Machine Learning (In) Security: A Stream of Problems

Ceschin, Fabrício; Gomes, Heitor Murilo; Botacin, Marcus; Bifet, Albert; Pfahringer, Bernhard; Oliveira, Luiz S.; Grégio, André

doi:10.48550/arxiv.2010.16045

Cited by 6 publications

(5 citation statements)

References 98 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Idea drift is pertinent for malware detection when static file analysis is performed, according to earlier research [7]. Prior studies have looked into methods for identifying idea drift in malware families [8] and warning human analysts when it is found during malware detection. The efficiency of several machine learning properties for detecting fraudulent websites is examined in work [9] However, the use of Host and Content capabilities is the extent of their activity.…”

Section: Related Workmentioning

confidence: 99%

Concept Drift Analysis and Malware Attack Detection System Using Secure Adaptive Windowing

Alsuwat¹,

Solaiman²,

Alsuwat³

2023

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

Concept drift is a main security issue that has to be resolved since it presents a significant barrier to the deployment of machine learning (ML) models. Due to attackers' (and/or benign equivalents') dynamic behavior changes, testing data distribution frequently diverges from original training data over time, resulting in substantial model failures. Due to their dispersed and dynamic nature, distributed denial-of-service attacks pose a danger to cybersecurity, resulting in attacks with serious consequences for users and businesses. This paper proposes a novel design for concept drift analysis and detection of malware attacks like Distributed Denial of Service (DDOS) in the network. The goal of this architecture combination is to accurately represent data and create an effective cyber security prediction agent. The intrusion detection system and concept drift of the network has been analyzed using secure adaptive windowing with website data authentication protocol (SAW_WDA). The network has been analyzed by authentication protocol to avoid malware attacks. The data of network users will be collected and classified using multilayer perceptron gradient decision tree (MLPGDT) classifiers. Based on the classification output, the decision for the detection of attackers and authorized users will be identified. The experimental results show output based on intrusion detection and concept drift analysis systems in terms of throughput, end-end delay, network security, network concept drift, and results based on classification with regard to accuracy, memory, and precision and F-1 score.

show abstract

Section: Related Workmentioning

confidence: 99%

Concept Drift Analysis and Malware Attack Detection System Using Secure Adaptive Windowing

Alsuwat¹,

Solaiman²,

Alsuwat³

2023

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

show abstract

“…Cinco classificadores foram escolhidos para a avaliação: XGBoost, NuSVC, RadiusNeighbors, AdaBoost e stochastic gradient descent (SGD). Os algoritmos selecionados são populares para detecção de intrusões baseada em anomalias, e sua diversificação permite que se observe como a proposta se comporta com estratégias variadas de classificação [Mishra et al 2018, Ceschin et al 2020.…”

Section: Objetivos E Experimentos Realizadosunclassified

Uso de Chamadas WASI para a Identificação de Ameaças em Aplicações WebAssembly

Heinrich,

Will,

Obelheiro

et al. 2023

Anais Do XXIII Simpósio Brasileiro De Segurança Da Informação E De Sistemas Computacionais (SBSeg 2023)

View full text Add to dashboard Cite

WebAssembly (ou Wasm) é um formato de bytecode que vem ganhando rápida adoção devido a seu bom desempenho, representação compacta, e portabilidade. Ele é mais usado como alvo de compilação para linguagens de programação de alto nível, como C, C++, Go e Rust, podendo ser executado dentro de navegadores Web ou em runtimes nativos. Embora a segurança seja uma meta do projeto do WebAssembly, ainda existem problemas com código malicioso, especialmente para aplicações Web. Este artigo introduz um método para realizar detecção baseada em anomalias de binários Wasm maliciosos, por meio de análise dinâmica. É proposta uma classificação de chamadas WASI – equivalentes no Wasm a chamadas de sistema – de acordo com seu risco e funcionalidade, a qual é usada para categorizar as chamadas realizadas por binários Wasm, o que permite detectar binários maliciosos usando modelos de aprendizagem de máquina. Os resultados obtidos mostram que esta é uma abordagem promissora para a identificação de código WebAssembly malicioso.

show abstract

“…Fig. 2 illustrates the overview learning framework of PE malware detection [18], which generally consists of three steps, including data acquisition, feature engineering as well as learning from models and predictions. In the following, we are going to introduce each step at a glance.…”

Section: Overviewmentioning

confidence: 99%

“…Feature engineering aims to extract the intrinsic properties of PE files that are most likely to be used for distinguishing malware from goodware, and then generates corresponding numeric features for representation. From different perspectives of properties of PE files, there is a large body of work on extracting various features, which can be generally categorized into three broad category: static features, dynamic features and hybrid features [18,106,142] and summarized in Table 1.…”

Section: Feature Engineeringmentioning

confidence: 99%

Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art

Ling¹,

Wu²,

Zhang³

et al. 2021

Preprint

View full text Add to dashboard Cite

The malware has been being one of the most damaging threats to computers that span across multiple operating systems and various file formats. To defend against the ever-increasing and ever-evolving threats of malware, tremendous efforts have been made to propose a variety of malware detection methods that attempt to effectively and efficiently detect malware so as to mitigate possible damages as earlier as possible. Recent studies have shown that, one the one hand, existing machine learning (ML) and deep learning (DL) techniques enable the superior detection of newly emerging and previously unseen malware. However, on the other hand, ML and DL models are inherently vulnerable to adversarial attacks in the form of adversarial examples, which are maliciously generated by slightly and carefully perturbing the legitimate inputs to confuse the targeted models. Basically, adversarial attacks are initially extensively studied in the domain of computer vision like image classification, and some quickly expanded to other domains, including natural language processing, audio recognition and even malware detection which is extremely critical to computers.In this paper, we focus on malware with the file format of portable executable (PE) in the family of Windows operating systems, namely Windows PE malware, as a representative case to study the adversarial attack methods in such adversarial settings. To be specific, we start by first outlining the general learning framework of Windows PE malware detection based on ML/DL and subsequently highlighting three unique challenges of performing adversarial attacks in the context of Windows PE malware. We then conduct a comprehensive and systematic review to categorize the state-of-the-art adversarial attacks against PE malware detection, as well as corresponding defenses to increase the robustness of Windows PE malware detection. We conclude the paper by first presenting other related attacks against Windows PE malware detection beyond the adversarial attacks and then shedding light on future research directions and opportunities. In addition, a curated resource list of adversarial attacks and defenses for Windows PE malware detection is also available at https://github.com/ryderling/adversarial-attacks-and-defenses-for-windows-pe-malware-detection. CCS Concepts: • Security and privacy → Intrusion/anomaly detection and malware mitigation; • Theory of computation → Adversarial learning.

show abstract

Machine Learning (In) Security: A Stream of Problems

Cited by 6 publications

References 98 publications

Concept Drift Analysis and Malware Attack Detection System Using Secure Adaptive Windowing

Concept Drift Analysis and Malware Attack Detection System Using Secure Adaptive Windowing

Uso de Chamadas WASI para a Identificação de Ameaças em Aplicações WebAssembly

Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art

Contact Info

Product

Resources

About