4096 bytes of header fragment has the highest accuracy. We achieved a prediction accuracy of up to 97.48%. Moreover, an example of fileless attack is illustrated at the end of the paper. The results show that the proposed method can detect malicious codes effectively, especially the fileless attack. Its accuracy is better than that of common machine learning methods.

Randomized encryption techniques, where randomness is used for security enhancement, are considered. We focus on the case where the encrypted data experiences noise, e.g., is transmitted over a noisy channel, within the encoding-encryption paradigm, where the data is first encoded for error correction, before being encrypted for security. We assume that the ciphertext is subject to a corruption equivalent to its transmission through a binary symmetric channel with known probability of error. The enhanced security is based on a dedicated wire-tap channel coding that introduces extra randomness, combined with that of the communication channel noise. The encryption is based on a block-by-block modulo 2 addition between an encoded message vector and a pseudorandom vector. The goal is to enhance the protection of the secret key employed in the encryption algorithm. Security evaluations of the model are performed employing an information-theoretic approach. Assuming both a passive and an active attacker, we show that there is a threshold before which the wire-tap encoder guarantees an information-theoretic security (during which the equivocation of the secret key is increased), and after which the uncertainty reduces, entering a regime in which a computational security analysis is needed for estimating the complexity resistance against the secret key recovery.

This paper proposes an approach for pool mining in public blockchain systems based on the employment of a recently reported consensus protocol with the puzzle based on a symmetric encryption that provides an energy–space trade-off and reduces energy consumption. The proposed architecture employs a pseudo-symmetric allocation of the resources for the blockchain consensus protocol and provides protection against certain malicious actions of the pool members, as well as a miner’s opportunity for selecting the resources required for participation in the consensus protocol. Given that the considered consensus protocol employs two resources, the proposed architecture uses this two-dimensional nature to provide resistance against block withholding and selfish mining attacks, as well as a reduction in energy spending as a trade-off with the employment of certain memory resources. The high resistance of the proposed pool mining approach against the considered attacks appears to be a consequence of the success probability of the pool in comparison with the success probability of malicious miners. Assuming appropriate selection of the puzzle hardness, the probability that malicious miners can solve the puzzle without the support of the pool manager can be arbitrarily small. Implementation of the proposed approach on a modified Ethereum platform and experimental evaluation issues have also been reported. The conceptual novelty of the proposed pool mining approach is the following: Instead of separation of the blockchain consensus protocol and control of pool miners honest work, this paper proposes an approach where honest work of miners and pool managers is provided by a dedicated application of the considered consensus protocol. Advantages of the proposal in comparison with the previously reported ones include the following: (i) high resistance against block withholding and selfish mining attacks without an additional security procedure; (ii) reduction in the energy required, and at the same time preservationthe security of the consensus protocol; (iii) flexibility of the pool miners regarding selection of the resources that should be employed providing a trade-off between required energy and memory resources. The proposed architecture was implemented employing a dedicated modification of the Ethereum platform and the performed experiments confirmed the feasibility and effectiveness of the proposal.

This paper considers the problem of data access control when the subscribers are IoT devices with initialization that cannot be updated during the entire life cycle. A generic framework and a particular instance for conditional data access control within IoT are proposed. The generic framework is based on the employment of a dedicated secret key-based broadcast encryption scheme where encrypted credentials for conditional data access is available in the blockchain and encrypted data subject to conditional access are available in an off-chain source of streaming data. Reduction of the keys management overhead in comparison with a straightforward decryption keys delivery is experimentally illustrated. An instance of the proposed framework built over the Ethereum blockchain platform is developed and experimentally evaluated.