On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Evasion Attacks: Classifiers <s> Automated intrusion response is an important unsolved problem in computer security. A system called pH (for process homeostasis) is described which can successfully detect and stop intrusions before the target system is compromised. In its current form, pH monitors every executing process on a computer at the system-call level, and responds to anomalies by either delaying or aborting system calls. The paper presents the rationale for pH, its design and implementation, and a set of initial experimental results. <s> BIB001 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Evasion Attacks: Classifiers <s> We examine several host-based anomaly detection systems and study their security against evasion attacks. First, we introduce the notion of a mimicry attack, which allows a sophisticated attacker to cloak their intrusion to avoid detection by the IDS. Then, we develop a theoretical framework for evaluating the security of an IDS against mimicry attacks. We show how to break the security of one published IDS with these methods, and we experimentally confirm the power of mimicry attacks by giving a worked example of an attack on a concrete IDS implementation. We conclude with a call for further research on intrusion detection from both attacker's and defender's viewpoints. <s> BIB002 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Evasion Attacks: Classifiers <s> Recent work has shown that properties of network traffic that remain observable after encryption, namely packet sizes and timing, can reveal surprising information about the traffic’s contents (e.g., the language of a VoIP call [29], passwords in secure shell logins [20], or even web browsing habits [21, 14]). While there are some legitimate uses for encrypted traffic analysis, these techniques also raise important questions about the privacy of encrypted communications. A common tactic for mitigating such threats is to pad packets to uniform sizes or to send packets at fixed timing intervals; however, this approach is often inefficient. In this paper, we propose a novel method for thwarting statistical traffic analysis algorithms by optimally morphing one class of traffic to look like another class. Through the use of convex optimization techniques, we show how to optimally modify packets in real-time to reduce the accuracy of a variety of traffic classifiers while incurring much less overhead than padding. Our evaluation of this technique against two published traffic classifiers for VoIP [29] and web traffic [14] shows that morphing works well on a wide range of network data—in some cases, simultaneously providing better privacy and lower overhead than naive <s> BIB003 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Evasion Attacks: Classifiers <s> Owed to their versatile functionality and widespread adoption, PDF documents have become a popular avenue for user exploitation ranging from large-scale phishing attacks to targeted attacks. In this paper, we present a framework for robust detection of malicious documents through machine learning. Our approach is based on features extracted from document metadata and structure. Using real-world datasets, we demonstrate the the adequacy of these document properties for malware detection and the durability of these features across new malware variants. Our analysis shows that the Random Forests classification method, an ensemble classifier that randomly selects features for each individual classification tree, yields the best detection rates, even on previously unseen malware. Indeed, using multiple datasets containing an aggregate of over 5,000 unique malicious documents and over 100,000 benign ones, our classification rates remain well above 99% while maintaining low false positives of 0.2% or less for different classification parameters and experimental scenarios. Moreover, the classifier has the ability to detect documents crafted for targeted attacks and separate them from broadly distributed malicious PDF documents. Remarkably, we also discovered that by artificially reducing the influence of the top features in the classifier, we can still achieve a high rate of detection in an adversarial setting where the attacker is aware of both the top features utilized in the classifier and our normality model. Thus, the classifier is resilient against mimicry attacks even with knowledge of the document features, classification method, and training set. <s> BIB004 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Evasion Attacks: Classifiers <s> Malicious PDF files have been used to harm computer security during the past two-three years, and modern antivirus are proving to be not completely effective against this kind of threat. In this paper an innovative technique, which combines a feature extractor module strongly related to the structure of PDF files and an effective classifier, is presented. This system has proven to be more effective than other state-of-the-art research tools for malicious PDF detection, as well as than most of antivirus in commerce. Moreover, its flexibility allows adopting it either as a stand-alone tool or as plug-in