A Survey of Stealth Malware Attacks, Mitigation Measures, and Steps Toward Autonomous Open World Solutions
A Survey of Stealth Malware Attacks, Mitigation Measures, and Steps Toward Autonomous Open World Solutions
复制标题
DOI：
10.1109/comst.2016.2636078
复制
发表时间：
2016-03
影响因子：
35.6
通讯作者：
Ethan M. Rudd;Andras Rozsa;Manuel Günther;T. Boult
中科院分区：
文献类型：
--
作者：
Ethan M. Rudd;Andras Rozsa;Manuel Günther;T. Boult
随着我们的专业、社会和金融存在日益数字化，随着我们的政府、医疗保健和军事基础设施更多地依赖计算机技术，它们为恶意软件提供了更大、更有利可图的目标。隐形恶意软件尤其会带来更大的威胁，因为它专门设计来逃避检测机制，在野外长时间潜伏传播，收集敏感信息或为高影响力的零日攻击做好准备。监管日益增长的攻击面需要开发具有改进的通用性的高效反恶意软件解决方案，以检测新型恶意软件并在尽可能少的人类专家负担的情况下解决这些事件。在本文中，我们综述了恶意隐身技术以及现有的自主检测和分类这些对抗措施的解决方案。虽然机器学习为日益自治的解决方案提供了很有希望的潜力，通过改进对新恶意软件类型的泛化，无论是在网络级别还是在主机级别，我们的发现表明，大多数识别算法固有的几个有缺陷的假设阻止了隐形恶意软件识别问题和机器学习解决方案之间的直接映射。这些有缺陷的假设中最值得注意的是封闭世界假设：在查询时不会出现属于静态训练集以外的类的样本。我们提出了一个形式化的自适应开放世界框架，用于隐身恶意软件识别，并在数学上将其与其他机器学习领域的研究联系起来。
As our professional, social, and financial existences become increasingly digitized and as our government, healthcare, and military infrastructures rely more on computer technologies, they present larger and more lucrative targets for malware. Stealth malware in particular poses an increased threat because it is specifically designed to evade detection mechanisms, spreading dormant, in the wild for extended periods of time, gathering sensitive information or positioning itself for a high-impact zero-day attack. Policing the growing attack surface requires the development of efficient anti-malware solutions with improved generalization to detect novel types of malware and resolve these occurrences with as little burden on human experts as possible. In this paper, we survey malicious stealth technologies as well as existing solutions for detecting and categorizing these countermeasures autonomously. While machine learning offers promising potential for increasingly autonomous solutions with improved generalization to new malware types, both at the network level and at the host level, our findings suggest that several flawed assumptions inherent to most recognition algorithms prevent a direct mapping between the stealth malware recognition problem and a machine learning solution. The most notable of these flawed assumptions is the closed world assumption: that no sample belonging to a class outside of a static training set will appear at query time. We present a formalized adaptive open world framework for stealth malware recognition and relate it mathematically to research from other machine learning domains.