Abstract: File systems, being one of the core components of any computational device, contain the most important information which makes them pivotal to any digital forensics investigation. However, file system parsing is a complex process. Existing file system forensic software are capable of processing large datasets but often at the cost of either performance or resource utilisation. Slow evidence processing has a direct impact on investigation time, while higher resource requirements have a monetary impact. Digital Forensics labs are often on a constrained budget in terms of both time and money. So, they often need to define priorities on a case-by-case basis. Another major concern for forensic investigators is correctness. Tools that suffer from memory management issues may generate inconsistent reports or worse yet, increase overall attack surface for malware that may pollute investigator’s workstation. This research proposes a novel open-source exFAT file system parsing library. It has been validated against the current open-source state-of-the-art: The Sleuth Kit (TSK), on a dataset of disk images ranging from 1MiB to 1TiB. Experimental results indicate that the proposed tool is 40 times faster and 17 times more memory efficient than TSK.

Abstract The research aims to assess the understanding and perception of cybersecurity among teachers, focusing on the prevention of malware attacks, social engineering, and habits for protecting confidential information. A descriptive quantitative methodology was employed with a sample of 61 teachers in virtual mode. The survey, validated by experts in Information Technologies, evaluated the recognition and consequences of cyber attacks. The results revealed a uniform distribution in identifying confidential information, emphasizing the importance of safeguarding specific data. While the majority acknowledged the risks of sharing information, there were gaps in the perception of consequences such as blackmail and extortion. In social engineering, there was a noted need for improved understanding, and in malware protection, there was a lack of awareness regarding ransomware and its consequences. In conclusion, the research underscores the importance of enhancing cybersecurity in education and proposes measures to improve threat identification and prevention skills. These findings highlight the necessity for increased cybersecurity training in the educational environment, contributing to risk mitigation and more effective protection of sensitive information.

Resumen La investigación tiene como objetivo evaluar la comprensión y percepción de la ciberseguridad entre docentes, enfocándose en la prevención de ataques de malware, ingeniería social y hábitos de protección de información confidencial. Se utilizó una metodología descriptiva cuantitativa con una muestra de 61 docentes de modalidad virtual. La encuesta, fue validada por expertos en Tecnologías de la Información, evaluó el reconocimiento y consecuencias de ciberataques. Los resultados revelaron una distribución uniforme en la identificación de información confidencial, resaltando la importancia de proteger datos específicos. La mayoría reconoció riesgos de compartir información, sin embargo, hubo brechas en la percepción de consecuencias como el chantaje y la extorsión. En ingeniería social, se señaló la necesidad de mejorar la comprensión, y en protección contra malware, hubo desconocimiento sobre ransomware y sus consecuencias. En conclusión, la investigación resalta la importancia de fortalecer la ciberseguridad en la educación y propone medidas para mejorar la identificación de amenazas y habilidades de prevención. Estos hallazgos mencionan la necesidad de una mayor formación en ciberseguridad en el entorno educativo, contribuyendo a mitigar riesgos y proteger la información sensible de forma más efectiva.

ABSTRACT When faced with questions about artificial intelligence (AI), many surgeons respond with scepticism and rejection. However, in the realm of cardiac surgery, it is imperative that we embrace the potential of AI and adopt a proactive mindset. This systematic review utilizes PubMed® to explore the intersection of AI and cardiac surgery since 2017. AI has found applications in various aspects of cardiac surgery, including teaching aids, diagnostics, predictive outcomes, surgical assistance, and expertise. Nevertheless, challenges such as data computation errors, vulnerabilities to malware, and privacy concerns persist. While AI has limitations, its restricted capabilities without cognitive and emotional intelligence should lead us to cautiously and partially embrace this advancing technology to enhance patient care. AI, , (AI) rejection However mindset PubMed 2017 aids diagnostics outcomes assistance expertise Nevertheless errors malware persist limitations care (AI 201 20 2

Resumen En el presente artículo se evidencia que los ataques de ransomware en América Latina se han convertido en una de las ciber amenazas más importantes y a su vez más peligrosas para las organizaciones y usuarios en genera. Inicialmente se realizó una revisión bibliográfica y de casos relevantes ocurridos, lo que permitió recopilar información para determinar su evolución e impacto desde el año 2015. En esta fase se logró entender este concepto y sus características, posteriormente se identificaron los vectores de ataque y metodologías que utilizan los atacantes. Esto contribuyó a identificar los tipos de ransomware que han aparecido en los últimos años para así describir los métodos de infección que se utilizan por parte de los ciber criminales. Al reconocer el comportamiento de este malware y las tendencias asociadas a esta amenaza, se generan recomendaciones que permiten orientar a las organizaciones y a las personas para que eviten ser víctimas de ataques de este tipo, lo que constituye una contribución para mitigar este tipo de riesgo.