to improve the performance of an already installed antivirus. <s> BIB005 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Evasion Attacks: Classifiers <s> In security-sensitive applications, the success of machine learning depends on a thorough vetting of their resistance to adversarial data. In one pertinent, well-motivated attack scenario, an adversary may attempt to evade a deployed system at test time by carefully manipulating attack samples. In this work, we present a simple but effective gradient-based approach that can be exploited to systematically assess the security of several, widely-used classification algorithms against evasion attacks. Following a recently proposed framework for security evaluation, we simulate attack scenarios that exhibit different risk levels for the classifier by increasing the attacker's knowledge of the system and her ability to manipulate attack samples. This gives the classifier designer a better picture of the classifier performance under evasion attacks, and allows him to perform a more informed model selection (or parameter setting). We evaluate our approach on the relevant security task of malware detection in PDF files, and show that such systems can be easily evaded. We also sketch some countermeasures suggested by our analysis. <s> BIB006
6.1.1. Mimicry Attack. BIB002 introduced the idea of a mimicry attackan attack in which the goal is to craft an attack point that appears as a benign point and hence is an example of an exploratory, integrity attack that can be either targeted or indiscriminate. The attack either aims to move the attack point into the benign area (indiscriminate) or attempts to mimic a particular benign point (targeted). The attack attempts to modify the features of the attack point such that an anomaly detector or classifier labels the point as benign. The attack is limited by the ability of the attacker to modify the features under consideration by the learner. This attack typically does not require knowledge about the classification algorithm in use, as the attack is focused on exploiting knowledge of the distribution of malicious and benign points. Affected algorithms. The mimicry attack works by effectively reducing the distance between the attack point and benign points. The attack has been demonstrated against the random forest, Bayes, and SVM classifiers. As random forest is a multiple decision tree-based classifier, the attack should also be effective against single decision treebased algorithms such as C4.5. BIB006 demonstrate a gradient descent attack that theoretically works against any classifier with a differentiable discriminant function, including SVMs and neural networks. Demonstrated attacks. BIB002 demonstrate the mimicry attack against a host-based IDS with a goal of identifying any traces of system calls that are accepted by the IDS but still carry out some malicious activity. The attack can be performed by either adding no-ops (system calls that have no side effect on the system) or removing system calls that cause alarms by replacing them with a different sequence of calls, which achieve the same end result (in exploiting the system). An example of this is to replace a sequence that opens up a root shell with one that adds a new root user to the shadow file. The attack is mimicry because the attackers find a sequence of calls that are accepted (labeled as benign) by the IDS, and thus the attack "mimics" a legitimate sequence of system calls. The attack is tested against the pH IDS BIB001 by modifying the autowx attack script exploit. The attack is shown to be able to successfully evade the IDS. Srndic and Laskov [2014] demonstrate a mimicry attack against PDFRate BIB004 , a system for the detection of malicious PDF files. PDFRate uses the random forest classifier to assign a score to PDF files, indicating their maliciousness. The system extracts 202 features by reading the file at the byte level and applying regular expressions to extract the feature values. By inserting data into the space between the cross-reference table and the trailer in the PDF file, attacks can be performed that will influence the output of PDFRate but will not affect the rendering of the file in a normal PDF reader, which will parse the file and skip that data. To perform a mimicry attack, the modifiable features are set to match those of a benign file. The attack, using a surrogate classifier, tries different benign files until one is found that suitably reduces the score output by the surrogate. The article focuses on attacks where the feature set is known (around 70% of the features are described in the original work). Attacks are tested first on a local version of PDFRate that is built using the available knowledge based on the adversary, then the best strategy is applied and the result is uploaded to PDFRate, with a goal of reducing the score assigned to the file. The attacker can modify the values of 35 features and increment a further 33 features. This is partly limited by the interdependability of the features. The attacks when applied onto files, which are then uploaded to PDFRate, can reduce the output score by 28% to 42% for attacks. Interestingly, when using a