Mimicking Anti-Viruses with Machine Learning and Entropy Profiles
The quality of anti-virus software relies on simple patterns extracted from binary files. Although these patterns have proven to work on detecting the specifics of software, they are extremely sensitive to concealment strategies, such as polymorphism or metamorphism. These limitations also make anti...
Main Authors: | , |
---|---|
Format: | Article |
Language: | English |
Published: |
MDPI AG
2019-05-01
|
Series: | Entropy |
Subjects: | |
Online Access: | https://www.mdpi.com/1099-4300/21/5/513 |
id |
doaj-6a3cc6ef65b64c628d92e2aebb9ee9cb |
---|---|
record_format |
Article |
spelling |
doaj-6a3cc6ef65b64c628d92e2aebb9ee9cb2020-11-25T01:18:01ZengMDPI AGEntropy1099-43002019-05-0121551310.3390/e21050513e21050513Mimicking Anti-Viruses with Machine Learning and Entropy ProfilesHéctor D. Menéndez0José Luis Llorente1Computer Science Department, University College London, London WC1E 6BT, UKHoffmann-La Roche, 28027 Madrid, SpainThe quality of anti-virus software relies on simple patterns extracted from binary files. Although these patterns have proven to work on detecting the specifics of software, they are extremely sensitive to concealment strategies, such as polymorphism or metamorphism. These limitations also make anti-virus software predictable, creating a security breach. Any black hat with enough information about the anti-virus behaviour can make its own copy of the software, without any access to the original implementation or database. In this work, we show how this is indeed possible by combining entropy patterns with classification algorithms. Our results, applied to 57 different anti-virus engines, show that we can mimic their behaviour with an accuracy close to 98% in the best case and 75% in the worst, applied on Windows’ disk resident malware.https://www.mdpi.com/1099-4300/21/5/513anti-virusclassificationmalwaremimickingmimickAVentropy profiles |
collection |
DOAJ |
language |
English |
format |
Article |
sources |
DOAJ |
author |
Héctor D. Menéndez José Luis Llorente |
spellingShingle |
Héctor D. Menéndez José Luis Llorente Mimicking Anti-Viruses with Machine Learning and Entropy Profiles Entropy anti-virus classification malware mimicking mimickAV entropy profiles |
author_facet |
Héctor D. Menéndez José Luis Llorente |
author_sort |
Héctor D. Menéndez |
title |
Mimicking Anti-Viruses with Machine Learning and Entropy Profiles |
title_short |
Mimicking Anti-Viruses with Machine Learning and Entropy Profiles |
title_full |
Mimicking Anti-Viruses with Machine Learning and Entropy Profiles |
title_fullStr |
Mimicking Anti-Viruses with Machine Learning and Entropy Profiles |
title_full_unstemmed |
Mimicking Anti-Viruses with Machine Learning and Entropy Profiles |
title_sort |
mimicking anti-viruses with machine learning and entropy profiles |
publisher |
MDPI AG |
series |
Entropy |
issn |
1099-4300 |
publishDate |
2019-05-01 |
description |
The quality of anti-virus software relies on simple patterns extracted from binary files. Although these patterns have proven to work on detecting the specifics of software, they are extremely sensitive to concealment strategies, such as polymorphism or metamorphism. These limitations also make anti-virus software predictable, creating a security breach. Any black hat with enough information about the anti-virus behaviour can make its own copy of the software, without any access to the original implementation or database. In this work, we show how this is indeed possible by combining entropy patterns with classification algorithms. Our results, applied to 57 different anti-virus engines, show that we can mimic their behaviour with an accuracy close to 98% in the best case and 75% in the worst, applied on Windows’ disk resident malware. |
topic |
anti-virus classification malware mimicking mimickAV entropy profiles |
url |
https://www.mdpi.com/1099-4300/21/5/513 |
work_keys_str_mv |
AT hectordmenendez mimickingantiviruseswithmachinelearningandentropyprofiles AT joseluisllorente mimickingantiviruseswithmachinelearningandentropyprofiles |
_version_ |
1725144298692804608 |