Abstract This article shows that Ransomware attacks in Latin America have become one of the most important and dangerous cyber threats for organizations and users in general; This according to the security report latinoamerica 2021 by antivirus company ESET, for this reason initially a literature review was conducted and relevant cases occurred, which allowed gathering information to determine its evolution and impact since 2015, likewise in this phase it was possible to understand this concept and its characteristics, then the attack vectors and methodologies used by the attackers were identified, this contributed to identify the types of Ransomware that have appeared in recent years to describe the methods of infection that are used by cyber criminals. By recognizing the behavior of this malware and the trends associated with this threat, recommendations are generated to guide organizations and individuals to avoid becoming victims of attacks of this type, which constitutes a contribution to mitigate this type of risk. This document is obtained from the research carried out in the development of the degree work: "EVOLUTION AND IMPACT OF RANSOMWARE IN LATIN AMERICA SINCE 2015".

Resumo O malware constitui um novo meio de obtenção de prova em matéria criminal. A sua operacionalização ocorre a partir da instalação, de forma oculta, de um software malicioso no equipamento ou sistema informático de um terceiro, a partir do qual será possível o acesso aos dados e informações nele contidos. Dado o seu elevado grau de invasividade, essa técnica enseja um impacto sobre diversos direitos fundamentais e garantias processuais dos cidadãos. O presente artigo faz uma análise dos principais aspectos problemáticos envolvendo o emprego do malware na esfera investigativa e averigua se é possível a sua utilização no Brasil no ordenamento jurídico vigente e, em quais termos, a sua utilização seria lícita. Ao final, o artigo conclui pela impossibilidade de seu emprego com base na legislação vigente e fornece parâmetros que devem orientar uma norma que vise futuramente regular essa medida no Brasil.

Abstract Malware is a new means of obtaining evidence in criminal matters. Its operation takes place from the installation, in a hidden way, of malicious software on the equipment or computer system of a third party, from which it will be possible to access the data and information contained therein. Given its high degree of invasiveness, this technique has an impact on several fundamental rights and procedural guarantees of citizens. This article analyzes the main problematic aspects involving the use of malware in the investigative sphere and investigates whether its use in Brazil is possible in the current legal system and, in what terms, its use would be lawful. In the end, the article concludes by the impossibility of its use based on the current legislation and provides parameters that should guide a norm that aims to regulate this measure in Brazil in the future.

Resumen Este estudio presenta una descripción general sobre la ciberseguridad desde la perspectiva de las redes neuronales y técnicas de aprendizaje profundo de acuerdo con las diversas necesidades actuales en ambientes de seguridad informática. Se discute la aplicabilidad de estas técnicas en diversos trabajos de ciberseguridad, como detección de intrusos, identificación de malware o botnets, phishing, predicción de ciberataques, denegación de servicio, ciberanomalías, entre otros. Para este estudio se aplicó el método analítico-sintético que sirvió para identificar soluciones óptimas en el campo de la ciberseguridad. Los resultados destacan y recomiendan algoritmos aplicables a la seguridad cibernética como base de conocimiento y facilidad para investigaciones futuras dentro del alcance de este estudio en el campo. Esta investigación sirve como punto de referencia y guía para la academia y los profesionales de las industrias de la seguridad cibernética desde el punto de vista del aprendizaje profundo.

Abstract This study presents an overview on cybersecurity from the perspective of neural networks and deep learning techniques according to the various current needs in computer security environments. It discusses the applicability of these techniques in various cybersecurity works, such as intrusion detection, malware or botnet identification, phishing, cyber attack prediction, denial of service, cyber anomalies, among others. For this study, the analytical-synthetic method was applied to identify optimal solutions in the field of cybersecurity. The results highlight and recommend algorithms applicable to cybersecurity as a knowledge base and facility for future research within the scope of this study in the field. This research serves as a reference point and guide for academia and practitioners in cyber security industries from the deep learning point of view.

RESUMEN. Este trabajo tiene como objetivo estudiar las principales etapas de la evolución de los ciberataques en cuanto a su peligrosidad, desde los primeros ciberataques gamberros hasta las ciber-guerras modernas. Los autores utilizan métodos empíricos de investigación cualitativa y cuantitativa para evaluar las etapas del desarrollo de los ciberataques, teniendo en cuenta su incremento, su diversidad y la creación del malware empleado. El artículo permite comprender mejor las causas, las condiciones y las consecuencias de los nuevos tipos de ciberataques. El artículo concluye señalando las tres etapas de la evolución de los ciberataques y extrae los principales rasgos característicos del estado actual del ciberentorno.

