Malware analysis is fundamental for defending against prevalent cyber security threats, and requires a means to deploy and study behavioural software traits as more sophisticated malware is developed. Traditionally, virtual machines are used to provide an environment that is isolated from production systems so as to not cause any adverse impact on existing infrastructure. Malware developers are fully aware of this and so will often develop evasion techniques to avoid detection within sandbox environments. In this paper, we conduct an investigation of anti-evasion malware triggers for uncovering malware that may attempt to conceal itself when deployed in a traditional sandbox environment. To facilitate our investigation, we developed a tool called MORRIGU that couples together both automated and human-driven analysis for systematic testing of anti-evasion methods using dynamic sandbox reconfiguration techniques. This is further supported by visualisation methods for performing comparative analysis of system activity when malware is deployed under different sandbox configurations. Our study reveals a variety of anti-evasion traits that are shared amongst different malware families, such as sandbox `wear-and-tear', and Reverse Turing Tests (RTT), as well as more sophisticated malware samples that require multiple anti-evasion checks to be deployed. We also perform a comparative study using Cuckoo sandbox to demonstrate the limitations of adopting only automated analysis tools, to justify the exploratory analysis provided by MORRIGU. By adopting a clearer systematic process for uncovering anti-evasion malware triggers, as supported by tools like MORRIGU, this study helps to further the research of evasive malware analysis so that we can better defend against such future attacks.

Ransomware attacks have rapidly proliferated, inflicting severe financial damages on businesses and individuals. Machine learning approaches to automate ransomware detection have shown promise but grapple with challenges like limited training data. This study introduces a novel deep learning model for few-shot ransomware classification. The model employs entropy features derived directly from malware binaries coupled with a twin neural network architecture utilizing transfer learning. Tests on over 1000 samples across 11 families demonstrate a weighted F1-score of 85.8\%, surpassing existing methods. The approach mitigates biases in limited training data and preserves intricacies lost in image-based features. It exhibits precise classification capabilities even with sparse samples of new ransomware variants. The research highlights the potential of entropy-driven deep learning to equip defenses against emerging zero-day ransomware strains.

In contemporary times, the landscape of malware analysis has advanced into an era of sophisticated threat detection. Today's malware sandboxes not only conduct rudimentary analyses but have evolved to incorporate cutting-edge artificial intelligence and machine learning capabilities. These advancements empower them to discern subtle anomalies and recognize emerging threats with a heightened level of accuracy. Moreover, malware sandboxes have adeptly adapted to counteract evasion tactics, creating a more realistic and challenging environment for malicious entities attempting to detect and evade analysis. This paper delves into the maturation of malware sandbox technology, tracing its progression from basic analysis to the intricate realm of advanced threat hunting. At the core of this evolution is the instrumental role played by malware sandboxes in providing a secure and dynamic environment for the in-depth examination of malicious code, contributing significantly to the ongoing battle against evolving cyber threats. In addressing the ongoing challenges of evasive malware detection, the focus lies on advancing detection mechanisms, leveraging machine learning models, and evolving malware sandboxes to create adaptive environments. Future efforts should prioritize the creation of comprehensive datasets, distinguish between legitimate and malicious evasion techniques, enhance detection of unknown tactics, optimize execution environments, and enable adaptability to zero-day malware through efficient learning mechanisms, thereby fortifying cybersecurity defences against emerging threats.

The rapid proliferation of digital devices and connectivity has seen an unprecedented rise in the threats of cyber-attacks, making cybersecurity a high research priority worldwide. Among the various forms of cyberattacks, malicious software or malware, significantly disrupts the privacy and integrity of data on millions of computing devices globally. It is already a well-established notion that robust malware analysis underpins successful protection systems in the rapidly changing threat landscape. Traditional malware detection techniques, although effective against known malware types, are often found wanting against new and sophisticated varieties. The situation necessitates the exploration of advanced techniques like cryptographic hashing and fuzzy hashing that have proven instrumental in handling malware's dynamic nature. Fuzzy hashing, by allowing a score-based match rather than an exact digital signature, enables the identification of unknown malware that are derivatives of known malwares. However, the efficiency of the fuzzy hashing algorithms comes to the forefront concerning the encryption used. The research paper titled, "Using ASCON-based Fuzzy Hashing for Efficient Malware Analysis," seeks to explore leveraging the ASCON encryption, a lightweight but secure encryption standard, in the application of fuzzy hashing for malware detection.

