Full Chapter Advances in Computer Communication and Computational Sciences Proceedings of Ic4S 2019 Sanjiv K Bhatia PDF
Full Chapter Advances in Computer Communication and Computational Sciences Proceedings of Ic4S 2019 Sanjiv K Bhatia PDF
Full Chapter Advances in Computer Communication and Computational Sciences Proceedings of Ic4S 2019 Sanjiv K Bhatia PDF
https://textbookfull.com/product/advances-in-computer-
communication-and-computational-sciences-proceedings-of-
ic4s-2018-sanjiv-k-bhatia/
https://textbookfull.com/product/advances-in-computer-
communication-and-computational-sciences-proceedings-of-
ic4s-2017-volume-1-sanjiv-k-bhatia/
https://textbookfull.com/product/advances-in-communication-and-
computational-technology-select-proceedings-of-
icacct-2019-gurdeep-singh-hura/
https://textbookfull.com/product/advances-in-computational-
intelligence-and-communication-technology-proceedings-of-
cict-2019-xiao-zhi-gao/
Advances in Information Communication Technology and
Computing Proceedings of AICTC 2019 Vishal Goar
https://textbookfull.com/product/advances-in-information-
communication-technology-and-computing-proceedings-of-
aictc-2019-vishal-goar/
https://textbookfull.com/product/advances-in-vlsi-communication-
and-signal-processing-select-proceedings-of-vcas-2019-david-
harvey/
https://textbookfull.com/product/advances-in-computer-vision-
proceedings-of-the-2019-computer-vision-conference-cvc-
volume-1-kohei-arai/
https://textbookfull.com/product/advances-in-structural-
engineering-select-proceedings-of-face-2019-k-v-l-subramaniam/
https://textbookfull.com/product/advances-in-ic-engines-and-
combustion-technology-select-proceedings-of-ncicec-2019-ashwani-
k-gupta/
Advances in Intelligent Systems and Computing 1158
Advances in
Computer,
Communication
and Computational
Sciences
Proceedings of IC4S 2019
Advances in Intelligent Systems and Computing
Volume 1158
Series Editor
Janusz Kacprzyk, Systems Research Institute, Polish Academy of Sciences,
Warsaw, Poland
Advisory Editors
Nikhil R. Pal, Indian Statistical Institute, Kolkata, India
Rafael Bello Perez, Faculty of Mathematics, Physics and Computing,
Universidad Central de Las Villas, Santa Clara, Cuba
Emilio S. Corchado, University of Salamanca, Salamanca, Spain
Hani Hagras, School of Computer Science and Electronic Engineering,
University of Essex, Colchester, UK
László T. Kóczy, Department of Automation, Széchenyi István University,
Gyor, Hungary
Vladik Kreinovich, Department of Computer Science, University of Texas
at El Paso, El Paso, TX, USA
Chin-Teng Lin, Department of Electrical Engineering, National Chiao
Tung University, Hsinchu, Taiwan
Jie Lu, Faculty of Engineering and Information Technology,
University of Technology Sydney, Sydney, NSW, Australia
Patricia Melin, Graduate Program of Computer Science, Tijuana Institute
of Technology, Tijuana, Mexico
Nadia Nedjah, Department of Electronics Engineering, University of Rio de Janeiro,
Rio de Janeiro, Brazil
Ngoc Thanh Nguyen , Faculty of Computer Science and Management,
Wrocław University of Technology, Wrocław, Poland
Jun Wang, Department of Mechanical and Automation Engineering,
The Chinese University of Hong Kong, Shatin, Hong Kong
The series “Advances in Intelligent Systems and Computing” contains publications
on theory, applications, and design methods of Intelligent Systems and Intelligent
Computing. Virtually all disciplines such as engineering, natural sciences, computer
and information science, ICT, economics, business, e-commerce, environment,
healthcare, life science are covered. The list of topics spans all the areas of modern
intelligent systems and computing such as: computational intelligence, soft comput-
ing including neural networks, fuzzy systems, evolutionary computing and the fusion
of these paradigms, social intelligence, ambient intelligence, computational neuro-
science, artificial life, virtual worlds and society, cognitive science and systems,
Perception and Vision, DNA and immune based systems, self-organizing and
adaptive systems, e-Learning and teaching, human-centered and human-centric
computing, recommender systems, intelligent control, robotics and mechatronics
including human-machine teaming, knowledge-based paradigms, learning para-
digms, machine ethics, intelligent data analysis, knowledge management, intelligent
agents, intelligent decision making and support, intelligent network security, trust
management, interactive entertainment, Web intelligence and multimedia.
