Currently, many cyberattacks use the Domain Generation Algorithm (DGA) to generate random domain names, so as to maintain communication with the Communication and Control (C&C) server. Discovering DGA domain names in advance could help to detect attacks and response in time. However, in recent years, the General Data Protection Regulation (GDPR) has been promulgated and implemented, and the method of DGA classification based on the context information, such as the WHOIS (the information about the registered users or assignees of the domain name), is no longer applicable. At the same time, acquiring the DGA algorithm by reversing malware samples encounters the problem of no malware samples for various reasons, such as fileless malware. We propose a DGA domain name classification method based on Long Short-Term Memory (LSTM) with attention mechanism. This method is oriented to the character sequence of the domain name, and it uses the LSTM combined with attention mechanism to construct the DGA domain name classifier to achieve the rapid classification of domain names. The experimental results show that the method has a good classification result.

Recent research shows that executable and linkable format (ELF) malware detection models based on deep learning are vulnerable to adversarial attacks. The most commonly used method in previous work is adversarial training to defend adversarial examples. Nevertheless, it is inefficient and only effective for specific adversarial attacks. Given that the perturbation byte insertion positions of existing adversarial malware generation methods are relatively fixed, we propose a new method to detect adversarial ELF malware. Using model interpretation techniques, we analyze the decision-making basis of the malware detection model and extract the features of adversarial examples. We further use anomaly detection techniques to identify adversarial examples. As an add-on module of the malware detection model, the proposed method does not require modifying the original model and does not need to retrain the model. Evaluating results show that the method can effectively defend the adversarial attacks against the malware detection model.

APT (Advanced Persistent Threat) attacks are developing rapidly and become severe threats nowadays. In this paper, homologous malware mean that they are developed and programmed by the same author or organization. To identify the homology of malware adopted by different APT attacks is conducive to constructing attack scenario, tracking attackers and even defending against new APT attacks. Currently, homology identification still relies on manual analysis and security experts' experience in the anti-malware industry. It is persuasive, but inefficient and time-consuming. In order to improve the effectiveness and efficiency, an automatic malware homology identification method is proposed in this paper. Six types of API (Application Programming Interface) call behaviors are defined according to programming habits, and extracted from the binary samples by static analysis. Based on the API call behaviors, the homologous degree of different malware is calculated using Jaccard similarity coefficient. Then the homology is identified by comparing the homologous degree with a threshold. Experimental evaluations on real-world samples show that this method achieves high accuracy rate and acceptable recall rate.

Jailbreak attacks to Large audio-language models (LALMs) are studied recently, but they exclusively focused on the attack scenario where the adversary can fully manipulate user prompts (named strong adversary) and limited in effectiveness, applicability, and practicability. In this work, we first conduct an extensive evaluation showing that advanced text jailbreak attacks cannot be easily ported to end-to-end LALMs via text-to-speech (TTS) techniques. We then propose AUDIOJAILBREAK, a novel audio jailbreak attack, featuring (1) asynchrony: the jailbreak audios do not need to align with user prompts in the time axis by crafting suffixal jailbreak audios; (2) universality: a single jailbreak perturbation is effective for different prompts by incorporating multiple prompts into the perturbation generation; (3) stealthiness: the malicious intent of jailbreak audios is concealed by proposing various intent concealment strategies; and (4) over-the-air robustness: the jailbreak audios remain effective when being played over the air by incorporating reverberation into the perturbation generation. In contrast, all prior audio jailbreak attacks cannot offer asynchrony, universality, stealthiness, and/or over-the-air robustness. Moreover, AUDIOJAILBREAK is also applicable to a more practical and broader attack scenario where the adversary cannot fully manipulate user prompts (named weak adversary). Extensive experiments with thus far the most LALMs demonstrate the high effectiveness of AUDIOJAILBREAK, in particular, it can jailbreak openAI's GPT-4o-Audio and bypass Meta's Llama-Guard-3 safeguard, in the weak adversary scenario. We highlight that our work peeks into the security implications of audio jailbreak attacks against LALMs, and realistically fosters improving their robustness, especially for the newly proposed weak adversary.

It is a common phenomenon to reuse code from open source code or personal previous work in software/malware development. In addition, compilers often insert many functions when compiling. Therefore, to fast identify these reused functions in binary executables and trace their origins is helpful for reverse engineering, software copyright protection, malware detection and correlation and so on. Much research in recent years has focused on code similarity identification, whereas only a few researchers have addressed the problem of reused function retrieval. In this paper, we proposed a method for fast retrieving reused function in a large corpus of code based on simhash and inverted index. First of all, we constructed a code database including massive binary executables, their functions, the code blocks of functions and the simhash value of code blocks and the inverted index of these elements. Then, for a function to be retrieved, we split it into several code blocks according to the jump instructions and jump addresses, and calculated simhash value for every code block. Similar code blocks could be fast retrieved from the code database based on simhash. Consequently, we could easily retrieve those possibly similar functions using inverted index, and further locate them in binary executables. The experimental evaluation shows that our method achieves high accuracy rate and recall rate, and has a fast speed.