In this paper, we propose – DOT – a hybrid analysis approach designed for the detection and classification of malicious files. We have developed both a unified single model and specialized models tailored to various file extensions. Our solutions leverage byte-level content analysis to identify malicious elements within documents, along with n-gram analysis. The uniqueness of DOT lies in its ability to significantly reduce computational overhead. We achieve this by employing Rolling Encoder Hashing, which shortens bytecode sequences, making them compatible with state-of-the-art sequence models like Recurrent Neural Networks (RNNs). Additionally, we have created a static analysis-based generic model capable of working with a variety of file types, including.doc,.docx,.xls,.xlsx,.pdf, and more. This model can be efficiently deployed in real-world scenarios. Furthermore, we have developed specialized models for different file types, which are enhanced versions of the generic architecture, streamlining complex maintenance procedures. Another key innovation and novelty of DOT lies in exactly locating the portion of content in the byte code that could contain malicious code, to help security analysts make the binary code analysis more efficient.We conducted extensive experiments using a dataset recently made available by sources like VirusShare, Contagio, and others, specifically intended for academic research. Our dataset comprises a substantial collection of over 156,000 documents, encompassing both malicious and benign files of the most hazardous types observed in recent years. Our findings reveal impressive results, with a unified single model achieving a 91.43% accuracy in distinguishing between benign and malicious documents. Furthermore, specialized models tailored to specific file types exhibit even higher accuracy rates: 96.13% for.doc files, 97.85% for.docx files, 92.62% for.xls files, 97.02% for.xlsx files, and 94.11% for.pdf files, respectively and with a very low false positive rate.

Password-based authentication system has been praised for its user-friendly, cost-effective, and easily deployable features. It is arguably the most commonly used security mechanism for various resources, services, and applications. On the other hand, it has well-known security flaws, including vulnerability to guessing attacks. Present state-of-the-art approaches have high overheads, as well as difficulties and unreliability during training, resulting in a poor user experience and a high false positive rate. As a result, a lightweight authentication compromise detection model that can make accurate detection with a low false positive rate is required.In this paper we propose – LOG-OFF – a behavior-based authentication compromise detection model. LOG-OFF is a lightweight model that can be deployed efficiently in practice because it does not include a labeled dataset. Based on the assumption that the behavioral pattern of a specific user does not suddenly change, we study the real-world authentication traffic data. The dataset contains more than 4 million records. We use two features to model the user behaviors, i.e., consecutive failures and login time, and develop a novel approach. LOG-OFF learns from the historical user behaviors to construct user profiles and makes probabilistic predictions of future login attempts for authentication compromise detection. LOG-OFF has a low false positive rate and latency, making it suitable for real-world deployment. In addition, it can also evolve with time and make more accurate detection as more data is being collected.