This paper explores the application of Large Language Models (LLMs), such as GPT-3 and GPT-4, in generating cybersecurity policies and strategies to mitigate ransomware threats, including data theft ransomware. We discuss the strengths and limitations of LLMs for ransomware defense and provide recommendations for effectively leveraging LLMs while ensuring ethical compliance. The key contributions include a quantitative evaluation of LLM-generated policies, an examination of the legal and ethical implications, and an analysis of how LLMs can enhance ransomware resilience when applied judiciously.

Using smartphone especially android platform has already got eighty percent market shares, due to aforementioned report, it becomes attacker’s primary goal. There is a growing number of private data onto smart phones and low safety defense measure, attackers can use multiple way to launch and to attack user’s smartphones.(e.g. Using different coding style to confuse the software of detecting malware). Existing android malware detection methods use multiple features, like safety sensor API, system call, control flow structure and data information flow, then using machine learning to check whether its malware or not. These feature provide app’s unique property and limitation, that is to say, from some perspectives it might suit for some specific attack, but wouldn’t suit for others. Nowadays most malware detection methods use only one aforementioned feature, and these methods mostly analysis to detect code, but facing the influence of malware’s code confusion and zero-day attack, aforementioned feature extraction method may cause wrong judge. So, it’s necessary to design an effective technique analysis to prevent malware. In this paper, we use the importance of word from apk, because of code confusion, some malware attackers only rename variables, if using general static analysis wouldn’t judge correctly, then use these importance value to go through our proposed method to generate picture, finally using convolutional neural network to see whether the apk file is malware or not.

A modern binary executable is a composition of various networks. Control flow graphs are commonly used to represent an executable program in labeled datasets used for classification tasks. Control flow and term representations are widely adopted, but provide only a partial view of program semantics. This study is an empirical analysis of the networks composing malicious binaries in order to provide a complete representation of the structural properties of a program. This is accomplished by the measurement of structural properties of program networks in a malicious binary executable dataset. We demonstrate the presence of Scale-Free properties of network structure for program data dependency and control flow graphs, and show that data dependency graphs also have Small-World structural properties. We show that program data dependency graphs have a degree correlation that is structurally disassortative, and that control flow graphs have a neutral degree assortativity, indicating the use of random graphs to model the structural properties of program control flow graphs would show increased accuracy. By providing an increase in feature resolution within labeled datasets of executable programs we provide a quantitative basis to interpret the results of classifiers trained on CFG graph features. An increase in feature resolution allows for the structural properties of program classes to be analyzed for patterns as well as their component parts. By capturing a complete picture of program graphs we can enable theoretical solutions for the mapping a program's operational semantics to its structure.

Portable Document Format (PDF) is one of the most widely used files types worldwide in data exchange, this has encourage hackers to utilize such files to spread any malicious content through PDF, utilizing different methods and techniques to accomplish that, on the other hand, security researches kept trying to improve detection methods to cope up to the rapidly increasing number of malwares daily, one of the commonly used detection technique nowadays is by utilizing artificial intelligence and Machine learning classificat; thision to help detecting PDF Malwares, in this paper, we utilize machine learning classifier Random Forest on a newly released PDF Malware dataset CIC-Evasive-PDFMal2022 to achieve the main goal of detecting malicious PDF documents, results showing a detection accuracy of around 99.5%

