Revealing MageCart-like Threats in Favicons via Artificial Intelligence

An increasing volume of malicious software exploits information hiding techniques to cloak additional attack stages or bypass frameworks enforcing security. This trend has intensified with the growing diffusion of mobile ecosystems, and many threat actors now conceal scripts or configuration data within high-resolution icons. Even if machine learning has proven to be effective in detecting various hidden payloads, modern mobile scenarios pose further challenges in terms of scalability and privacy. In fact, applications can be retrieved from multiple stores or directly from the Web or social media. Therefore, this paper introduces an approach based on federated learning to reveal information hidden in high-resolution icons bundled with mobile applications. Specifically, multiple nodes are used to mitigate the impact of different privacy regulations, the lack of comprehensive datasets, or the computational burden arising from distributed stores and unofficial repositories. Results collected through simulations indicate that our approach achieves performances similar to those of centralized blueprints. Moreover, federated learning demonstrated its effectiveness in coping with simple “obfuscation” schemes like Base64 encoding and zip compression used by attackers to avoid detection.

show abstract

Revealing MageCart-like Threats in Favicons via Artificial Intelligence

Cited by 5 publications

References 21 publications

Federated Learning for the Efficient Detection of Steganographic Threats Hidden in Image Icons

Federated Learning for the Efficient Detection of Steganographic Threats Hidden in Image Icons

Enhancing Incident Management by an Improved Understanding of Data Exfiltration: Definition, Evaluation, Review

A federated approach for detecting data hidden in icons of mobile applications delivered via web and multiple stores

Contact Info

Product

Resources

About