MaleficNet: Hiding Malware into Deep Neural Networks Using Spread-Spectrum Channel Coding

Abstract

Training high-quality deep learning models is a challenging task due to computational and technical requirements. A growing number of individuals, institutions, and companies increasingly rely on pre-trained, third-party models made available in public repositories. These models are often used directly or integrated in product pipelines with no particular precautions, since they are effectively just data in tensor form and considered safe.In this paper, we raise awareness of a new machine learning supply chain threat targeting neural networks. We introduce MaleficNet 2.0, a novel technique to embed self-extracting, selfexecuting malware in neural networks. MaleficNet 2.0 uses spread-spectrum channel coding combined with error correction techniques to inject malicious payloads in the parameters of deep neural networks. MaleficNet 2.0 injection technique is stealthy, does not degrade the performance of the model, and is robust against removal techniques. We design our approach to work both in traditional and distributed learning settings such as Federated Learning, and demonstrate that it is effective even when a reduced number of bits is used for the model parameters. Finally, we implement a proof-of-concept self-extracting neural network malware using MaleficNet 2.0, demonstrating the practicality of the attack against a widely adopted machine learning framework.Our aim with this work is to raise awareness against these new, dangerous attacks both in the research community and industry, and we hope to encourage further research in mitigation techniques against such threats.

Transpose Attack: Stealing Datasets with Bidirectional Training

“…Instead of embedding the data in the model's function, other studies tried embedding the data in the model's parameters using stenography [23,24,56]. However, as shown in Section VI, we found that these methods are easily mitigated during export if a small amount of random Gaussian noise is added to the parameters.…”

Sharing cyber threat intelligence: Does it really help?

“…To build a ground truth dataset of Indicator objects, we retrieve scanning reports from three services: VirusTotal, HybridAnalysis, and MetaDefender, which are widely used to validate threat indicators [28], [38], [37], [21], [55]. For each attribute type (i.e., malware hashes, domains, URLs, and IP addresses), VirusTotal and MetaDefender provide detection results from various anomaly detection engines, and HybridAnalysis provides a threat score with three status tags (i.e., malicious, suspicious, and no specific threat).…”

“…To obtain more reliable and accurate actual security threat data, we use at least three representative services related to each measurement (e.g., VirusTotal, Hybri-dAnalysis, and MetaDefender for the timeliness analysis) as sources of security threat data instead of relying on a single service. Note that these sources are widely used as ground truth in prior works [28], [38], [37], [21], [55], [67], [59], [32].…”

Federated Learning-Based Ransomware Detection via Indicators of Compromise

“…Decision trees provided a straightforward yet powerful means of classifying ransomware activities based on distinct features, which helped in isolating anomalous patterns indicative of ransomware attacks [1], [2]. Neural networks, with their deep learning capabilities, allowed for the modeling of complex relationships within large datasets, significantly enhancing the ability to detect subtle ransomware signatures that traditional methods might overlook [3], [4]. Support vector machines leveraged hyperplane-based classification to separate benign from malicious activities with high accuracy, thus offering a robust solution for early-stage ransomware detection [5]- [7].…”