The publications within “Advances in Intelligent Systems and Computing” are
primarily proceedings of important conferences, symposia and congresses. They
cover significant recent developments in the field, both of a foundational and
applicable character. An important characteristic feature of the series is the short
publication time and world-wide distribution. This permits a rapid and broad
dissemination of research results.
** Indexing: The books of this series are submitted to ISI Proceedings,
EI-Compendex, DBLP, SCOPUS, Google Scholar and Springerlink **
K. K. Mishra
Editors
Advances in Computer,
Communication
and Computational Sciences
Proceedings of IC4S 2019
123
Editors
Sanjiv K. Bhatia Shailesh Tiwari
Department of Mathematics Computer Science Engineering Department
and Computer Science ABES Engineering College
University of Missouri–St. Louis Ghaziabad, Uttar Pradesh, India
Chesterfield, MO, USA
Munesh Chandra Trivedi
Su Ruidan National Institute of Technology Agartala
Shanghai Advanced Research Institute Agartala, Tripura, India
Pudong, China
K. K. Mishra
Computer Science Engineering Department
Motilal Nehru National Institute
of Technology
Allahabad, Uttar Pradesh, India
This Springer imprint is published by the registered company Springer Nature Singapore Pte Ltd.
The registered company address is: 152 Beach Road, #21-01/04 Gateway East, Singapore 189721,
Singapore
Preface
v
vi Preface
of these reviews, 91 high-quality papers were selected for publication in this pro-
ceedings volume, with an acceptance rate of 18.57%.
We are thankful to the keynote speakers—Prof. Shyi-Ming Chen, IEEE Fellow,
IET Fellow, IFSA Fellow, Chair Professor in National Taiwan University of
Science and Technology, Taiwan, and Prof. Maode Ma, IET Fellow, Nanyang
Technological University, Singapore, to enlighten the participants with their
knowledge and insights. We are also thankful to delegates and the authors for their
participation and their interest in IC4S 2019 as a platform to share their ideas and
innovation. We are also thankful to the Prof. Dr. Janusz Kacprzyk, Series Editor,
AISC, Springer, for providing guidance and support. Also, we extend our heartfelt
gratitude to the reviewers and Technical Program Committee Members for showing
their concern and efforts in the review process. We are indeed thankful to everyone
directly or indirectly associated with the conference organizing team leading it
towards the success.
Although utmost care has been taken in compilation and editing, however, a few
errors may still occur. We request the participants to bear with such errors and
lapses (if any). We wish you all the best.
Editors
Bangkok, Thailand Sanjiv K. Bhatia
Shailesh Tiwari
Munesh Chandra Trivedi
K. K. Mishra
About This Book
With advent of technology, intelligent and soft computing techniques came into
existence with a wide scope of implementation in engineering sciences. Nowadays,
technology is changing with a speedy pace and innovative proposals that solve the
engineering problems intelligently are gaining popularity and advantages over the
conventional solutions to these problems. It is very important for research com-
munity to track the latest advancements in the field of computer sciences. Keeping
this ideology in preference, this book includes the insights that reflect the Advances
in Computer and Computational Sciences from upcoming researchers and leading
academicians across the globe. It contains the high-quality peer-reviewed papers of
‘International Conference on Computer, Communication and Computational
Sciences (IC4S-2019)’, held during 11–12 October 2019 at Mandarin Hotel
Bangkok, Bangkok, Thailand. These papers are arranged in the form of chapters.
