TWC: Small: A Moving Target Approach to Enhancing Machine Learning-Based Malware Defense

不断增长的恶意软件威胁需要有效而高效的缓解技术。由于机器学习带来的可扩展性和自动化，它为恶意软件防御提供了一个很有前途的解决方案。然而，机器学习技术并不是高级恶意软件攻击的灵丹妙药，网络犯罪分子可以精心制作恶意软件功能以逃避检测。此类攻击的根本原因可归因于现有基于机器学习的恶意软件防御系统的被动性质。我们的项目旨在通过一种新颖的移动目标策略来增强这些系统。我们的方法与传统方法不同，传统方法使用特征选择方案来搜索静态特征子集以进行恶意软件检测或分类。相比之下，我们的方法动态地改变用于训练分类模型的特征，以预测未来的恶意软件攻击。为了防止对抗性相关分析，我们的方法使用随机游走技术来确保不同预测模型中使用的特征具有低互信息。我们进一步研究了移动目标方法在恶意软件攻击者各种规避策略下增强基于机器学习的恶意软件防御的有效性。如果成功，这项研究将为减轻日益增长的恶意软件威胁引入一种有前途的新策略。

The ever-growing malware threats call for effective, yet efficient, mitigation techniques. Machine learning offers a promising solution to malware defense due to the scalability and automation that it brings. Machine learning techniques are however not a panacea for advanced malware attacks where cyber criminals can carefully craft malware features to evade detection. The root cause of such attacks can be attributed to the passive nature of existing machine learning-based malware defense systems. Our project aims to enhance these systems with a novel moving target strategy. Our method differs from traditional methods that use feature selection schemes to search for a static subset of features for malware detection or classification. In contrast, our approach dynamically changes the features used to train a classification model for predicting future malware attacks. To prevent adversarial correlation analysis, our method uses a random walk technique to ensure that features used across different predictive models have low mutual information. We further study the effectiveness of the moving target approach in enhancing machine learning-based malware defense under various evasion strategies by malware attackers. If successful, this research will introduce a promising new strategy for mitigating the ever-growing malware threats.