ABSTRACT. This paper aims to study the main stages of cyberattacks' evolution in terms of the danger they pose, from the first hooligan cyberattacks to modern cyberwars. The authors use empirical qualitative and quantitative research methods to assess the stages of cyberattack development, considering their increasing numbers, diversity, and the creation of the malware employed. The paper provides a better understanding of the causes, conditions, and consequences of the emerging types of cyberattacks. The article concludes by pointing out the three stages in the evolution of cyberat-tacks and draws upon the main characteristic features of the current state of the cyber environment.

RESUMEN La pandemia generada por el COVID-19 implicó estrategias de confinamiento masivo como respuesta pública de emergencia en el marco de derecho de policía para combatir el nivel de contagios. Adicionalmente, dicha situación coyuntural implicó cambiar las distintas formas de interacción social (virtual) en torno a temas como la educación, la atención en salud y el empleo. De manera directamente proporcional, la delincuencia aprovechó la situación virtual para intensificar delitos electrónicos como el phishing, las fake news y en general actividades como inyección de malware. El propósito de la investigación fue identificar las prácticas de seguridad de la información en una comunidad universitaria por medio de una encuesta, bajo un enfoque de investigación mixto que consideró entre otras variables la pandemia como precursora de nuevos hábitos de higiene digital. Entre los resultados más representativos se destaca que tanto los profesores como estudiantes tienen un aceptable conocimiento sobre seguridad de la información, pese a no recibir capacitación significativa por entidades gubernamentales. Finalmente, se concluye que los esfuerzos institucionales para combatir ese tipo de delitos no han sido suficientes y por tanto se está en mora de generar estrategias de sensibilización para promover una mejor higiene digital.

ABSTRACT The pandemic generated by COVID-19 implied massive confinement strategies as an emergency public response within the framework of the police law to combat the level of contagion. Additionally, this situation implied changing the different forms of social interaction such as education, health care and employment. In a directly proportional way, crime took advantage of the situation to intensify electronic crimes such as phishing, fake news and, in general, activities such as malware injection. The purpose of the research was to identify information security practices in a university community by means of a survey, under a mixed research approach that considered, among other variables, the pandemic as a precursor of new digital hygiene habits. Among the most representative results, it is highlighted that both professors and students have an acceptable knowledge of information security, despite not receiving significant training by governmental entities such as the National Police. Finally, it is concluded that institutional efforts to combat this type of crime have not been sufficient and therefore there is a lack of awareness strategies to promote better digital hygiene.

RESUMO A pandemia gerada pelo COVID-19 envolveu estratégias de confinamento em massa como uma resposta de emergência pública dentro da estrutura da lei policial para combater o nível de contágio. Além disso, essa situação conjuntural implicou uma mudança nas diferentes formas de ¡interação social (virtual) em torno de questões como educação, saúde e emprego. De forma diretamente proporcional, a delinquência aproveitou a situação virtual para intensificar os crimes eletrônicos como phishing, fake news e atividades gerais como injeção de malware. O objetivo da pesquisa foi identificar as práticas de segurança da informação em uma comunidade universitária por meio de uma enquete, sob uma abordagem de pesquisa mista que considerou, entre outras variáveis, a pandemia como precursora de novos hábitos de higiene digital. Dentre os resultados mais representativos, destaca-se que tanto professores quanto alunos possuem conhecimentos aceitáveis sobre segurança da informação, apesar de não receberem treinamento significativo de órgãos governamentais. Finalmente, conclui-se que os esforços institucionais para combater este tipo de crime não têm sido suficientes e, portanto, está em atraso gerar estratégias de conscientização para promover uma melhor higiene digital.

