Nowhere Metamorphic Malware Can Hide - A Biological Evolution Inspired Detection Scheme

Abstract

The ability to detect metamorphic malware has generated significant research interest over recent years, particularly given its proliferation on mobile devices. Such malware is particularly hard to detect via signature-based intrusion detection systems due to its ability to change its code over time. This article describes a novel framework which generates sets of potential mutants and then uses them as training data to inform the development of improved detection methods (either in two separate phases or in an adversarial learning setting). We outline a method to implement the mutant generation step using an evolutionary algorithm, providing preliminary results that show that the concept is viable as the first steps towards instantiation of the full framework.

Improving Classification of Metamorphic Malware by Augmenting Training Data with a Diverse Set of Evolved Mutant Samples

“…Here, we focus on a two-phase approach to training better malware detectors: in the first phase, an EA is used to evolve a diverse set of mutants that are both malicious and evasive. This was described in previous work [3], [4]. The second-phase is proposed in this paper, in which the evolved data is shown to be beneficial in training improved ML detection models.…”

“…This section briefly discusses the algorithms employed in the generation of the training samples, which have been documented in [3], [4]. Then, the data-collection and pre-processing steps taken to obtain both normal and malware samples are described.…”

“…An EA is described in [14] that evolved samples that evaded a number of detection engines. Our recent work advanced this, using a multi-objective fitness function in [3] which optimised for samples that were evasive but also structurally and behaviourally diverse compared to the original malware, and using a quality-diversity algorithm in [4] to enhance the range of diversity and return multiple samples in one run. Moreover, an adversarial approach to generating pdf malware was described in [15], which used a genetic programming approach.…”

“…The adversarial samples used as training data and test data in this work were created using two evolutionary algorithms as described in [3] and [4]. The first algorithm used a steady state mutation-only EA [3] to generate variants, which were evaluated according to one of three fitness functions: minimises the behavioral similarity between a variant and the original malware; minimises the structural similarity between a variant and the original malware; minimises the detection rate with respect to 63 detection-engines. Only evolved samples that are both evasive and malicious are retained.…”

“…Here we propose a modified version of this method which uses an Evolutionary Algorithm (EA) first to evolve a diverse set of malware-mutants that are optimised with respect to their ability to evade detection by a large set of detection engines, while retaining their maliciousness. The evolution of these mutants has been previously described in recent papers [3], [4]; the former uses a classical EA to evolve an optimised mutant, whereas the latter uses a quality-diversity algorithm MAP-Elites to return a set of mutants which are diverse with respect to their behavioural and structural similarity to the original malware. In this paper, we investigate whether these mutants can be used to train better machine-learning models capable of detecting other potential unseen mutants.…”