The content of this book is divided into five broader tracks that cover variety of
topics. These tracks are: Advanced Communications and Security, Intelligent
Hardware and Software Design, Intelligent Computing Techniques, Web and
Informatics and Intelligent Image Processing. This book helps the perspective
readers’ from computer and communication industry and academia to derive the
immediate surroundings developments in the field of communication and computer
sciences and shape them into real-life applications.
vii
Contents
ix
x Contents
xvii
xviii About the Editors
1 Introduction
2 Related Work
it has first been reported as malicious and added to the malicious signature repos-
itory. Moreover, static-based detection is also ineffective against code obfuscation,
high variant output and targeted attacks [2]. Furthermore, static-based detection is
not an effective stand-alone approach to detect crypto-ransomware. Therefore, past
researcher has reviewed on crypto-ransomware characteristics and developed few
detection methods in order to overcome mitigation of crypto-ransomware [6].
Shaukat and Ribeiro proposed RansomWall [7], a cryptographic-ransomware-
layered defense scheme. It follows a mixture of static and dynamic analysis strategy
to produce a new compact set of features characterizing the behavior of crypto-
ransomware. This can be accomplished when initial RansomWall layers tag a process
for suspected crypto-ransomware behavior, and process-modified files are backed
up for user data preservation until they have been categorized as crypto-ransomware
or benign. On the other hand, behavioral-based detection methods are based on
detecting mass file encryption where it could be effective however may come at
a resource-intensive cost; this is because the file entropy needs to be calculated
for every single write operation executed by an application [2]. In addition, these
operations need to track file operations for each file separately over the life span of
an observed process. Hence, such an approach may considerably deteriorate disk
read and write performance and result in a high system load. Besides that, detecting
crypto-ransomware by analyzing the file rename operations to identify ransom-like
file names or extensions may work on simple crypto-ransomware, but will not work on
more intelligently written crypto-ransomware such as CryptXXX which randomizes
the file name or Spore which retains the original file name. Consequently, this will
lead the model to produce a high false-positive rate.
Azmoodeh et al. suggested a solution [8] that uses a strategy based on machine
learning to identify crypto-ransomware attacks by tracking android device energy
usage. In particular, it has been suggested that technique tracks the energy consump-
tion patterns of distinct procedures to classify non-malicious apps for crypto-
ransomware. However, the use of energy consumption to detect crypto-ransomware
can trigger a significant false negative indicating that a crypto-ransomware is not
identified and marked as a non-malicious application [2]. Typically, this could occur
because crypto-ransomware developers are aware of data transformation analysis
techniques that have been known to use simple tricks to mask the presence of mass
file encryption [2]. Nevertheless, the use of energy consumption to detect crypto-
ransomware can also set off a notable false positive, whereby benign application such
as Web browsers uses high system resource which could lead the model to indicating
benign application is identified and marked as a malicious application.
Sgandurra et al. proposed EldeRan [9], a dynamically analyzing and classifying
machine learning approach for crypto-ransomware. EldeRan observes a set of actions
applied in their first phase of installation to check for crypto-ransomware character-
istics. In addition, EldeRan operates without needing a complete family of crypto-
ransomware to be accessible in advance. EldeRan, however, has some limitations.
The first limitation addresses the analysis and identification of crypto-ransomware
samples that have been silent for some duration or are waiting for a trigger action
done by the user. Hence, EldeRan does not properly extract their features; this is due
6 M. Kakavand et al.
3 Objectives
leading to deteriorating the disk read and write performance. In summary, the objec-
tive is to produce a classification algorithm with the practical approach for feature
representation that is able to distinguish the crypto-ransomware family with a low
computational cost.
8 M. Kakavand et al.
4 Methodology
This section describes the approaches will be taken to achieve the proposed solution.