The first appearance of viruses can date back to the late last century. As an effective form of malware, viruses reside in the permanent storage of target hosts. Before a virus can execute, that must load into memory from the persistent storage included in the associated file. Due to the reliable destructive power of viruses, many mechanisms have been developed to defend computer systems against these hazardous threats. Antivirus software is one of the most famous and popular among these mechanisms. Most antivirus software uses static analysis (signature-based) technology on files stored in permanent storage, such as hard disks or USB flashes, to detect viruses hidden in files. Fileless malware was developed to enhance the survivability of malware by circumventing detection. Fileless malware only exists in the target hosts’ memory, not files. Antivirus software cannot even access the fileless malware code, much less analyze it, since it may be performed in memory directly without needing to load it from a disk. As a result, it is difficult for an antivirus engine to defend a system against fileless malware attacks. This paper proposes a kernel-based solution called Check-on-Execution (CoE) to detect fileless malware on a Linux system. When a program is going to execute a piece of code in a writable and executable memory area of a process, CoE suspends the code execution first. Coe retrieves the code from memory, packs the code with an ELF header to create an ELF file, and uses VirusTotal to check the file to prevent a Linux system from executing fileless malware. Experimental results show that CoE noticeably enhances the ability of a Linux system to defend itself again fileless malware. CoE is also suitable for protecting a system from shell code injection attacks, such as buffer and heap overflow attacks. It is capable of handling even packed malware. But in this paper, we only focus on fileless malware.

Technologies providing copyright-infringing IPTV content are a commonly used, as an illegal alternative to legal IPTV subscriptions and services, as they usually have lower monetary costs, and can be more convenient for the users that follow content from different sources. These infringing IPTV technologies may include websites, software, software add-ons, and physical set-top boxes. Due to the free or low cost of illegal IPTV technologies, illicit IPTV content providers will often resort to intrusive advertising, scams, and the distribution of malware to increase their revenue. We developed an automated solution for collecting and analysing malware from illegal IPTV technologies and used it to analyse a sample of illicit IPTV websites, application (app) stores, and software. Our results show that our IPTV Technologies Malware Analysis Framework (IITMAF) classified 32 of the 60 sample URLs tested as malicious, compared to running the same test using publicly available online anti-virus solutions, which only detected 23 of the 60 sample URLs as malicious. Moreover, the IITMAF framework also detected malicious URLs and files from 31 of the sample’s websites, one of which had reported ransomware behaviour.

Zero-day threats are a more severe and constantly developing menace to various participants including large companies, government offices, and educational establishments. These entities may contain valuable information and essential operations that attract cyber attackers. These exploits are especially devastating as they target weaknesses that an organization’s vendors are not even aware of, making them have no protection against them. This paper focuses on the background and use of zero-day exploitation and the structure and technologies of these complex malware attacks. We examine two notable real-life cases: the case of ‘HAFNIUM targeting Exchange Servers with zero-day exploits’ that was investigated by Microsoft 365 Security and Microsoft Threat Intelligence, and the ‘Log4j vulnerability’ case that was reported by the National Cyber Security Centre. These cases show the critical effects of zero-day vulnerabilities and measures taken to combat them. Additionally, this paper outlines different strategies that can be used to prevent zero-day attacks with the help of modern technologies. These are fast patch release, effective IDS/IPS, and a security model that involves constant vigilance and use of behavioral analytics. Thus, by studying the lifecycle of zero-day vulnerabilities and the structure of the exploits, one can enhance the protection of the organization against the threats that are invisible to traditional security systems. This extensive survey is designed to be useful in understanding the characteristics of zero-day vulnerabilities, the technologies for their mitigation, and the constant threat and development in the field of cybersecurity. Thus, it is possible to strengthen the protection against these threats that are constant and develop with time by analyzing the previous events and predicting potential problems.

The proliferation of Internet of Things (IoT) devices on Linux platforms has heightened concerns regarding vulnerability to malware attacks. This paper introduces a novel approach to investigating the behavior of Linux IoT malware by examining syscalls and library syscall wrappers extracted through static analysis of binaries, as opposed to the conventional method of using dynamic analysis for syscall extraction. We rank and categorize Linux system calls based on their security significance, focusing on understanding malware intent without execution.Feature analysis of the assigned syscall categories and risk ranking is conducted with statistical tests to validate their effectiveness and reliability in differentiating between malware and benign binaries. Our findings demonstrate that potential threats can be reliably identified with an F1 score of 96.86%, solely by analyzing syscalls and library syscall wrappers. This method can augment traditional static analysis, providing an effective preemptive measure to enhance Linux malware analysis. This research highlights the importance of static analysis in strengthening IoT systems against emerging malware threats.

