Misleading worm signature generators using deliberate noise injection

Perdisci, Roberto; Dagon, David; Lee, Wenke; Fogla, Prahlad; Sharif, Muhammad

doi:10.1109/sp.2006.26

Cited by 135 publications

(118 citation statements)

References 13 publications

Supporting

Mentioning

118

Contrasting

Order By: Relevance

“…Another limitation which follows from the use of machine learning is the possibility of mimicry and poisoning attacks [e.g., 25,27,35]. While obfuscation strategies, such as repackaging, code reordering or junk code insertion do not affect DREBIN, renaming of activities and components between the learning and detection phase may impair discriminative features [30,38].…”

Section: Limitationsmentioning

confidence: 99%

“…While obfuscation strategies, such as repackaging, code reordering or junk code insertion do not affect DREBIN, renaming of activities and components between the learning and detection phase may impair discriminative features [30,38]. Similarly, an attacker may succeed in lowering the detection score of DREBIN by incorporating benign features or fake invariants into malicious applications [25,27]. Although such attacks against learning techniques cannot be ruled out in general, the thorough sanitization of learning data [see 7] and a frequent retraining on representative datasets can limit their impact.…”

Section: Limitationsmentioning

confidence: 99%

See 1 more Smart Citation

Drebin: Effective and Explainable Detection of Android Malware in Your Pocket

Arp

Spreitzenbarth

Hubner³

et al. 2014

Proceedings 2014 Network and Distributed System Security Symposium

1,729

1,686

View full text Add to dashboard Cite

Malicious applications pose a threat to the security of the Android platform. The growing amount and diversity of these applications render conventional defenses largely ineffective and thus Android smartphones often remain unprotected from novel malware. In this paper, we propose DREBIN, a lightweight method for detection of Android malware that enables identifying malicious applications directly on the smartphone. As the limited resources impede monitoring applications at run-time, DREBIN performs a broad static analysis, gathering as many features of an application as possible. These features are embedded in a joint vector space, such that typical patterns indicative for malware can be automatically identified and used for explaining the decisions of our method. In an evaluation with 123,453 applications and 5,560 malware samples DREBIN outperforms several related approaches and detects 94% of the malware with few false alarms, where the explanations provided for each detection reveal relevant properties of the detected malware. On five popular smartphones, the method requires 10 seconds for an analysis on average, rendering it suitable for checking downloaded applications directly on the device.

show abstract

Section: Limitationsmentioning

confidence: 99%

Section: Limitationsmentioning

confidence: 99%

Drebin: Effective and Explainable Detection of Android Malware in Your Pocket

Arp

Spreitzenbarth

Hubner³

et al. 2014

Proceedings 2014 Network and Distributed System Security Symposium

1,729

1,686

View full text Add to dashboard Cite

show abstract

“…An adversary can inject specially-crafted noise into one of these systems to force it to, little by little, learn a malicious behavior. This is called a poisoning attack and it has been proposed both for signature-based [28,29] and anomaly-based [30] NIDS.…”

Section: Attacks On Nidsmentioning

confidence: 99%

Randomized Anagram revisited

Pastrana

Orfila

Tapiador

et al. 2014

Journal of Network and Computer Applications

View full text Add to dashboard Cite

When compared to signature-based Intrusion Detection Systems (IDS), anomaly detectors present the potential advantage of detecting previously unseen attacks, which makes them an attractive solution against zero-day exploits and other attacks for which a signature is unavailable. Most anomaly detectors rely on machine learning algorithms to derive a model of normality that is later used to detect suspicious events. Such algorithms, however, are generally susceptible to evasion by means of carefully constructed attacks that are not recognized as anomalous. Different strategies to thwart evasion have been proposed over the last years, including the use of randomization to make somewhat uncertain how each packet will be processed. In this paper we analyze the strength of the randomization strategy suggested for Anagram, a well-known anomaly detector based on n-gram models. We show that an adversary who can interact with the system for a short period of time with inputs of his choosing will be able to recover the secret mask used to process packets. We describe and discuss an efficient algorithm to do this and report our experiences with a prototype implementation. Furthermore, we show that the specific form of randomization suggested for Anagram is a double-edged sword, as knowledge of the mask makes evasion easier than in the non-randomized case. We finally discuss a simple countermeasure to prevent our attacks.

show abstract

“…But they can be evaded by injecting well crafted fake anomalous flows into normal traffic, thereby misleading signature generation process [30].…”

Section: Related Workmentioning

confidence: 99%

“…Hamsa and LESG also proved that presence of noise in suspicious pool makes the problem NP hard [8,26]. Still there is little or no attention is paid in filtering noise in suspicious pool [30].…”

Section: Related Workmentioning

confidence: 99%