surrogate classifier using SVM rather than random forest, and then uploading the attack points to PDFRate, the scores output by PDFRate are still significantly reduced. BIB006 demonstrate a mimicry attack with a gradient descent component against the SVM classifier and a neural network. The attack is considered in both the perfect knowledge (PK) situation, where the attacker knows all components of the classifier, and the limited knowledge (LK) situation, where the attacker only knows which classifier is in use and the feature set but not the training data or trained classifier (although an estimated surrogate training set can be produced). The attack modifies feature values until the attack point changes labels. This is performed using a gradient descent approach with a component that favors points which imitate benign points. Including the mimicry attack makes the attack suboptimal (when compared to the nonmimicry version described in Section 6.1.2). The attack is tested on two datasets: a dataset of handwritten digits (represented as greyscale images) for the PK case using a linear SVM classifier, and for malicious PDF detection (with features extracted according to previous work by BIB005 ) in both the PK and SK cases using both SVM and neural networks. The handwritten digits were modified by changing the greyscale pixel values, whereas the PDF files were modified by adding objects (and therefore keywords). In the handwritten digits example using SVM with the linear kernel, the attack when containing the mimicry component is slower (requiring more iterations) but can cause the digits to appear as other digits, and in the LK case this could lead to a higher probability of evading the target classifier, requiring up to 50 modifications to achieve a false negative (FN) rate of 1. In the malicious PDF example, using linear SVM, the mimicry attack is effective in both the PK and LK cases. Fifty modifications (iterations of the gradient descent) increases the FN rate to 1 or 0.75 for the PK and LK cases, respectively. For the RBF kernel, 15 modifications still increases the FN rate up to around 0.8 in the PK case or 0.6 in the LK case. The neural network is more susceptible to the mimicry attack, requiring only 20 modifications in the PK case to result in an FN rate of 1, whereas in the LK case an FN rate of 0.5 can be achieved with 50 modifications. When not using the mimicry component, 50 modifications in the PK case only results in a FN rate of 0.2. It is explained that as the pure gradient descent only finds a local minimal, this may not be enough to evade; however, when incorporating the mimicry component, the attack point is drawn toward an area densely populated by benign points. Traffic morphing, which shares similarities with the mimicry attack, has been shown to be effective against the Bayes classifier. BIB003 show that it can be enough to simply emulate the traffic feature(s) that is the focus of the detection system. They show that this works in the case of identifying Web pages by traffic volume using the Bayes classifier, for which the accuracy can be reduced from 98% to 4%, or 63% if the classifier is trained with attack samples. Attack limitations. The attack is limited in two ways. First, there could be features that are not modifiable to the extent required to perform the attack. There is also a limit on how far the malicious sample can be changed-the sample still needs to serve its original, malicious purpose. For example, in network traffic destination fields, IP addresses cannot be chosen arbitrarily. The attack also requires knowledge of what is seen as normal in the production learner, which may not be available (although this can usually be estimated). 6.1.2. Gradient Descent Attacks. The gradient descent attack is a relatively common attack within the literature. This attack is applied to both classifiers and clustering algorithms, and it applies a gradient descent function to find a state for the attack point that achieves the desired result (point misclassified). Gradient descent is an optimization algorithm that aims to minimize functions by iteratively moving a point (by changing parameter values) in the negative direction of the function gradient. In the evasion case, these are examples of exploratory integrity attacks. The typical approach is to generate an attack point and test its effectiveness on a surrogate learner. If the point is not sufficient, the gradient descent is applied and a new point is generated and tested until the desired result is achieved. In some cases, the gradient descent can be combined with a mimicry component to launch a targeted attack. Affected algorithms. Because the gradient descent attack is not targeting a particular design component of classifiers, the attack is applicable to most classifiers. The attack finds any attack point that achieves the desired result for the attacker. For example, the technique used by BIB006 , although only tested using SVM and neural networks, is theoretically applicable to any classifier with a differentiable discriminant function. We found example works (discussed in the following) against the SVM and random forest classifiers, as well as neural networks.