On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Attack limitations. <s> Today's Internet intrusion detection systems (IDSes) monitor edge networks' DMZs to identify and/or filter malicious flows. While an IDS helps protect the hosts on its local edge network from compromise and denial of service, it cannot alone effectively intervene to halt and reverse the spreading of novel Internet worms. Generation of the worm signatures required by an IDS--the byte patterns sought in monitored traffic to identify worms--today entails non-trivial human labor, and thus significant delay: as network operators detect anomalous behavior, they communicate with one another and manually study packet traces to produce a worm signature. Yet intervention must occur early in an epidemic to halt a worm's spread. In this paper, we describe Autograph, a system that automatically generates signatures for novel Internet worms that propagate using TCP transport. Autograph generates signatures by analyzing the prevalence of portions of flow payloads, and thus uses no knowledge of protocol semantics above the TCP level. It is designed to produce signatures that exhibit high sensitivity (high true positives) and high specificity (low false positives); our evaluation of the system on real DMZ traces validates that it achieves these goals. We extend Autograph to share port scan reports among distributed monitor instances, and using trace-driven simulation, demonstrate the value of this technique in speeding the generation of signatures for novel worms. Our results elucidate the fundamental trade-off between early generation of signatures for novel worms and the specificity of these generated signatures. <s> BIB001 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Attack limitations. <s> We present a payload-based anomaly detector, we call PAYL, for intrusion detection. PAYL models the normal application payload of network traffic in a fully automatic, unsupervised and very effecient fashion. We first compute during a training phase a profile byte frequency distribution and their standard deviation of the application payload flowing to a single host and port. We then use Mahalanobis distance during the detection phase to calculate the similarity of new data against the pre-computed profile. The detector compares this measure against a threshold and generates an alert when the distance of the new input exceeds this threshold. We demonstrate the surprising effectiveness of the method on the 1999 DARPA IDS dataset and a live dataset we collected on the Columbia CS department network. In once case nearly 100% accuracy is achieved with 0.1% false positive rate for port 80 traffic. <s> BIB002 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Attack limitations. <s> It is widely believed that content-signature-based intrusion detection systems (IDS) are easily evaded by polymorphic worms, which vary their payload on every infection attempt. In this paper, we present Polygraph, a signature generation system that successfully produces signatures that match polymorphic worms. Polygraph generates signatures that consist of multiple disjoint content substrings. In doing so, Polygraph leverages our insight that for a real-world exploit to function properly, multiple invariant substrings must often be present in all variants of a payload; these substrings typically correspond to protocol framing, return addresses, and in some cases, poorly obfuscated code. We contribute a definition of the polymorphic signature generation problem; propose classes of signature suited for matching polymorphic worm payloads; and present algorithms for automatic generation of signatures in these classes. Our evaluation of these algorithms on a range of polymorphic worms demonstrates that Polygraph produces signatures for polymorphic worms that exhibit low false negatives and false positives. <s> BIB003 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Attack limitations. <s> New features of the PAYL anomalous payload detection sensor are demonstrated to accurately detect and generate signatures for zero-day worms. Experimental evidence demonstrates that site-specific packet content models are capable of detecting new worms with high accuracy in a collaborative security system. A new approach is proposed that correlates ingress/egress payload alerts to identify the worm's initial propagation. The method also enables automatic signature generation that can be deployed immediately to network firewalls and content filters to proactively protect other hosts. We also propose a collaborative privacy-preserving security strategy whereby different hosts can exchange PAYL signatures to increase accuracy and mitigate against false positives. The important principle demonstrated is that correlating multiple alerts identifies true positives from the set of anomaly alerts and reduces incorrect decisions producing accurate mitigation. <s> BIB004 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Attack limitations. <s> Several syntactic-based automatic worm signature generators, e.g., Polygraph, have recently been proposed. These systems typically assume that a set of suspicious flows are provided by a flow classifier, e.g., a honeynet or an intrusion detection system, that often introduces "noise" due to difficulties and imprecision inflow classification. The algorithms for extracting the worm signatures from the flow data are designed to cope with the noise. It has been reported that these systems can handle a fairly high noise level, e.g., 80% for Polygraph. In this paper, we show that if noise is introduced deliberately to mislead a worm signature generator, a much lower noise level, e.g., 50%, can already prevent the system from reliably generating useful worm signatures. Using Polygraph as a case study, we describe a new and general class of attacks whereby a worm can combine polymorphism and misleading behavior to intentionally pollute the dataset of suspicious flows during its propagation and successfully mislead the automatic signature generation process. This study suggests that unless an accurate and robust flow classification process is in place, automatic syntactic-based signature generators are vulnerable to such noise injection attacks. <s> BIB005 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Attack limitations. <s> Defending a server against Internet worms and defending a user's email inbox against spam bear certain similarities. In both cases, a stream of samples arrives, and a classifier must automatically determine whether each sample falls into a malicious target class (e.g., worm network traffic, or spam email). A learner typically generates a classifier automatically by analyzing two labeled training pools: one of innocuous samples, and one of samples that fall in the malicious target