A huge number of applications available for Android-based smartphone devices have emerged over the past years. Due to which a huge number of malicious applications has been growing explosively. Many approaches have been proposed to ensure the security and quality of application in the markets. Usually, Machine Learning approaches are utilized in the classification process of malicious application detection. Calculating accurate results of characterizing applications behaviors, or other features, has a direct effect on the results with Machine Learning calculations. Android applications emerge so quickly. The behavior of current applications has gotten progressively malicious. The extraction of malware-infected features from applications is thus become a difficult task. According to our knowledge, a ton of features have been extricated in existing work however no survey has overviewed the features built for identifying malicious applications efficiently. In this paper, we will in general give an extensive review of such sort of work that identifies feature applications by describing various practices of uses with various kinds of features. In this survey we have discussed the following dimensions: extraction and selection of feature methods if any, methods of detection and evaluation performed. In light of our review, we notice the issues of investigating malware-affected features from applications, give the scientific categorization and demonstrate the future headings.

Social networks have captured the attention of many people worldwide. However, these services have also attracted a considerable number of malicious users whose purpose is to compromise digital assets of other members by using messages as an attack vector to execute different variants of cyberattacks against them. Therefore, this work presents an approach based on Natural Language Processing tools and a Convolutional Neural Network architecture to detect and classify, on social network messages, four types of cyberattacks, such as malware, phishing, spam, and even one whose purpose is deceiving the user into spreading malicious messages to other users, which in this work is identified as bot attacks. One notable feature of this work is that it analyzes textual content without depending on any characteristics from a specific social network, making its analysis independent from particular data sources. Finally, this work was tested on real data, demonstrating its results in two stages. The first detects the existence of any of the four cyberattacks within the message, obtaining an accuracy value of 0.91. After detecting a message as a cyberattack, the next stage is to classify it into one of the four types of cyberattack, achieving an accuracy value of 0.82.

Recent years have witnessed a rapid growth of code-reuse attacks in advance persistent threats and cyberspace crimes. Carefully crafted code-reuse exploits circumvent modern protection mechanisms and hijack the execution flow of a program to perform expected functionalities by chaining together existing codes. The sophistication and intrication of code-reuse exploits hinder the scrutinization and dissection on them. Although the previous literature has introduced some feasible approaches, effectiveness and reliability in practical applications remain severe challenges. To address this issue, we propose Horus, a data-driven framework for effective and reliable detection on code-reuse exploits. In order to raise the effectiveness against underlying noises, we comprehensively leverage the strengths of time-series and frequency-domain analysis, and propose a learning-based detector that synthesizes the contemporary twofold features. Then we employ a lightweight interpreter to speculatively and tentatively translate the suspicious bytes to open the black box and enhance the reliability and interpretability. Additionally, a functionality-preserving data augmentation is adopted to increase the diversity of limited training data and raise the generality for real-world deployment. Comparative experiments and ablation studies are conducted on a dataset composed of real-world instances to verify and prove the prevalence of Horus. The experimental results illustrate that Horus outperform existing methods on the identification of code-reuse exploits from data stream with an acceptable overhead. Horus does not rely on any dynamic executions and can be easily integrated into existing defense systems. Moreover, Horus is able to provide tentative interpretations about attack semantics irrespective of target program, which further improve system's effectiveness and reliability.

Smartphone devices, particularly android devices used by billions of people everywhere in the world. Similarly, this increasing rate attracts mobile botnet attackers that is a network of interconnected nodes operated by command and control (C&C) method to expand malicious activities. At present, mobile botnet attacks carried Distributed denial of services (DDoS) that causes to steal sensitive data, remote access, spam generation, etc. Consequently, various approaches are defined in the literature to detect mobile botnet using static or dynamic analysis. In this paper, we have proposed a novel hybrid model, which is a combination of static and dynamic method that relies on machine learning to identify android botnet applications having C&C capability. The results evaluated through machine learning classifiers in which Random forest classifier outperform other ML techniques, i.e. Naïve Bayes, Support Vector Machine, and Simple logistics. Our proposed framework can achieve 97.48% accuracy in detecting such harmful applications. Furthermore, we highlight some research directions and possible solutions regarding botnet attacks for the entire community.

