Lecture Notes in Computer Science

2020

DOI: 10.1007/978-3-030-57878-7_13

|View full text |Cite

|

Sign up to set email alerts

|

The Naked Sun: Malicious Cooperation Between Benign-Looking Processes

Fabio De Gaspari

¹

,

²

,

Giulio Pagnotta

³

et al.

Help me understand this report

Search citation statements

Order By: Relevance

Paper Sections

Select...

Introduction3

Ethical Considerations1

George Bernard Shaw1

Citation Types

Supporting

0

Mentioning

19

Contrasting

0

Year Published

2020

2020

2022

2022

Publication Types

Select...

Book3

Article2

Other2

Relationship

Self Cite5

Independent2

Authors

Journals

Cited by 18 publications

(22 citation statements)

References 25 publications

Supporting

0

Mentioning

19

Contrasting

0

Order By: Relevance

“…However, we do plan to make it available on a case-by-case basis to reputable research groups. Prior to publishing our previous conference paper [11], we also communicated details and results of our attack to Malwarebytes.…”

Section: Ethical Considerationsmentioning

confidence: 99%

“…In this paper, which is an extended version of our previous conference paper [11], we make the following contributions:…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Evading behavioral classifiers: a comprehensive analysis on evading ransomware detection techniques

¹

,

²

,

³

et al. 2022

Neural Comput & Applic

Self Cite

View full text Add to dashboard Cite

Recent progress in machine learning has led to promising results in behavioral malware detection. Behavioral modeling identifies malicious processes via features derived by their runtime behavior. Behavioral features hold great promise as they are intrinsically related to the functioning of each malware, and are therefore considered difficult to evade. Indeed, while a significant amount of results exists on evasion of static malware features, evasion of dynamic features has seen limited work. This paper examines the robustness of behavioral ransomware detectors to evasion and proposes multiple novel techniques to evade them. Ransomware behavior differs significantly from that of benign processes, making it an ideal best case for behavioral detectors, and a difficult candidate for evasion. We identify and propose a set of novel attacks that distribute the overall malware workload across a small set of independent, cooperating processes in order to avoid the generation of significant behavioral features. Our most effective attack decreases the accuracy of a state-of-the-art classifier from 98.6 to 0% using only 18 cooperating processes. Furthermore, we show our attacks to be effective against commercial ransomware detectors in a black-box setting. Finally, we evaluate a detector designed to identify our most effective attack, as well as discuss potential directions to mitigate our most advanced attack.

“…However, we do plan to make it available on a case-by-case basis to reputable research groups. Prior to publishing our previous conference paper [11], we also communicated details and results of our attack to Malwarebytes.…”

Section: Ethical Considerationsmentioning

confidence: 99%

“…In this paper, which is an extended version of our previous conference paper [11], we make the following contributions:…”

Section: Introductionmentioning

confidence: 99%

Evading behavioral classifiers: a comprehensive analysis on evading ransomware detection techniques

¹

,

²

,

³

et al. 2022

Neural Comput & Applic

Self Cite

View full text Add to dashboard Cite

Recent progress in machine learning has led to promising results in behavioral malware detection. Behavioral modeling identifies malicious processes via features derived by their runtime behavior. Behavioral features hold great promise as they are intrinsically related to the functioning of each malware, and are therefore considered difficult to evade. Indeed, while a significant amount of results exists on evasion of static malware features, evasion of dynamic features has seen limited work. This paper examines the robustness of behavioral ransomware detectors to evasion and proposes multiple novel techniques to evade them. Ransomware behavior differs significantly from that of benign processes, making it an ideal best case for behavioral detectors, and a difficult candidate for evasion. We identify and propose a set of novel attacks that distribute the overall malware workload across a small set of independent, cooperating processes in order to avoid the generation of significant behavioral features. Our most effective attack decreases the accuracy of a state-of-the-art classifier from 98.6 to 0% using only 18 cooperating processes. Furthermore, we show our attacks to be effective against commercial ransomware detectors in a black-box setting. Finally, we evaluate a detector designed to identify our most effective attack, as well as discuss potential directions to mitigate our most advanced attack.