Moreover, this section intends to describe and show the relationship between the
various work activities that are performed during this research. Furthermore, the
expected result from these activities will also be listed here.
The crypto-ransomware and goodware dataset were obtained from [11] which consist
of 100 working samples of 10 distinct classes of ransomware and 100 benign
applications. The crypto-ransomware samples are gathered to represent the most
common versions and variations presently found in the wild. Furthermore, each
crypto-ransomware is grouped together into a well-established family name, as there
are several discrepancies between the naming policies of anti-virus (AV) suppliers,
and therefore it is not simple to obtain a common name for each ransomware family.
This segment highlights the approaches used by the data preprocessing module to
transform the raw information into a comprehensible format in order to support
toward this research framework. Furthermore, three data preprocessing approaches
will be utilized in this research. Generally, it is possible to consider all binary files
as a series of ones and zeros. As shown in Fig. 1, the first method is to convert each
android application package to binary. After that, the binary file will be converted to
hexadecimal code. Moreover, during this process the data has retained the original
integrity of the application. In line with our knowledge, the reason for using binary to
hexadecimal conversion is to reduce the code complexity as shown in Fig. 2, which
will be effective toward the next stage of the transfiguring image conversion process.
In this process, the hexadecimal code content of the string is extracted into 6 char-
acters which refers to 6 characters for every unit. Now knowing each unit as 6
characters, it is possible to take their unit as indicators of a two-dimensional color
map that stores RGB values that match the particular unit. Furthermore, repeating
this process for each unit allows me to get a sequence of RGB values (pixel values)
A Novel Crypto-Ransomware Family Classification Based … 9
from the stage 1 preprocessed file. Next, we have transformed this series of pixel
values into a two-dimensional matrix, which will be used in image transfiguration
process resulting in an RGB picture representation. Besides, Fig. 3 shows the width
of the image output is set to 510; however, the height image is set to be dynamic
based on the hexadecimal to dynamic image transfiguration algorithm. The reason
for setting the width of the image static and the height of the image dynamic is to
create a standard baseline feature dimension.
From this part of the analysis, we found out there is a frequent amount of the
unique pattern appearing in the images corresponding to each crypto-ransomware
family. Moreover, this statement can be proved in Fig. 4. Besides as we further dive
into analyzing the crypto-ransomware family, we have discovered a complication
whereby all the crypto-ransomware family image dimensions are not standardized.
Furthermore, this complication will affect the convolution neural network model,
whereby the model will assign inequal weight toward the stage 2 preprocessed images
which will cause the loss function in the model to increase leading to bad predic-
tions. In addition, general approaches to manipulate the images such as center crop,
squashing or padding will not work toward this research dataset. This is because the
images will be losing a significant number of important features and this will lead
to bad classification. Therefore, in this research we have developed an algorithm
which solves the problem faced by stage 2 preprocessed images. The algorithm will
be explained in depth in the next stage of data preprocessing.
10 M. Kakavand et al.
In this process, we have used the created algorithm known as “horizontal feature
simplification (HFS)” to further preprocess the images produced by stage 2 data
preprocessing. Moreover, the main condition for horizontal feature simplification is
the width of the image should be fixed. The rule is applied because if the image does
A Novel Crypto-Ransomware Family Classification Based … 11
Fig. 4 Hexadecimal code to dynamic image transfiguration output for WannaLocker ransomware
variant
not have a fixed number of features, it will cause the images to be not normalized
leading bad prediction toward this research. If the condition meets the algorithm,
then it will be executed. As shown in Fig. 5, the first process will be converting
the stage 2 preprocessed image to two-dimensional plane array to extract each row
pixel vector. Next, SimHash algorithm with a prime number hash bit is used to a
Fig. 6 Horizontal feature simplification output for Koler ransomware variant output
create coordinate corresponding to row pixel vector, whereby the algorithm takes
each row vector, passes through a segment, then acquires effective feature vectors
and weighs each set of feature vectors (if a row pixel vector is given, then the feature
vector is the pixels in the image and the weight is the number of times the pixel
may appear). Furthermore, DJB2 algorithm with a prime number hash bit is used
to produce 26-bit hash value which will be utilized to create an RGB color pixel.