Background: Cyber Security is to protect online data and software from cyber threats. These cyberattacks are typically intended to gain access to, change, or delete sensitive information; extort money from users; or disrupt regular corporate activities. It is difficult to keep up a regular follow up with new technologies so it is necessary to keep the important data safe from cyber threats. There are many types of cyber threats; malware, ransom-ware, social engineering, phishing etc. To prevent cyber-attacks one can use password manager tools like LastPass and others. People also use two factor authentication for double security on their accounts. Methods: Boards such as the National Institute of Standards and Technology (NIST) are developing frameworks to assist firms in understanding their security risks, improving cybersecurity procedures, and preventing cyber assaults. The fight against cybercrimes and attack, rganisations needed a strong base there are 5 types of cyber securities; Critical Infrastructure Security, application security, network security, cloud security and (IoT) Security. In the modern time US is highly based on computers and on different software so it is really important for US to be more conscious about the security as they get many threats almost everyday for hacking their data and accounts.Results and Conclusion: Nowadays, even small businesses rarely recover their loss from the cyber-attacks and many back-off from continuing their businesses after being target of hackers. The first cybercrime attack was recorded on 1988 by a graduate student. Now that large companies and even small businesses are aware of cyber-attacks so they try their best to take every precaution to prevent the hacking with double security and password manager tools.

N-shot learning has emerge in recent year as potential learning approach to solve the problem of data scarcity by learning underlying pattern from a few training sample. Despite recent state-of-the-art research on model-agnostic metal learning, transfer learning, and optimization strategy to rapidly learn valid information from few sample, there remains a big challenge on an actual out-of-distribution zero-day without any similarity to previously known malware family or new variant of an existing malware family. This ultimately questions the effectiveness of current state-of-the-art few-shot learning approach. In this research, we did an in-depth investigation into the performance of state-of-the-art Zero-shot, Single-shot, and few-shot learning approaches on zero-day out-of-distribution malware attack detection based on their static properties using Malimg and Malevis malware dataset. We ensure our model was aware of an out-of-distribution class during training while varying the number of samples in the out-of-distribution class accordingly zero-shot(no sample), single-shot (1 sample), few-shot(5 samples) while using confusion matrix to get the actual number of correct prediction on out-of-distribution malware validation samples. we assert that the model should be smart enough to detect and classify previously unseen data into an empty family as an out-of-distribution considering that the model was made to be aware of the existence of such distribution during training. Result shows 0, 0, and 3 correct out-of-distribution predictions on Zero-shot, single-shot, and few-shot experiments respectively, thereby showing limitation of the current state-of-the-art N-shot approaches on out-of-distribution attack.

Cybercrime Threat Intelligence (CTI) allows us to change our actions from reactive to proactive in the fight against threat actors, and to make more informed, data-driven security decisions. Thus this study proposes the practical implementation of CTI in the Arab world. This study focuses on strengthening CTI by integrating Indicators of Compromise (IoCs) and collecting realistic security alerts from honeypot systems and open source intelligence. The collected data is stored in the Malware Information Sharing Platform (MISP), an open source platform that allows users to create and share IoCs with other organizations while staying informed about new threats. It features an intuitive interface for data analysis and threat identification, facilitating sharing, storage, and correlation of IoCs. Therefore, we leveraged MISP to generate IoCs based on the collected data and analyzed the results to identify potential cyber threats. The implemented platform aims to provide organizations with actionable information to prevent, detect and respond to cybercrime. This study presents a practical approach to strengthening CTI in the Arab world and provides an opportunity to strengthen the region’s security posture.

Malware complexity is rapidly increasing, causing catastrophic impacts on computer systems. Memory dump malware is gaining increased attention due to its ability to expose plaintext passwords or key encryption files. This paper presents an enhanced classification model based on One class SVM (OCSVM) classifier that can identify any deviation from the normal memory dump file patterns and detect it as malware. The proposed model integrates OCSVM and Principal Component Analysis (PCA) for increased model sensitivity and efficiency. An up-to-date dataset known as “MALMEMANALYSIS-2022” was utilized during the evaluation phase of this study. The accuracy achieved by the traditional one-class classification (TOCC) model was 55%, compared to 99.4% in the one-class classification with PCA (OCC-PCA) model. Such results have confirmed the increased performance achieved by the proposed model.

