Files
Abstract
In this digital era, where a massive number of files are being transferred every second, it is impossible to open and check every file for its effect on the computer system. For some files containing malware, the attack is launched once that file is opened. Furthermore, opening each file is very time-consuming. Therefore, the requirement of 'file checking without opening' arises. This paper introduces a standalone file segregator tool which conducts a preliminary investigation of incoming file traffic of a computer system. It can detect suspected malicious or hidden code snippets in those files without opening their contents. This file segregator tool calculates Shannon's entropy value of every file in the system's incoming file traffic before passing them onto the central system. The entropy of a file lies within the range of 0 to 8 bits per byte of information. A lower value indicates character uniformity, while a higher entropy value indicates randomness. Files with a higher entropy value are flagged as 'suspected' and are separated from the regular traffic. Such files are likely to be encrypted with some malware.
Results: Incoming traffic of files is routed through this file segregator tool, and some files are flagged by segregation. It is seen that the flagged files were either encoded or encrypted and had an entropy value of 7 bits or more.
Conclusion: It is found that the value for Shannon's entropy for a standard text file is generally less than 4 bits. Audio and video files are generally encoded and have a higher entropy value. The files being encrypted using sophisticated encryption techniques like Advanced Encryption Standard (A.E.S.) tend to have an even higher value of Shannon's entropy, i.e., greater than 7 bits. Such files can be potential malware carriers; hence, they are flagged by this file segregator tool.
Relevance in the Naval Industry: By removing the suspected files from the network traffic and allowing the transfer of the safe files, secured communication is established on an integrated command and control network. Jamming of a system can be prevented when a Denial of Service (DoS) or Distributed Denial of Service (DDoS) attack is perpetrated against it. As this file segregator tool can prevent malware attacks, national security agencies can use it to strengthen their threat prevention mechanisms.