Getting Ahead of the Arms Race: Hothousing the Coevolution of VirusTotal with a Packer.
Getting Ahead of the Arms Race: Hothousing the Coevolution of VirusTotal with a Packer.
复制标题
DOI：
10.3390/e23040395
复制
发表时间：
2021-03-26
期刊：
影响因子：
--
通讯作者：
T Barr E
中科院分区：
文献类型：
--
作者：
Menéndez HD;Clark D;T Barr E
攻击者和防守者不断地寻求攻击者，这是一个不对称的武器为了补偿这种失衡。机器学习。我们提出了一种称为hothouse的方法，它结合了模拟和搜索，以加速白帽的能力，以应对黑帽的增量移动，从而迫使黑帽子更频繁地实现颠覆性的动作。基于熵的多态性包装器，用于扮演黑色帽子的角色，EEE使用进化计算来破坏恶意软件签名的创建。在我们6个月的研究中，我们对Virustotal的响应不断改善EEE，最终会生产出一种包装的恶意软件，其逃避性从最初的51.8％中位数到19.6％。 - 包装二进制文件，Virustotal却如何忘记，以减少Virustotal的工具。
Malware detection is in a coevolutionary arms race where the attackers and defenders are constantly seeking advantage. This arms race is asymmetric: detection is harder and more expensive than evasion. White hats must be conservative to avoid false positives when searching for malicious behaviour. We seek to redress this imbalance. Most of the time, black hats need only make incremental changes to evade them. On occasion, white hats make a disruptive move and find a new technique that forces black hats to work harder. Examples include system calls, signatures and machine learning. We present a method, called Hothouse, that combines simulation and search to accelerate the white hat’s ability to counter the black hat’s incremental moves, thereby forcing black hats to perform disruptive moves more often. To realise Hothouse, we evolve EEE, an entropy-based polymorphic packer for Windows executables. Playing the role of a black hat, EEE uses evolutionary computation to disrupt the creation of malware signatures. We enter EEE into the detection arms race with VirusTotal, the most prominent cloud service for running anti-virus tools on software. During our 6 month study, we continually improved EEE in response to VirusTotal, eventually learning a packer that produces packed malware whose evasiveness goes from an initial 51.8% median to 19.6%. We report both how well VirusTotal learns to detect EEE-packed binaries and how well VirusTotal forgets in order to reduce false positives. VirusTotal’s tools learn and forget fast, actually in about 3 days. We also show where VirusTotal focuses its detection efforts, by analysing EEE’s variants.
登录
查看更多内容
影响因子：
8.9
作者：
Biggio, Battista;Fumera, Giorgio;Roli, Fabio
通讯作者：
Roli, Fabio
DOI：
10.3390/e21050513
发表时间：
2019-05-21
期刊：
Entropy (Basel, Switzerland)
影响因子：
--
作者：
Menéndez HD;Llorente JL
通讯作者：
Llorente JL
DOI：
10.3390/e22050575
发表时间：
2020-05-20
期刊：
Entropy (Basel, Switzerland)
影响因子：
--
作者：
Alshahwan N;Barr ET;Clark D;Danezis G;Menéndez HD
通讯作者：
Menéndez HD
影响因子：
8.5
作者：
Calleja, Alejandro;Martin, Alejandro;Clark, David
通讯作者：
Clark, David
影响因子：
4.8
作者：
Kantarcioglu, Murat;Xi, Bowei;Clifton, Chris
通讯作者：
Clifton, Chris