Abstract:Threat actors intent on gaining access to a network often choose file-based exploits because they can be easily and reliably delivered to intended targets. These actors often use the most common, critical protocols such as email, web, and social media as delivery vectors, and target widespread and critical applications. Wholesale blocks on those protocols or file types would cripple legitimate business activity and is generally not an option for network defenders. To defeat intrusions, defenders must be able to detect malicious files wherever they exist either transiting a network or stored on disk. There are a multitude of malware analysis tools and reverse engineering resources available to analyze malicious code, but these work best in one-off, isolated conditions and are not capable of real-time processing. As a result, most security teams have to manage a disparate set of analysis tools with different capabilities. This inefficient solution presents a frustration for many defenders: being able to detect malware in a lab, but not able to scale that approach to successfully detect malware and defend an enterprise. Most intrusion detection systems are focused primarily on the medium they monitor (e.g. networkbased, host-based). The medium-centric approach normalizes all collection, logging, and alerting around the medium. File features with all their different formats, data structures, and metadata are left as secondary concerns, or worse, neglected altogether. Furthermore, files often encapsulate other files, embed related objects, or have format-specific encodings which need to be deconstructed to identify the underlying characteristics. A modular approach to file analysis enables such an understanding. We propose a filecentric intrusion detection approach, allowing connectors to various network and endpoint devices which can disassociate the medium and any file encapsulation. A file-centric intrusion detection system, therefore, will scalably interpret, parse, and normalize files to expose malicious characteristics.

Can You Accept LaTeX Files from Strangers? Ten Years Later

Exploitation and Sanitization of Hidden Data in PDF Files

Security Attacks on LLM-based Code Completion Tools

On the Abuse and Detection of Polyglot Files

PDF-Malware: An Overview on Threats, Detection and Evasion Attacks

Hiding Malicious Content in PDF Documents

From Text to MITRE Techniques: Exploring the Malicious Use of Large Language Models for Generating Cyber Attack Payloads

Unveiling A Hidden Risk: Exposing Educational but Malicious Repositories in GitHub

Understanding EdTech's Privacy and Security Issues: Understanding the Perception and Awareness of Education Technologies' Privacy and Security Issues

Laika BOSS : Scalable File-Centric Malware Analysis and Intrusion Detection System

RatGPT: Turning online LLMs into Proxies for Malware Attacks

Transforming Computer Security and Public Trust Through the Exploration of Fine-Tuning Large Language Models

No . NOTTCS-TR-2005-1 Firewalls , Intrusion Detection Systems and Anti-Virus Scanners

Robust PDF Files Forensics Using Coding Style

LLM-Resistant Math Word Problem Generation via Adversarial Attacks

ColdPress: An Extensible Malware Analysis Platform for Threat Intelligence

A Study of Malware Prevention in Linux Distributions

Static detection of malicious JavaScript-bearing PDF documents

Anomalicious: Automated Detection of Anomalous and Potentially Malicious Commits on GitHub

Read Over the Lines: Attacking LLMs and Toxicity Detection Systems with ASCII Art to Mask Profanity

Adversarial Malware Examples for Terminal Cyberspace Attack Analysis in Cyber-Physical Power Systems