ABSTRACT The present research studies the creation of a virtual network environment to perform dynamic malware analysis using the Proxmox hypervisor system and LXC or KVM / QEMU virtualization technologies to ensure the operability and correct isolation of the components. A modest perimeter security topology is proposed using a DMZ with a tripod firewall, internal network and adding a monitoring network, as a representation of the business environment at a small or medium level for the abstraction in minimum elements permissible to virtualize with the least impact on the system functionality and safeguarding the consumption of physical resources. According to the characteristics of areas with great operational importance (internal network and DMZ), they are haunted by malicious code classified according to the expected scope: massive and targeted. The use of external tools to develop and obtain the necessary data on the behavior of the infected system and the development of the specimen in execution with services such as Zabbix and Moloch have influential limitations on the precision of the dynamic analysis and the consequent formulation of conclusions and elaboration of "Indicators of compromise" or signatures that aid in the detection of malicious software

RESUMEN La presente investigación estudia la creación de un entorno de red virtual para la realización de análisis dinámico de malware empleando el sistema hipervisor Proxmox y tecnologías de virtualización LXC o KVM/QEMU para el aseguramiento de la operatividad y el correcto aislamiento de los componentes. Se propone una topología modesta de seguridad perimetral empleando una DMZ con cortafuego en trípode, red interna y añadiendo una red de monitoreo, como representación de ambiente empresarial a nivel pequeño o mediano para la abstracción en elementos mínimos permisibles a virtualizar con el menor impacto en la funcionalidad del sistema y salvaguardando el consumo de recursos físicos. Según las características de zonas con gran importancia operacional (red interna y DMZ), son asechadas por código maliciosos clasificados de acuerdo al alcance esperado: masivos y dirigidos. El uso de herramientas externas para el desarrollo y obtención de datos necesarios sobre el comportamiento del sistema infectado y el desenvolvimiento del espécimen en ejecución con servicios como Zabbix y Moloch poseen limitaciones influyentes en la precisión del análisis dinámico y la consecuencia formulación de conclusiones y elaboración de indicadores de compromisos o firmas que ayuden a la detección de software maligno.

Abstract: The paper analyzes the legality of hacking operations carried out by the Dirección de Inteligencia de Carabineros de Chile (Dipolcar) during the controversial “Operación Huracán”. In order to achieve this objective, a brief description of the tools and techniques that could eventually allow access to communications from applications such as Whatsapp and Telegram is offered. Also, the paper analyzes the pertinent articles of the Criminal Procedure Code and Law 19,974 in order to assess whether these bodies enable State agencies to access computer systems, infect devices with malware and use phishing techniques. Finally, brief recommendations are offered with the hope that future legal modification can adequate our legal bodies to international human rights standards.

Resumen: El trabajo analiza la legalidad de la utilización de técnicas de hacking por parte de la Dirección de Inteligencia de Carabineros de Chile (Dipolcar), a la luz de los hechos ocurridos en la polémica Operación Huracán. Para ello, se hace una breve relación de las herramientas y técnicas que eventualmente podrían permitir obtener acceso a las comunicaciones de aplicaciones como Whatsapp y Telegram. Luego, se estudian las normas del Código Procesal Penal y la Ley 19.974, a fin de evaluar si estos cuerpos habilitan a las policías para acceder a sistemas informáticos, infectar dispositivos con programas maliciosos y utilizar técnicas de phishing. Por último, se entregan breves recomendaciones para que una futura modificación de la ley de inteligencia permita adecuarla a estándares internacionales de derechos humanos.

En los últimos años, la consolidación de Android, como el sistema operativo más utilizado en Smartphone lo convierte en blanco del mayor número de amenazas creciente; tendencia que se ha mantenido en los últimos años. De acuerdo al informe de 2016, Tendencias en Seguridad publicado por ESET, el número de vulnerabilidades móviles incrementa cada año desde 2013 y, a lo largo de 2015 la tasa de incremento dentro del ecosistema Android que ponen en riesgo la privacidad de su información, ha promediado de 200 nuevas muestras de malware por mes. Por lo tanto, en este artículo se presenta una aplicación (app) para la detección oportuna a potenciales aplicaciones maliciosas presentes en Smartphone, particularmente aquellos con sistema operativo Android, presentando un estudio de caso que ha permitido validar la app a través de la detección de aplicaciones maliciosas instaladas en un dispositivo móvil.

In recent years, the Android operating system is the most used in Smartphones, which makes it the target of the greatest number of threats; trend that has remained in recent years. According to the 2016 report, Trends in Security published by ESET, the number of mobile vulnerabilities increases every year since 2013 and, throughout 2015, the rate of increase within the Android ecosystem that put the privacy of your information at risk, has averaged 200 new malware samples per month. Therefore, this article presents an application (app) for the timely detection of potential malicious applications present in smartphones, particularly those with Android operating system, presenting a case study that has allowed validating the app through the detection of malicious applications installed on a mobile device.

