Deep Learning (DL) has become a dominant approach in malware detection, often favored for its ability to capture complex patterns. However, this study highlights a critical issue: simple non-deep learning models, such as One-Rule and AdaBoost, perform surprisingly well on several state-of-the-art malware detection datasets, achieving results comparable to those of more complex models, including LightGBM and DL approaches like FastAI’s Tabular Learner. Rather than suggesting that simple models are inherently superior, our findings indicate that a small subset of features often dominates the classification process, allowing models to achieve high accuracy with only a small fraction of the feature space. This behavior appears to be closely tied to the limited variability in some feature values across academic datasets. Across the eleven datasets that we analyze, classification scores reach above 99
Artificial intelligence has become crucial in routine tasks in the last few years. It is widely adopted in finance, the risk industry, and computer science. In the latter, Intelligent Systems has recently become necessary in cybersecurity to identify malicious actions attackers perform due to the inefficiency of the previous signature-based methodologies. To effectively use an AI-trained model, having a high-quality dataset is essential, representing one of the most critical challenges. In some cases, the amount of data that comprises the dataset is limited. Over the years, researchers have introduced different techniques to increase the accuracy, robustness, and generalizability of the model. One of these techniques is represented by data augmentation. This paper will demonstrate the effectiveness of different data augmentation techniques in malware detection, specifically in the Android environment. Moreover, we created five different datasets: one composed of original data obtained from malicious and trustworthy Android applications, and the other four including images obtained using various types of data augmentation. In detail, as data augmentation techniques, we used a standard technique like horizontal and vertical flipping, and three different Generative Adversarial Networks (DCGAN, WGAN, and WGAN-GP). Once we obtained datasets, we trained several models leveraging two Deep Learning architectures and compared the outcomes. In detail, using augmentation, we improved the accuracy between 9
While intrusion detection has become increasingly relevant and standardized, the same cannot be said for intrusion response. Currently, intrusion response systems vary widely in terms of infrastructure requirements, evaluation methodologies, and performance metrics. In this paper, we take a step toward standardizing intrusion response by introducing the concept of network intrusion response systems (NIRS). NIRS rely solely on network traffic data and perform network-level actions, thereby requiring minimal assumptions about the underlying infrastructure. We motivate this new definition by: (a) introducing the fundamental problem that NIRS aim to solve, i.e., turning alerts raised by network intrusion detection systems (NIDS) into network-level actions; (b) illustrating desirable properties that are fulfilled and their devised workflow in a network ecosystem. Finally, we discuss how NIRS, differently from other response solutions, can be evaluated on publicly available datasets that are typically used for NIDS assessment, thereby facilitating performance comparison between different implementations. We demonstrate how this evaluation can be performed on two baseline NIRS approaches: a heuristic-based and an LLM-based NIRS.
While detection and response are essential components of container runtime security, this reactive approach depends on the timely and accurate classification of threats to trigger mitigation. This dependency introduces unavoidable delays in the response path, creating a window of opportunity for adversaries to escalate privileges or pivot laterally across the cloud environment. These limitations underscore the need for a proactive hardening mechanism that reduces the container’s execution surface before it is compromised. While existing hardening mechanisms enforce security-relevant constraints, their effectiveness remains inherently tied to specific deployment configurations and does not generalize across diverse setups. Moreover, their dependence on prior knowledge of container behavior makes them ill-suited for dynamic microservices, where frequent rollouts invalidate baselines and introduce substantial maintenance overhead. In this work, we present ConLock, a hardening mechanism that generalizes across diverse deployment setups and requires no prior knowledge of container behavior. Our key insight is that containerized microservices, consistent with the single-concern principle, execute a single, task-specific binary throughout their lifetime. In contrast, adversaries violate this model by invoking additional executables—typically pre-packaged within the container image—to carry out malicious actions. At its core, ConLock identifies the main binary at startup and purges all non-essential executables from the container’s runtime filesystem, thereby preventing unauthorized code execution. We evaluate ConLock on five microservices-based applications maintained by major cloud vendors and 21 container attack scenarios derived from publicly available exploits. ConLock achieves a 99.57
The digitalization of public and private services has led to more sophisticated and serious cybersecurity threats. Among them, SQL injection attacks leverage user inputs to remotely execute malicious actions on a database, such as data exfiltration and deletion, or privilege escalation. They are regularly classified as one of the most prominent threats to web services. Intrusion detection systems are widely used to detect such injection attacks and react to them, but it is difficult to assess their actual effectiveness and compare them because of a lack of high-quality datasets. Current SQL injection detection datasets lack diversity, are poorly documented, and the generated samples are not representative of real-world infrastructures. This article presents a new dataset (The dataset is available at: https://zenodo.org/records/17086037 ). Whose design is structured around four quality dimensions: realism, diversity, benchmarking capabilities and the presence of good documentation. We examine the dataset diversity using lexical, syntactic and semantic metrics, and demonstrate that its size is sufficient to evaluate data-intensive detectors. Finally, we provide nine classical and state-of-the art SQL injection detection pipelines as baselines for future works.