Besides, if there is a collision between two-row pixel vectors, then the RGB colors
will be added together in order to maintain the integrity of the image. In summary,
horizontal feature simplification will create a static image dimension which will be
used in the convolution neural network model to create unbiased weight distribution
in order to produce a better classification model.
In this part, we will be analyzing HFS data output. From this part of the analysis,
we found out there is still a frequent amount of unique pattern appearing in the
images corresponding to each crypto-ransomware family even after the images been
preprocessed from stage 2 to stage 3. Furthermore, this statement can be proved
from Fig. 6. Besides, number pixel density per image is increased 5% due to using
prime numbers for SimHash and DJB2 algorithm hash bits compared to non-prime
numbers. Therefore, the number of characteristics in an image also increases, causing
the classification model to produce a higher-quality prediction.
Mr. Spedding was a man who thought quickly. Ideas and plans came
to him as dross and diamonds come to the man at the sorting table,
and he had the faculty of selection. He saw the police system of
England as only the police themselves saw it, and he had an open
mind upon Angel’s action. It was within the bounds of possibility that
Angel had acted with full authority; it was equally possible that Angel
was bluffing.
Mr. Spedding had two courses before him, and they were both
desperate; but he must be sure in how, so far, his immediate liberty
depended upon the whim of a deputy-assistant-commissioner of
police.
Angel had mentioned a supreme authority. It was characteristic of
Spedding that he should walk into a mine to see how far the fuse
had burned. In other words, he hailed the first cab, and drove to the
House of Commons.
The Right Honorable George Chandler Middleborough, His Majesty’s
Secretary of State for Home Affairs, is a notoriously inaccessible
man; but he makes exceptions, and such an exception he made in
favor of Spedding. For eminent solicitors do not come down to the
House at ten o’clock in the evening to gratify an idle curiosity, or to
be shown over the House, or beg patronage and interest; and when
a business card is marked “most urgent,” and that card stands for a
staple representative of an important profession, the request for an
interview is not easily refused.
Spedding was shown into the minister’s room, and the Home
Secretary rose with a smile. He knew Mr. Spedding by sight, and had
once dined in his company.
“Er—” he began, looking at the card in his hand, “what can I do for
you—at this hour?” he smiled again.
“I have called to see you in the matter of the late—er—Mr. Reale.”
He saw and watched the minister’s face. Beyond looking a little
puzzled, the Home Secretary made no sign.
“Good!” thought Spedding, and breathed with more freedom.
“I’m afraid——” said the minister. He got no further, for Spedding
was at once humility, apology, and embarrassment.
What! had the Home Secretary not received his letter? A letter
dealing with the estate of Reale? You can imagine the distress and
vexation on Mr. Spedding’s face as he spoke of the criminal
carelessness of his clerk, his attitude of helplessness, his recognition
of the absolute impossibility of discussing the matter until the
Secretary had received the letter, and his withdrawal, leaving behind
him a sympathetic minister of State who would have been pleased—
would have been delighted, my dear sir, to have helped Mr.
Spedding if he’d received the letter in time to consider its contents.
Mr. Spedding was an inventive genius, and it might have been in
reference to him that the motherhood of invention was first identified
with dire necessity.
Out again in the courtyard, Spedding found a cab that carried him to
his club.
“Angel bluffed!” he reflected with an inward smile. “My friend, you are
risking that nice appointment of yours.”
He smiled again, for it occurred to him that his risk was the greater.
“Two millions!” he murmured. “It is worth it: I could do a great deal
with two millions.”
He got down at his club, and tendered the cabman the legal fare to a
penny.
CHAPTER XI
THE QUEST OF THE BOOK