tsfresh

tsfresh このリポジトリには、 TSFRESH Python パッケージが含まれています。この略称は、次の意味を表します。 "Time Series Feature extraction based on scalable hypothesis tests". このパッケージは、統計学、時系列解析、信号処理、非線形力学からの確立されたアルゴリズムと、堅牢な特徴選択アルゴリズムを組み合わせることで、体系的な時系列特徴抽出を提供します。この文脈では、 時系列 という用語は可能な限り広い意味で解釈され、あらゆる種類のサンプリングデータやイベントシーケンスさえも特徴付けることができます。...

neto

Project Neto: 브라우저 플러그인 분석 도구 키트 개요 Project Neto는 Firefox 및 Chrome과 같은 잘 알려진 브라우저의 플러그인 및 확장 기능의 숨겨진 기능을 분석하고 파헤치기 위해 고안된 Python 3 패키지입니다. 패키지된 파일의 압축을 풀고 manifest.json, 지역화 폴더 또는 Javascript 및 HTML 소스 파일과 같은 확장 기능의 관련 리소스에서 이러한 기능을 추출하는 과정을 자동화합니다. 설치 패키지를 설치하려면 pip3를 사용할 수 있습니다. pip3 install -e...

AndroPyTool

AndroPyTool 업데이트! DroidBox 이미지가 수정되었습니다. 동적 분석이 이제 작동합니다. Android APK에서 정적 및 동적 특징을 추출하기 위한 도구입니다. DroidBox, FlowDroid, Strace, AndroGuard 또는 VirusTotal 분석과 같은 잘 알려진 Android 앱 분석 도구들을 결합합니다. APK 파일이 포함된 소스 디렉토리를 제공하면 AndroPyTool이 이러한 모든 도구를 적용하여 사전 정적, 정적 및 동적 분석을 수행하고 JSON 및 CSV 형식의 특징 파일을 생성하며 ...

Topological Signatures of Cyber-Attack Classes in Natural Visibility Graph Representations of Network Traffic

Natural Visibility Graph NVG-based representations provide a promising approach for capturing structural patterns in sequential network traffic. However, whether different cyber-attack classes exhibit distinctive topological signatures in such representations remains insufficiently understood. Th...

NetSecBed: A Container-Native Testbed for Reproducible Cybersecurity Experimentation

Cybersecurity research increasingly depends on reproducible evidence, such as traffic traces, logs, and labeled datasets, yet most public datasets remain static and offer limited support for controlled re-execution and traceability, especially in heterogeneous multi-protocol environments. This...

Context-Aware Phishing Email Detection Using Machine Learning and NLP

Phishing attacks remain among the most prevalent cybersecurity threats, causing significant financial losses for individuals and organizations worldwide. This paper presents a machine learning-based phishing email detection system that analyzes email body content using natural language processing...

MH-1M: A 1.34 Million-Sample Comprehensive Multi-Feature Android Malware Dataset for Machine Learning, Deep Learning, Large Language Models, and Threat Intelligence Research

We present MH-1M, one of the most comprehensive and up-to-date datasets for advanced Android malware research. The dataset comprises 1,340,515 applications, encompassing a wide range of features and extensive metadata. To ensure accurate malware classification, we employ the VirusTotal API,...

SAND: A Self-Supervised and Adaptive NAS-Driven Framework for Hardware Trojan Detection

The globalized semiconductor supply chain has made Hardware Trojans HT a significant security threat to embedded systems, necessitating the design of efficient and adaptable detection mechanisms. Despite promising machine learning-based HT detection techniques in the literature, they suffer from ...

EUVD-2015-2202

Malware in sbrugna...

Feature-Centric Approaches to Android Malware Analysis: a Survey

Sophisticated malware families exploit the openness of the Android platform to infiltrate IoT networks, enabling large-scale disruption, data exfiltration, and denial-of-service attacks. This systematic literature review SLR examines cutting-edge approaches to Android malware analysis with direct...

Quantum AI Algorithm Development for Enhanced Cybersecurity: a Hybrid Approach to Malware Detection

This study explores the application of quantum machine learning QML algorithms to enhance cybersecurity threat detection, particularly in the classification of malware and intrusion detection within high-dimensional datasets. Classical machine learning approaches encounter limitations when dealin...

Evaluating Diverse Feature Extraction Techniques of Multifaceted IoT Malware Analysis: a Survey

As IoT devices continue to proliferate, their reliability is increasingly constrained by security concerns. In response, researchers have developed diverse malware analysis techniques to detect and classify IoT malware. These techniques typically rely on extracting features at different levels fr...

MambaITD: an Efficient Cross-Modal Mamba Network for Insider Threat Detection

Enterprises are facing increasing risks of insider threats, while existing detection methods are unable to effectively address these challenges due to reasons such as insufficient temporal dynamic feature modeling, computational efficiency and real-time bottlenecks and cross-modal information...

PotentRegion4MalDetect: Advanced Features from Potential Malicious Regions for Malware Detection

Malware developers exploit the fact that most detection models focus on the entire binary to extract the feature rather than on the regions of potential maliciousness. Therefore, they reverse engineer a benign binary and inject malicious code into it. This obfuscation technique circumvents the...

OpCode-Based Malware Classification Using Machine Learning and Deep Learning Techniques

This technical report presents a comprehensive analysis of malware classification using OpCode sequences. Two distinct approaches are evaluated: traditional machine learning using n-gram analysis with Support Vector Machine SVM, K-Nearest Neighbors KNN, and Decision Tree classifiers; and a deep...

graduation_design

This is a Python script for a web intrusion detection system using machine learning. The script uses the scikit-learn library to implement a supervised learning approach. It collects and preprocesses normal requests and attack payloads, and uses a Support Vector Machine SVM to classify new reques...

PEpper - An Open Source Script To Perform Malware Static Analysis On Portable Executable

An open source tool to perform malware static analysis on P ortable E xecutable Installation eva@paradise:$ git clone https://github.com/Th3Hurrican3/PEpper/ eva@paradise:$ cd PEpper eva@paradise:$ pip3 install -r requirements.txt eva@paradise:$ python3 pepper.py ./malwaredir Screenshot...

Clustering App Attacks with Machine Learning Part 2: Calculating Distance

In our previous post in this series we discussed our motivation to cluster attacks on apps, the data we used and how we enriched it by extracting more meaningful features out of the raw data. We talked about the many features that can be extracted from IP and URL. In this blog post we’ll discuss...

Revoke-Obfuscation - PowerShell Obfuscation Detection Framework

Revoke-Obfuscation is a PowerShell v3.0+ compatible PowerShell obfuscation detection framework. Authors Daniel Bohannon @danielhbohannon Lee Holmes @LeeHomes Research Blog Post: https://www.fireeye.com/blog/threat-research/2017/07/revoke-obfuscation-powershell.html White Paper:...

PowerShell Obfuscation Detection Framework: Revoke-Obfuscation

Revoke-Obfuscation is an open-source PowerShell v3.0+ framework for detecting obfuscated PowerShell commands and scripts at scale. It relies on PowerShell’s AST Abstract Syntax Tree to rapidly extract thousands of features from any input PowerShell script and compare this feature vector against o...