class. ::: ::: Learning techniques have previously found success in settings where the content of the labeled samples used in training is either random, or even constructed by a helpful teacher, who aims to speed learning of an accurate classifier. In the case of learning classifiers for worms and spam, however, an adversary controls the content of the labeled samples to a great extent. In this paper, we describe practical attacks against learning, in which an adversary constructs labeled samples that, when used to train a learner, prevent or severely delay generation of an accurate classifier. We show that even a delusive adversary, whose samples are all correctly labeled, can obstruct learning. We simulate and implement highly effective instances of these attacks against the Polygraph [15] automatic polymorphic worm signature generation algorithms. <s> BIB006 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Attack limitations. <s> A very effective means to evade signature-based intrusion detection systems (IDS) is to employ polymorphic techniques to generate attack instances that do not share a fixed signature. Anomaly-based intrusion detection systems provide good defense because existing polymorphic techniques can make the attack instances look different from each other, but cannot make them look like normal. In this paper we introduce a new class of polymorphic attacks, called polymorphic blending attacks, that can effectively evade byte frequency-based network anomaly IDS by carefully matching the statistics of the mutated attack instances to the normal profiles. The proposed polymorphic blending attacks can be viewed as a subclass of the mimicry attacks. We take a systematic approach to the problem and formally describe the algorithms and steps required to carry out such attacks. We not only show that such attacks are feasible but also analyze the hardness of evasion under different circumstances. We present detailed techniques using PAYL, a byte frequency-based anomaly IDS, as a case study and demonstrate that these attacks are indeed feasible. We also provide some insight into possible countermeasures that can be used as defense. <s> BIB007
As in the classification case, the attack is limited by the amount of noise that the attacker can inject. Depending on the density of the data, the attacker may be required to introduce a large number of attack points to cause significant degradation in performance. 6.5. Other Attacks 6.5.1. Attacks on ASG. BIB005 propose an attack against Polygraph BIB003 ], a system for automatically generating signatures for the detection of polymorphic worms. The attack assumes that an attacker who controls host A, and wants to infect host B, will send a malicious flow containing the attack code. The hope is that host B will be used for collecting flows for input into Polygraph. The attack works by sending extra flows along with all malicious flows, which are constructed to not actually perform any attack but contain specifically crafted data that will cause the generated signatures to only include data related to the protocol framework rather than invariants related to the worm, effectively rendering the signature useless. The false flows are generated by taking a copy of the malicious flow and applying several transformations over it. These include randomly permuting bytes and injecting substrings from legitimate flows. The attack is tested on a recreation of Polygraph using the Apache Knacker exploit for the polymorphic worm, with flows collected from the university network for use as innocuous traffic. The original Polygraph paper claims that 80% noise is required to affect the system, but the authors find that one false flow per malicious flow can result in useless signatures up to 44% of the time. If two flows are used, this increases to up to 85%. BIB006 propose a causative integrity attack against conjunction learners (of which Polygraph is an example), dubbed red herring attacks. The attack involves including spurious features into attack samples, which will be included in signatures. To evade detection, the attacker then stops including the extra features. This attack only works on conjunction learners and is not effective against other ML algorithms, such as Bayes. For Bayes learners, they propose a causative availability attack, dubbed the correlated outlier attack. In this attack, the attack sample includes spurious features that appear in legitimate samples. This increases the Bayes score of legitimate samples, leading to a choice of either high FPs or FNs. Chung and Mok [2006, 2007] propose "allergy attacks" against the Autograph BIB001 signature generator. Allergy attacks have a goal of performing a denialof-service attack by leading the generator to produce signatures that match to normal traffic. The attack is performed by first sending attack traffic that causes Autograph to mark the node as suspicious, then traffic that resembles legitimate traffic. The attack can be supplemented with a corpus so that it will also affect Polygraph and similar automatic signature generation systems. The authors show that the attack is successful with only a small number of packets required to cause a target site to be blacklisted. 6.5.2. Attacks on IDSs. BIB007 propose polymorphic blending attacks against the PAYL, a byte frequency-based IDS BIB002 BIB004 . The attack extends polymorphic attacks by adding a blending component that, like mimicry attacks, matches the statistics of mutated attack instances to normal traffic profiles to evade byte frequency-based networks' anomaly IDSs. This is done by "encrypting" the packet payloads by using a substitution table that replaces bytes in the original packet with bytes in the target distribution. Padding is also added, and packets can be split to match the normal distribution. The substitution table is sent along with the packet, as well as a "decrypter" that can recover the original packet. The attack also ensures that the attack distribution matches the normal distribution despite the table and decrypter being included. The attack is tested on both the 1-gram and 2-gram variants of PAYL, using the MS03-022 vulnerability as the base attack. The normal traffic distribution is taken from 1 day collected from a university network, and the training set for PAYL is taken from a further 14 days. The attacks are tested with target packet lengths of 418,730 and 1,460. Such attacks are shown to be effective in reducing the anomaly score output by PAYL to below thresholds that would realistically be used. They also find that increasing the number of packets used by the attack (meaning smaller individual packets) further reduced the anomaly score, as the smaller packets could be made to more closely match the normal distribution. The authors provide a formal analysis of the attack in BIB007 .