Ransomware, a class of self-propagating malware that uses encryption to hold the victims' data ransom, has emerged in recent years as one of the most dangerous cyber threats, with widespread damage; e.g., zero-day ransomware WannaCry has caused world-wide catastrophe, from knocking U.K. National Health Service hospitals offline to shutting down a Honda Motor Company in Japan [1]. Our close collaboration with security operations of large enterprises reveals that defense against ransomware relies on tedious analysis from high-volume systems logs of the first few infections. Sandbox analysis of freshly captured malware is also commonplace in operation.We introduce a method to identify and rank the most discriminating ransomware features from a set of ambient (non-attack) system logs and at least one log stream containing both ambient and ransomware behavior. These ranked features reveal a set of malware actions that are produced automatically from system logs, and can help automate tedious manual analysis. We test our approach using WannaCry and two polymorphic samples by producing logs with Cuckoo Sandbox during both ambient, and ambient plus ransomware executions. Our goal is to extract the features of the malware from the logs with only knowledge that malware was present. We compare outputs with a detailed analysis of WannaCry allowing validation of the algorithm's feature extraction and provide analysis of the method's robustness to variations of input data-changing quality/quantity of ambient data and testing polymorphic ransomware. Most notably, our patterns are accurate and unwavering when generated from polymorphic WannaCry copies, on which 63 (of 63 tested) antivirus (AV) products fail.

No abstract

This survey focuses on intrusion detection systems (IDS) that leverage host-based data sources for detecting attacks on enterprise network. The host-based IDS (HIDS) literature is organized by the input data source, presenting targeted sub-surveys of HIDS research leveraging system logs, audit data, Windows Registry, file systems, and program analysis. While system calls are generally included in audit data, several publicly available system call datasets have spawned a flurry of IDS research on this topic, which merits a separate section. To accommodate current researchers, a section giving descriptions of publicly available datasets is included, outlining their characteristics and shortcomings when used for IDS evaluation. Related surveys are organized and described. All sections are accompanied by tables concisely organizing the literature and datasets discussed. Finally, challenges, trends, and broader observations are throughout the survey and in the conclusion along with future directions of IDS research. Overall, this survey was designed to allow easy access to the diverse types of data available on a host for sensing intrusion, the progressions of research using each, and the accessible datasets for prototyping in the area.

No abstract

We have recently reported that a recombinant HIV-1NL4.3 containing Met-to-Ile change at codon 50 of integrase (IN) (IN:M50I) exhibits suppression of the virus release below 0.5% of WT HIV, and the released viral particles are replication-incompetent due to defects in Gag/GagPol processing by inhibition of the initiation of autoprocessing of GagPol polyproteins in the virions and leads to replication-incompetent viruses. The coexisting Ser-to-Asn change at codon 17 of IN or Asn-to-Ser mutation at codon 79 of RNaseH (RH) compensated the defective IN:M50I phenotype, suggesting that both IN and RH regulate an HIV infectability. In the current study, to elucidate a distribution of the three mutations during anti-retroviral therapy among patients, we performed a population analysis using 529 plasma virus RNA sequences obtained through the MiSeq. The result demonstrated that 14 plasma HIVs contained IN:M50I without the compensatory mutations. Comparing the sequences of the 14 viruses with that of the defective virus illustrated that only Val-to-Ile change at codon 151 of IN (IN:V151I) existed in the recombinant virus. This IN:V151I is known as a polymorphic mutation and was derived from HIVNL4.3 backbone. A back-mutation at 151 from Ile-to-Val in the defective virus recovered HIV replication capability, and Western Blotting assay displayed that the back-mutation restored Gag/GagPol processing in viral particles. These results demonstrate that a combination of IN:M50I and IN:V151I mutations, but not IN:M50I alone, produces a defective virus.