“…Deep Learning (DL) is the key factor for an increased interest in research and development in the area of Artificial Intelligence (AI), resulting in a surge of Machine Learning (ML) based applications that are reshaping entire fields and seedling new ones. Variations of Deep Neural Networks (DNN), the algorithms residing at the core of DL, have successfully been implemented in a plethora of domains, including here but not limited to image classification [17,35,80], natural language processing [6,22,73], speech recognition [33,37], data (image, text, audio) generation [7,40,44,61], cybersecurity [18,21,59], and even aiding with the COVID-19 pandemic [52,55].…”

Section: George Bernard Shawmentioning

confidence: 99%

FedComm: Federated Learning as a Medium for Covert Communication

¹

,

²

,

³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

Proposed as a solution to mitigate the privacy implications related to the adoption of deep learning solutions, Federated Learning (FL) enables large numbers of participants to successfully train deep neural networks without having to reveal the actual private training data. To date, a substantial amount of research has investigated the security and privacy properties of FL, resulting in a plethora of innovative attack and defense strategies.This paper thoroughly investigates the communication capabilities of an FL scheme. In particular, we show that a party involved in the FL learning process, can use FL as a covert communication medium to send an arbitrary message.We introduce FedComm, a novel covert-communication technique that enables robust sharing and transfer of targeted payloads within the FL framework. Our extensive theoretical and empirical evaluations show that FedComm provides a stealthy communication channel, with minimal disruptions to the training process. Our experiments show that FedComm, allowed us to successfully deliver 100% of a payload in the order of kilobits before the FL procedure converges. Our evaluation also shows that FedComm is independent of the application domain and the neural network architecture used by the underlying FL scheme.

“…Consequently, there is no clear understanding of how these approaches: (i) fare on a variety of compressed file formats and sizes, and (ii) compare to each other. The potential negative implications are significant: the use of ineffective techniques for identifying encrypted content can hinder the effectiveness of ransomware detectors [20], and significantly limit the capability of forensic tools.…”

Section: Introductionmentioning

confidence: 99%

Reliable Detection of Compressed and Encrypted Data

¹

,

²

,

³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Several cybersecurity domains, such as ransomware detection, forensics and data analysis, require methods to reliably identify encrypted data fragments. Typically, current approaches employ statistics derived from byte-level distribution, such as entropy estimation, to identify encrypted fragments. However, modern content types use compression techniques which alter data distribution pushing it closer to the uniform distribution. The result is that current approaches exhibit unreliable encryption detection performance when compressed data appears in the dataset. Furthermore, proposed approaches are typically evaluated over few data types and fragment sizes, making it hard to assess their practical applicability.This paper compares existing statistical tests on a large, standardized dataset and shows that current approaches consistently fail to distinguish encrypted and compressed data on both small and large fragment sizes. We address these shortcomings and design ENCOD, a learning-based classifier which can reliably distinguish compressed and encrypted data. We evaluate ENCOD on a dataset of 16 different file types and fragment sizes ranging from 512B to 8KB. Our results highlight that ENCOD outperforms current approaches by a wide margin, with accuracy ranging from ∼ 82% for 512B fragments up to ∼ 92% for 8KB data fragments. Moreover, ENCOD can pinpoint the exact format of a given data fragment, rather than performing only binary classification like previous approaches.

scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.

Contact Info

hi@scite.ai

10624 S. Eastern Ave., Ste. A-614

Henderson, NV 89052, USA

Product

Browser Extension Assistant by scite Citation Statement Search Reference Check Visualizations Dashboards Explore Journals Explore Organizations Explore Funders Embedding Badge Embedding Citation Search Pricing

Resources

Blog Help & FAQ Accessibility Statement API Terms For Universities & Governments For Researchers For Publishers For Corporate, Pharma & Enterprise Author Marketing Become an Affiliate Get an organization trial or quote scite Data & Services

About

News & Press Careers Read our Paper Coverage

Blog Terms and Conditions API Terms Privacy Policy Contact Cookie Preferences Do Not Sell or Share My Personal Information

Copyright © 2024 scite LLC. All rights reserved.

Made with 💙 for researchers

Part of the Research Solutions Family.