To secure computers and information systems from attackers taking advantage of vulnerabilities in the system to commit cybercrime, several methods have been proposed for real-time detection of vulnerabilities to improve security around information systems. Of all the proposed methods, machine learning had been the most effective method in securing a system with capabilities ranging from early detection of software vulnerabilities to real-time detection of ongoing compromise in a system. As there are different types of cyberattacks, each of the existing state-of-the-art machine learning models depends on different algorithms for training which also impact their suitability for detection of a particular type of cyberattack. In this research, we analyzed each of the current state-of-theart machine learning models for different types of cyberattack detection from the past 10 years with a major emphasis on the most recent works for comparative study to identify the knowledge gap where work is still needed to be done with regard to detection of each category of cyberattack

Malicious apps specifically aimed at the Android platform have increased in tandem with the proliferation of mobile devices. Malware is now so carefully written that it is difficult to detect. Due to the exponential growth in malware, manual methods of malware are increasingly ineffec-tive. Although prior writers have proposed numerous high-quality approaches, static and dy-namic assessments inherently necessitate intricate procedures. The obfuscation methods used by modern malware are incredibly complex and clever. As a result, it cannot be detected using only static malware analysis. As a result, this work presents a hybrid analysis approach, partially tai-lored for multiple-feature data, for identifying Android malware and classifying malware families to improve Android malware detection and classification. This paper offers a hybrid method that combines static and dynamic malware analysis to give a full view of the threat. Three distinct phases make up the framework proposed in this research. Normalization and feature extraction procedures are used in the first phase of pre-processing. Both static and dynamic features undergo feature selection in the second phase. Two feature selection strategies are proposed to choose the best subset of features to use for both static and dynamic features. The third phase involves ap-plying a newly proposed detection model to classify android apps; this model uses a neural net-work optimized with an improved version of HHO. Application of binary and multi-class classi-fication is used, with binary classification for benign and malware apps and multi-class classifica-tion for detecting malware categories and families. By utilizing the features gleaned from static and dynamic malware analysis, several machine-learning methods are used for malware classifi-cation. According to the results of the experiments, the hybrid approach improves the accuracy of detection and classification of Android malware compared to the scenario when considering static and dynamic information separately.

Portable Document Format (PDF) files are one of the most universally used file types. This has fascinated hackers to develop methods to use these normally innocent PDF files to create security threats via infection vectors PDF files. This is usually realized by hiding embedded malicious code in the victims’ PDF documents to infect their machines. This, of course, results in PDF Malware and requires techniques to identify benign files from malicious files. Research studies indicated that machine-learning methods provide efficient detection techniques against such malware. In this paper, we present a new detection system that can analyze PDF documents in order to identify benign PFD files from malware PFD files. The proposed system makes use of the AdaBoost decision tree with optimal hyperparameters, which is trained and evaluated on a modern-inclusive dataset, viz. Evasive-PDFMal2022. The investigational assessment demonstrates a lightweight-accurate PDF detection system, achieving a 98.84% prediction accuracy with a short prediction interval of 2.174 μSec. To this end, the proposed model outperforms other state-of-the-art models in the same study area. Hence, the proposed system can be effectively utilized to uncover PDF malware at high detection performance and low detection overhead.

Machine learning (ML) is changing cybersecurity by enabling progressed discovery, anticipation and reaction instruments. This paper gives a comprehensive survey of ML's part in cybersecurity, looking at both hypothetical systems and down to earth usage. It diagrams the rising dangers focusing on ML models, such as ill-disposed assaults, information harming and show reversal assaults and examines state-of-the-art defense procedures, counting ill-disposed preparing, vigorous models and differential protection. Furthermore, the paper investigates different ML applications in cybersecurity from interruption location to malware classification, highlighting their affect on improving security measures. An peculiarity induction calculation is proposed for the early discovery of cyber-intrusions at the substations. Cybersecurity has ended up a imperative investigate range. The paper concludes with a discourse on the key inquire about bearings and best hones for making secure and versatile ML frameworks in a data-driven world. This paper dives into how Machine Learning (ML) revolutionizes cybersecurity, enabling progressed discovery, avoidance, and reaction components. It offers a exhaustive investigation of ML's urgent part in cybersecurity, enveloping hypothetical systems and viable applications. It addresses rising dangers like ill-disposed assaults and information harming, nearby cutting-edge defense techniques such as antagonistic preparing and strong models.

