Iosif Polenakis

Dept. of Computer Science and Engineering, University of Ioannina

A graph-based model for malware detection and classification using system-call groups

The projects focuses on the developmenta graph-based model that, utilizing relations between groups of System-calls, detects whether an unknown software sample is malicious or benign, and classifies a malicious software to one of a set of known malware families. More precisely, we utilize the System-call Dependency Graphs (or, for short, ScD-graphs), obtained by traces captured through dynamic taint analysis. We design our model to be resistant against strong mutations applying our detection and classification techniques on a weighted directed graph, namely Group Relation Graph, or Gr-graph for short, resulting from ScD-graph after grouping disjoint subsets of its vertices. For the detection process, we propose the \Delta -similarity metric, and for the process of classification, we propose the SaMe-similarity and NP-similarity metrics consisting the SaMe-NP similarity. Finally, we evaluate our model for malware detection and classification showing its potentials against malicious software measuring its detection rates and classification accuracy.

Preventing malware pandemics in mobile devices by establishing response-time bounds

The spread of malicious software among computing devices nowadays poses a major threat to the systems security. Since both the use of mobile devices and the growth of malware propagation increase rapidly, this project focuses in investigating how the time needed by a counter-measure (i.e., an antivirus or a cleaner) to detect and remove a malware from infected devices affects the malware propagation. In this work, we study the effect of counter-measure response-time on the propagation of a malicious software and propose a model for establishing reasonable response-time bounds for its activation in order to prevent pandemic. More precisely, given an initial infected population in a network of mobile devices nd a specific city area (town planning), our model establishes upper response-time bounds for a counter-measure which guarantee that, within a period of time, not all the susceptible devices in the city get infected and the infected ones get sanitized. To this end, we first propose a malware propagation model along with a device mobility model, and then we develop a simulator utilizing these models in order to study the spread of malware in such networks. Finally, we present experimental results for the pandemic prevention taken by our simulator for various response-time intervals and other factors that affect the spread deploying different epidemic models.

Malicious Software Detection and Classification utilizing Temporal Graphs of Discrete and Cummulative Modification

This project focuses on the development of a graph-based model that, utilizing relations between groups of System-calls, distinguishes malicious from benign software samples utilizing a behavioral graph representing their interaction with the operating system. More precisely, given a System-call Dependency Graph (ScDG) that depicts the malware's behavior, we first transform it to a more abstract representation, utilizing the indexing of System-calls to a set of groups of similar functionality, constructing thus a mutation tolerant graph that we call Group Relation Graph (GrG); we pointed out that behavior-based graph representations had not leveraged the aspect of the temporal evolution of the graph. Hence, the novelty of our work is that, preserving the initial representations of GrG graphs, we focus on augmenting the potentials of theses graphs by adding further features that enhance its detection abilities. To that end, we construct periodical instances of the graph that represent its temporal evolution concerning its structural modifications, creating another graph representation that we call Temporal Graphs. In this paper, we present the theoretical background behind our approach, and demonstrate the overall architecture of our proposed detection model alongside with its underlying main principles and its structural key-components.

Graph Theory

The course covers the basic concepts and definitions related to classical writing theory problems. The course also covers a number of applications whose graph modeling is known to lead to an effective solution. The course material studies the following topics: Introduction and basic definitions Graphic illustrations and graph isomorphism Trees - special properties and applications Connectivity, Euler routes and Hamiltonian circles Overlays and matches Clicks and independent sets Node coloring and edge coloring Guided graphs and applications Flat charts and networks General applications.

e-Commerce

E-commerce (electronic commerce) is the activity of electronically buying or selling of products on online services or over the Internet. Electronic commerce draws on technologies such as mobile commerce, electronic funds transfer, supply chain management, Internet marketing, online transaction processing, electronic data interchange (EDI), inventory management systems, and automated data collection systems. E-commerce is in turn driven by the technological advances of the semiconductor industry, and is the largest sector of the electronics industry. Modern electronic commerce typically uses the World Wide Web for at least one part of the transaction's life cycle although it may also use other technologies such as e-mail. Typical e-commerce transactions include the purchase of online books (such as Amazon) and music purchases , and to a less extent, customized/personalized online liquor store inventory services. There are three areas of e-commerce: online retailing, electronic markets, and online auctions. E-commerce is supported by electronic business. This course mainly focuses to explain and deeply integrate the main corpus of the technologies applied in e-commenrse with the adoption of web-app technologies in order to be in place to develop a primarly form of an electronic shop consisted by the adequate procedures demanded for its operation.

Web-app Technologies

The aim of the course is for students after the end to be able to: Understand the operation and development of web-based applications in using the HTTP protocol. To develop web applications with dynamic web creation and access data to databases using Java technologies (JSP, JDBC) or PhP To distinguish server technologies from client technologies and related their advantages. The primary purpose of the course is to acquaint students with the most common technologies applied on the Internet, while at a second but equally important level, if the theoretical background is understood, the use of these technologies by connecting what they have learned to develop throughout the semester a complete internet system. The aim of the laboratory part of the course is to apply the knowledge gained by the students by attending the lecture towards the development of integrated internet systems and the further bridging of the gap with the labor market. This methodology is estimated to contribute on the one hand to the completion of students' knowledge (including knowledge acquired from previous courses) to the development of a system that will combine much of what has been taught before, and on the other hand will provide them with a direct coupling with environments and situations that may be challenged in the job market and which they should be able to manage (eg design failures or implementation errors at an early stage, changes in requirements, etc.), offering students the opportunity (in a protected environment) to deal with the full development of a complete web system. Finally, it is worth noting that the use of Content Management Systems ( CMS) is severely discouraged as, despite being a widely used assistive technology in the development of online services, they deprive students of the opportunity to practice and improve their programming skills, providing them with a a very specific work environment that limits both their technical skills and the range of their personal choices, features that are of major importance to a developer.