Gary Warner

Malicious software, universally known as malware, is typically used to cause disruption as it tries to steal sensitive information such as passwords, credit card numbers and other pertinent information. Malware infections have increased tremendously over the last decade. Recent reports indicate that around 70% of malware infections go undetected by the antivirus software. The infections that remain undetected fall into the category of zero-day malware, which is defined as malware that is new and is essentially an undiscovered and undisclosed threat. Furthermore, its substructure or the functioning has not been understood, and no signatures have been defined to distinguish the zero-day malware from others. Moreover, an average enterprise receives 17,000 malware alerts per week, and if 70% goes undetected, then one is certain to be infected by the zero-day malware every week. Therefore, the low detection rates and increasing vulnerabilities have created an unmet need for the researchers to try and develop an algorithm that will help in timely and efficient detection of malware. Moreover, in our approach researchers used the cloud for malware detection, which is a safe, cost-effective and user-friendly environment.

Retrieval of images with object-of-interest from a vast pool of social media images has been a research interest in cyber crime research community for detecting criminal behaviors in social media. Due to inherent diversity and the low duplicate property of images on social media, it brings forth many challenges in image retrieval, especially in identifying distinct features for a given object-of-interest. Previous literature approached this problem with extended General Hough Transform, where Hough space is analyzed for each specific object-of-interest. Different objects of interest produce different types of patterns in Hough space and no unified framework can be easily established to incorporate all those patterns. In this paper, we propose a unified framework based on convolutional neural network (CNN) for classifying the social media images and retrieving the images based on the probability score from the softmax classifier. In our framework, a reduced size CNN model is trained by distilling the knowledge from a pretrained full size CNN model, which is suitable for applications with limited training data such as ours and results in a higher accuracy in image retrieval as well as better performance in execution speed in comparison with the full size CNN model. Experiments on three image datasets relating to suspicious e-crime and terrorist involvement - Guy Fawkes masks, credit card logos, and ISIS logos show that our framework outperforms extended General Hough Transform and the full size CNN model.

Using object-of-interest matching to detect presence of e-Crime activities in low-duplicate social media images is an interesting yet challenging problem that involves many complications due to the dataset's inherent diversity. SURF-based (Speeded Up Robust Features) object matching, though claimed to be scale and rotation invariant, is not effective as expected in this domain. This paper approaches this problem by an extended paradigm of Generalized Hough Transform using shape matching applied to two types of object-of-interest, Guy Fawkes Mask and Credit Card. We propose an extended GHT that updates the best matching score and the sum up score simultaneously, combined with a face detector and circular magnitude ranker, for detecting Guy Fawkes; also proposed is an extended GHT capable of mining the directional property in Hough space, combined with optical character recognition and an edge density filter, for detecting credit cards. Experiments on two real world datasets indicate that our approach outperforms the baseline GHT and the SURF.

Spam researchers and security personnel require a method for determining whether the URLs embedded in email messages are safe or potentially hostile. Prior research has been focused on spam collections that are quite insignificant compared to real-world spam volumes. In this paper, researchers evaluate 464 million URLs representing nearly 1 million unique domains observed in email messages in a six day period from November 2014. Four methods of customization and randomization of URLs believed to be used by spammers to attempt to increase deliverability of their URLs are explored: domain diversity, hostname wild-carding, path uniqueness, and attribute uniqueness. Implications of the findings suggest improvements for “URL blacklist” methods, methods of sampling to decrease the number of URLs that must be reviewed for safety, as well as presenting some challenges to the ICANN, Registrar, and Email Safety communities.

Since the number of potential malicious URLs from diverse sources is large, URL deduplication is needed for the efficient identification of malicious websites. URL Deduplication-as-a-Service (UDaaS) was developed to help a URL analyst to deploy and manage a cloud-based distributed and parallel URL deduplication infrastructure easily, this can improve the performance of malicious websites detection while reducing duplication and quantity of local storage requirements.

URL blacklisting is a widely used technique for blocking phishing websites. To prepare an effective blacklist, it is necessary to analyze possible threats and include the identified malicious sites in the blacklist. Spam emails are good source for acquiring suspected phishing websites. However, the number of URLs gathered from spam emails is quite large. Fetching and analyzing the content of this large number of websites are very expensive tasks given limited computing and storage resources. Moreover, a high percentage of URLs extracted from spam emails refer to the same website. Hence, preserving the contents of all the websites causes significant storage waste. To solve the problem of massive computing and storage resource requirements, we propose and develop CURLA - a Cloud-based spam URL Analyzer, built on top of Amazon Elastic Computer Cloud (EC2) and Amazon Simple Queue Service (SQS). CURLA allows processing large number of spam-based URLs in parallel, which reduces the cost of establishing equally capable local infrastructure. Our system builds a database of unique spam-based URLs and accumulates the content of these unique websites in a central repository, which can be later used for phishing or other counterfeit websites detection. We show the effectiveness of our proposed architecture using real-life spam-based URL data.

The static analysis of malwares at UAB starts with the receipt of about 5000 malwares each day. One of our goals is to cluster these malwares into families. Each malware is an executable. For processing, we represent each malware by the set of printable strings that it contains. A method we have pursued to cluster malwares into families starts with the data mining technique of generating frequent itemsets. It is difficult to generate frequent itemsets at low support thresholds, which is what our application demands. This paper discusses our successful efforts to overcome this barrier of low support threshold.

The most common approach to collect users' secret credentials from phishing websites is to email the credentials to criminals' email addresses which we call drop email addresses. We propose a clustering algorithm, which is based on the assumption that if there is a common drop email address found in the phishing kits from two different phishing websites, then these two websites are directly related. Based on obfuscated and plain-text drop email addresses, we produce two types of clusters: one is called phishing kit creator cluster and another is kit user cluster. Clustering related phishing websites using our proposed approach will allow phishing investigators to focus their investigative efforts on important phishing attacks rather than random attacks. For example, in January 2013, 1475 phishing websites are hosted by only 317 groups of phishers (who we will call kit users). Our scheme will thus help investigators to narrow investigation to pervasive phishing criminals. By analyzing the clusters generated using our clustering approach, we can determine the strongest and most pervasive phishers, and phishing kit creators, relationships between phishing kit creators and phishing kit users, and the most dominant phisher of one group. These findings have real-life implication in phishing investigation paradigm.

Social learning theories, such as differential association theory, state that criminals develop deviant behaviors and learn the tools of their trade through close association with other deviants. This case study examines a group of 99 email addresses found to be using the same PayPal phishing kit. It uses Open Source Intelligence techniques to determine potential relationships between the holders of these email addresses. The results are then discussed in light of differential association theory to determine the extent to which this theory may aid in the understanding of cybercrime.