Optimation through Automation of Malware Update Process, Capable of Evading Anti-Malware Systems

Abstract

Implementation and maintenance of malware protection measures imply high resources usage. Such is the case of Information Security Management Systems (ISMS), whose suggested structure is described by ISO Standard 27.001:2013. In this standard, work with malware is contemplated for penetration testing (pentesting) purposes, allowing to evaluate the response of computer systems against this kind of events. The present document approaches one of the existing malware usage methods for this purpose: encrypted malware obfuscation, through dead code insertion. This method is evaluated in terms of monetary cost and required time, through simulation, to later evaluate those metrics against an automated model, tested through a prototype software. The optimization of this process through the proposed automation, yielded a significant reduction of the monetary cost and time needed.