Bypassing system calls–based intrusion detection systems

Abstract

Machine learning augments today's intrusion detection system (IDS) capability to cope with unknown malware. However, if an attacker gains partial knowledge about the IDS' classifier, he can create a modified version of his malware, which can evade detection. In this article we present an IDS on the basis of various classifiers using system calls, executed by the inspected code as features. We then present a camouflage algorithm that is used to modify malicious code to be classified as benign, while preserving the code's functionality, for decision tree and random forest classifiers. We also present transformations to the classifier's input, to prevent this camouflageand a modified camouflage algorithm that overcomes those transformations. Our research shows that it is not enough to provide a decision tree based classifier with a large training set to counter malware. One must also be aware of the possibility that the classifier would be fooled by a camouflage algorithm, and try to counter such an attempt with techniques such as input transformation or training set updates.

Early-stage malware prediction using recurrent neural networks

“…Though API calls to the operating system kernel are the most popular behavioural features used in dynamic malware detection, there are several reasons why we have chosen machine activity features as inputs to the model instead. Firstly, recent work has shown that API calls are vulnerable to manipulation, causing neural networks to misclassify samples ( [22], [23]). As Burnap et al [24] argue"malware cannot avoid leaving a behavioural footprint" of machine activity, future work will necessarily examine the robustness of machine activity to adversarial crafting, but this is outside the scope of this paper.…”

Foreword to the special issue on networked system security and efficiency

“…There is another study also focusing the security issues for Intrusion Detection System (IDS) based on various classifiers using system calls, executed by the inspected code as feature, and thus a camouflage algorithm that is used to modify malicious code to be classified as benign, while preserving the code's functionality, for decision tree and random forest classifiers. The research shows that it is not enough to provide a decision tree–based classifier with a large training set to counter malware.…”

An intrusion detection algorithm based on bag representation with ensemble support vector machine in cloud computing

“…Therefore, intrusion detection technology has attracted much attention of researchers. [4][5][6][7] The ultimate purpose of intrusion detection is to classify network behavior into normal or abnormal according to certain rules. The goal of intrusion detection is to detect as many attacks as possible with the lowest false alarm rate, that is, the detection system must accurately detect abnormal or attack behavior.…”

“…[8][9][10] Therefore, it is necessary to establish a detection model that can accurately identify most of attacks, and handle large-scale data fast enough. Although the recent literatures [11][12][13] have solved these problems, they are not suitable for the detection of persistent attacks. Instead of detecting data flows individually, we subcontract data flows according to a certain rule (eg, all samples in each bag have the same source port), which can improve recall and precision of detection for persistent attacks.…”

“…If the attack or abnormal event cannot be detected in time, the network system may suffer serious losses. Therefore, intrusion detection technology has attracted much attention of researchers 4‐7 …”