Evading Machine Learning Botnet Detection Models via Deep Reinforcement Learning

Wu, Di; Fang, Binxing; Wang, Junnan; Liu, Qixu; Cui, Xiang

doi:10.1109/icc.2019.8761337

Cited by 55 publications

(69 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…However, surprisingly, proper analyses and efficient solutions to this menace are scarce in the cybersecurity domain. The field of network intrusion detection is poorly investigated [10,11], while multiple works exist in the areas of malware, phishing, and spam detection [6,[12][13][14][15][16][17]. In particular, although several studies have shown the effectiveness of adversarial evasion attacks against botnet detectors [10,11,18,19], there is a lack of proposals to counter this menace that are feasible for real world environments.…”

Section: Introductionmentioning

confidence: 99%

AppCon: Mitigating Evasion Attacks to ML Cyber Detectors

et al. 2020

View full text Add to dashboard Cite

Adversarial attacks represent a critical issue that prevents the reliable integration of machine learning methods into cyber defense systems. Past work has shown that even proficient detectors are highly affected just by small perturbations to malicious samples, and that existing countermeasures are immature. We address this problem by presenting AppCon, an original approach to harden intrusion detectors against adversarial evasion attacks. Our proposal leverages the integration of ensemble learning to realistic network environments, by combining layers of detectors devoted to monitor the behavior of the applications employed by the organization. Our proposal is validated through extensive experiments performed in heterogeneous network settings simulating botnet detection scenarios, and consider detectors based on distinct machine- and deep-learning algorithms. The results demonstrate the effectiveness of AppCon in mitigating the dangerous threat of adversarial attacks in over 75% of the considered evasion attempts, while not being affected by the limitations of existing countermeasures, such as performance degradation in non-adversarial settings. For these reasons, our proposal represents a valuable contribution to the development of more secure cyber defense platforms.

show abstract

Section: Introductionmentioning

confidence: 99%

AppCon: Mitigating Evasion Attacks to ML Cyber Detectors

et al. 2020

View full text Add to dashboard Cite

show abstract

“…e literature [75] proposed a new anti-botnet traffic generator framework based on deep reinforcement learning (DRL), which could effectively generate reverse traffic flow through the RL algorithm and Markov decision process (MDP).…”

Section: Fnnmentioning

confidence: 99%

Survey on Botnet Detection Techniques: Classification, Methods, and Evaluation

Xing

Hui

Zhao

et al. 2021

Mathematical Problems in Engineering

View full text Add to dashboard Cite

With the continuous evolution of the Internet, as well as the development of the Internet of Things, smart terminals, cloud platforms, and social platforms, botnets showing the characteristics of platform diversification, communication concealment, and control intelligence. This survey analyzes and compares the most important efforts in the botnet detection area in recent years. It studies the mechanism characteristics of botnet architecture, life cycle, and command and control channel and provides a classification of botnet detection techniques. It focuses on the application of advanced technologies such as deep learning, complex network, swarm intelligence, moving target defense (MTD), and software-defined network (SDN) for botnet detection. From the four dimensions of service, intelligence, collaboration, and assistant, a common bot detection evaluation system (CBDES) is proposed, which defines a new global capability measurement standard. Combing with expert scores and objective weights, this survey proposes quantitative evaluation and gives a visual representation for typical detection methods. Finally, the challenges and future trends in the field of botnet detection are summarized.

show abstract

“…An example of a similar implementation is the fast gradient sign method (FGSM) 12 . Additionally, there are some other non-differentiable objective based methods in the area of reinforcement learning 13,14 that have been explored. These methods are designed with an underlying assumption that the distribution of the new data generated from the ' ′  network of these systems is significantly different form the ones that the IDS ( ' ′  network) is trained on.…”

Section: Related Workmentioning

confidence: 99%

DRLDO A Novel DRL based De obfuscation System for Defence Against Metamorphic Malware

2021

View full text Add to dashboard Cite

In this paper, we propose a novel mechanism to normalise metamorphic and obfuscated malware down at the opcode level and hence create an advanced metamorphic malware de-obfuscation and defence system. We name this system as DRLDO, for deep reinforcement learning based de-obfuscator. With the inclusion of the DRLDO as a sub-component, an existing Intrusion Detection System could be augmented with defensive capabilities against ‘zero-day’ attack from obfuscated and metamorphic variants of existing malware. This gains importance, not only because there exists no system till date that use advance DRL to intelligently and automatically normalise obfuscation down even to the opcode level, but also because the DRLDO system does not mandate any changes to the existing IDS. The DRLDO system does not even mandate the IDS’ classifier to be retrained with any new dataset containing obfuscated samples. Hence DRLDO could be easily retrofitted into any existing IDS deployment. We designed, developed, and conducted experiments on the system to evaluate the same against multiple-simultaneous attacks from obfuscations generated from malware samples from a standardised dataset that contain multiple generations of malware. Experimental results prove that DRLDO was able to successfully make the otherwise undetectable obfuscated variants of the malware detectable by an existing pre-trained malware classifier. The detection probability was raised well above the cut-off mark to 0.6 for the classifier to detect the obfuscated malware unambiguously. Further, the de-obfuscated variants generated by DRLDO achieved a very high correlation (of ≈ 0.99) with the base malware. This observation validates that the DRLDO system is actually learning to de-obfuscate and not exploiting a trivial trick.

show abstract

Evading Machine Learning Botnet Detection Models via Deep Reinforcement Learning

Cited by 55 publications

References 12 publications

AppCon: Mitigating Evasion Attacks to ML Cyber Detectors

AppCon: Mitigating Evasion Attacks to ML Cyber Detectors

Survey on Botnet Detection Techniques: Classification, Methods, and Evaluation

DRLDO A Novel DRL based De obfuscation System for Defence Against Metamorphic Malware

Contact Info

Product

Resources

About