The emergence of few-shot learning as a potential approach to address the problem of data scarcity by learning underlying pattern from a few training sample had so far given a mix-result especially on the suitability of model-agnostic meta learning, transfer learning, and optimization strategy to rapidly learn valid information from few sample. In this research, we did an in-depth evaluation of meta- learning to determine their plausibility and suitability for previously unknown cyberattack detection by first retrieving the original research artifacts of current state of the art meta learning to repeat the experiment with original dataset before replicating the experiment with two different malware dataset which had not been previously done with meta-transfer learning. On each of the experiments, meta-transfer learning gave good results on digital character recognition dataset but abysmal result on Malimg and Malevis malware images datasets thereby indicating its unreliability for detecting cyberattacks and the need for an improvement to the state-of-the-art meta transfer learning towards a better attack detection. Transfer learning performance is independent on imbalance and hence does not influence its performance since both malware dataset used for this experiment result in high validation loss and balancing the dataset doesn't result in reduced validation loss,the successful learning transfer seen on digital character recognition dataset is not unconnected to the fact that several languages have similar characters and digits thereby enhancing the successful learning transfer unlike malware datasets, and more importantly the finding that current meta-learning transfer approach doesn't generalize well on malware dataset and hence not suitable for detecting previously unseen out-of-distribution attack.

Currently, the Bangladeshi financial sector is undergoing significant transformations. With the expansion of the infrastructure and the increasing prevalence of digital banking services, it is essential to take measures to prevent cyberattacks. These threats can be effectively mitigated through the utilization of deep learning and machine learning techniques. Through the analysis of massive amounts of banking data in real-time, these methods make it possible to detect and prevent malicious software, fraud, and security breaches that are proactive. Because the government is actively pushing for financial inclusion and digitalization, strong cybersecurity measures are more important than they have ever been. It is the purpose of this study to investigate the application of deep learning and machine learning to improve the cybersecurity environment of Bangladesh’s banking sector in light of the country’s rapidly expanding digital economy.

Malware detection is a crucial pillar of cybersecurity and aims to identify and neutralize malware threats. This study investigates how three deep learning algorithms - Convolutional Neural Net-works with One-Dimensional Architecture (CNN1D), Neural Networks (NN), and a hybrid model of one dimensional convolutional neural networks (CNN1D) and Long Short-Term Memory (LSTM) - help detect malware in Portable Executable working (.exe) files. Using a large dataset of tagged malware and benign samples, the effectiveness of these algorithms in distinguishing dangerous from harmless executables is extensively tested. In addition, the study evaluates the computational efficiency of the proposed methods for a variety of hardware configurations, including Central Processing Units (CPU), Graphics Processing Units (GPU), Raspberry Pi (IoT device), and Tensor Processing Units (TPU). Performance metrics provide insight into the scalability and effectiveness of the model across different hardware configurations. The results of this study have significant impact on the development of malware detection, particularly in the context of IoT security. By demonstrating the capabilities and limitations of CNN1D, Neural Networks, and CNN1D with LSTM models, the study provides practitioners with efficient and scalable solutions to real-world malware detection difficulties. In addition, insights from performance tests on various hardware platforms provide important assistance in developing robust security measures in IoT contexts, strengthening cybersecurity defenses in an ever-changing digital landscape.

Mobile devices have become tools we spend our free time where we carry them with us every moment, they allow us to interact with the environment, we immortalize the moment when necessary. These devices which we spend most of our daily life become very common in recent years and even there are unique business areas emerged. It was announced that the number of people using smartphones is over than 2.5 billion in the first quarter of 2016. As people become more addicted to mobile technology, they become the target of malevolent people. A huge increase in the number of mobile malware is observed as the number of the users increase. Billions of users at risk day by day due to the development of the methods. We have addressed the recent methods used and the types of malware that target mobile devices in our study. We have mentioned the proxy server and reverse proxy server operation logic. We discuss the method of turning mobile devices into reverse proxy servers, risks involved and protection methods.