Malware threats have become increasingly dynamic and complex, and, accordingly, artificial intelligence techniques have become the focal point for cybersecurity, as they are viewed as being more suited to tackling modern malware incidents. Specifically, neural networks, with their strong generalisation performance capability, are able to address a wide range of cyber threats. This article outlines the development and testing of a neural network ensemble approach to malware detection, based on a hybrid search mechanism. In this mechanism, the optimising of individual networks is done by an adaptive memetic algorithm with tabu search, which is also used to improve hidden neurons and weights of neural networks. The adaptive memetic algorithm combines global and local search optimisation techniques in order to overcome premature convergence and obtain an optimal search outcome. The results from the testing prove that the proposed method is strongly adaptive and efficient in its detection of a range of malware threats, and that it generates better results than other existing methods.

Resumen El sandboxing ha sido usado de manera regular para analizar muestras de software y determinar si estas contienen propiedades o comportamientos sospechosos. A pesar de que el sandboxing es una técnica poderosa para desarrollar análisis de malware, esta requiere que un analista de malware desarrolle un análisis riguroso de los resultados para determinar la naturaleza de la muestra: goodware o malware. Este artículo propone dos modelos de aprendizaje automáticos capaces de clasificar muestras con base a un análisis de firmas o permisos extraídos por medio de Cuckoo sandbox, Androguard y VirusTotal. En este artículo también se presenta una propuesta de arquitectura de centinela IoT que protege dispositivos IoT, usando uno de los modelos de aprendizaje automáticos desarrollados anteriormente. Finalmente, diferentes enfoques y perspectivas acerca del uso de sandboxing y aprendizaje automático por parte de agencias de seguridad del Estado también son aportados.

Abstract Sandboxing has been used regularly to analyze software samples and determine if these contain suspicious properties or behaviors. Even if sandboxing is a powerful technique to perform malware analysis, it requires that a malware analyst performs a rigorous analysis of the results to determine the nature of the sample: goodware or malware. This paper proposes two machine learning models able to classify samples based on signatures and permissions obtained through Cuckoo sandbox, Androguard and VirusTotal. The developed models are also tested obtaining an acceptable percentage of correctly classified samples, being in this way useful tools for a malware analyst. A proposal of architecture for an IoT sentinel that uses one of the developed machine learning model is also showed. Finally, different approaches, perspectives, and challenges about the use of sandboxing and machine learning by security teams in State security agencies are also shared.

Internet-based attacks have become prevalent and are expected to increase as technology ubiquity increases. Consequently, cybersecurity has emerged as an essential concept in everyday life. Cybersecurity awareness (CSA) is a key defence in the protection of people and systems. The research presented in this article aimed to assess the levels of CSA among students at a private tertiary education institution in South Africa. A questionnaire tested students in terms of four variables: cybersecurity knowledge; self-perception of cybersecurity skills, actual cybersecurity skills and behaviour; and cybersecurity attitudes. The responses revealed several misalignments, including instances of "cognitive dissonance" between variables, which make the students potentially vulnerable to cyber-attacks. The findings demonstrate the need for targeted CSA campaigns that address the specific weaknesses of particular populations of users.

Las tecnologías de la información han evolucionado de tal manera que la comunicación entre computadoras o hosts se ha vuelto algo común, hasta el punto que la organización a nivel mundial (gobiernos y grandes empresas) depende de esto; lo que pasaría si estas computadoras dejaran de funcionar por un periodo de tiempo largo es catastrófico. Desgraciadamente, las redes de hosts son blanco de ataques por malware como virus y gusanos informáticos que podrían colapsar el sistema. Esto ha servido como motivación para el estudio formal de los gusanos informáticos y sus epidemias con el fin de idear estrategias de prevención y protección; por ello en el presente artículo, y previo al análisis de modelos epidemiológicos, se proponen un conjunto de definiciones formales basadas en la teoría de conjuntos y funciones que permiten describir 21 conceptos utilizados en el estudio de los gusanos informáticos. Estas definiciones servirán de base para futuras investigaciones cualitativas sobre el comportamiento de los gusanos informáticos, y cuantitativas para el estudio de sus modelos epidemiológicos.

The information technologies have evolved in such a way that communication between computers or hosts has become common, so much that the worldwide organization (governments and corporations) depends on it; what could happen if these computers stop working for a long time is catastrophic. Unfortunately, networks are attacked by malware such as viruses and worms that could collapse the system. This has served as motivation for the formal study of computer worms and epidemics to develop strategies for prevention and protection; this is why in this paper, before analyzing epidemiological models, a set of formal definitions based on set theory and functions is proposed for describing 21 concepts used in the study of worms. These definitions provide a basis for future qualitative research on the behavior of computer worms, and quantitative for the study of their epidemiological models.