On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Emerging Host-Based Evasion Techniques <s> Attackers often try to evade an intrusion detection system (IDS) when launching their attacks. There have been several published studies in evasion attacks, some with available tools, in the research community as well as the "hackers'' community. Our recent empirical case study showed that some payload-based network anomaly detection systems can be evaded by a polymorphic blending attack (PBA). The main idea of a PBA is to create each polymorphic instance in such a way that the statistics of attack packet(s) match the normal traffic profile. In this paper, we present a formal framework for the open problem: given an anomaly detection system and an attack, can one automatically generate its PBA instances? We show that in general, generating a PBA that optimally matches the normal traffic profile is a hard problem (NP-complete). However, the problem of finding a PBA can be reduced to the SAT or ILP problems so that solvers available in those domains can be used to find a near-optimal solution. We also present a heuristic (hill-climbing) to find an approximate solution. Our framework can not only expose how the IDS can be exploited by a PBA but also suggest how the IDS can be improved to prevent the PBA. We have experimented with our framework using the PAYL 1-gram and 2-gram anomaly detection system, and the results have validated our framework. <s> BIB001 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Emerging Host-Based Evasion Techniques <s> Malicious code (or Malware) is defined as software that fulfills the deliberately harmful intent of an attacker. Malware analysis is the process of determining the behavior and purpose of a given Malware sample (such as a virus, worm, or Trojan horse). This process is a necessary step to be able to develop effective detection techniques and removal tools. Currently, Malware analysis is mostly a manual process that is tedious and time-intensive. To mitigate this problem, a number of analysis tools have been proposed that automatically extract the behavior of an unknown program by executing it in a restricted environment and recording the operating system calls that are invoked. The problem of dynamic analysis tools is that only a single program execution is observed. Unfortunately, however, it is possible that certain malicious actions are only triggered under specific circumstances (e.g., on a particular day, when a certain file is present, or when a certain command is received). In this paper, we propose a system that allows us to explore multiple execution paths and identify malicious actions that are executed only when certain conditions are met. This enables us to automatically extract a more complete view of the program under analysis and identify under which circumstances suspicious actions are carried out. Our experimental results demonstrate that many Malware samples show different behavior depending on input read from the environment. Thus, by exploring multiple execution paths, we can obtain a more complete picture of their actions. <s> BIB002 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Emerging Host-Based Evasion Techniques <s> Anti-virus vendors are confronted with a multitude of potentially malicious samples today. Receiving thousands of new samples every day is not uncommon. The signatures that detect confirmed malicious threats are mainly still created manually, so it is important to discriminate between samples that pose a new unknown threat and those that are mere variants of known malware. This survey article provides an overview of techniques based on dynamic analysis that are used to analyze potentially malicious samples. It also covers analysis programs that leverage these It also covers analysis programs that employ these techniques to assist human analysts in assessing, in a timely and appropriate manner, whether a given sample deserves closer manual inspection due to its unknown malicious behavior. <s> BIB003 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Emerging Host-Based Evasion Techniques <s> Malware includes several protections to complicate their analysis: the longer it takes to analyze a new malware sample, the longer the sample survives and the larger number of systems it compromises. Nowadays, new malware samples are analyzed dynamically using virtual environments (e.g., emulators, virtual machines, or debuggers). Therefore, malware incorporate a variety of tests to detect whether they are executed through such environments and obfuscate their behavior if they suspect their execution is being monitored. Several simple tests, we indistinctly call red-pills, have already been proposed in literature to detect whether the execution of a program is performed in a real or in a virtual environment. In this paper we propose an automatic and systematic technique to generate red-pills, specific for detecting if a program is executed through a CPU emulator. Using this technique we generated thousands of new red-pills, involving hundreds of different opcodes, for two publicly available emulators, which are widely used for analyzing malware. <s> BIB004 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Emerging Host-Based Evasion Techniques <s> Pattern recognition systems are increasingly being used in adversarial environments like network intrusion detection, spam filtering and biometric authentication and verification systems, in which an adversary may adaptively manipulate data to make a classifier ineffective. Current theory and design methods of pattern recognition systems do not take into account the adversarial nature of such kind of applications. Their extension to adversarial settings is thus mandatory, to safeguard the security and reliability of pattern recognition systems in adversarial environments. In this paper we focus on a strategy recently proposed in the literature to improve the robustness of linear classifiers to adversarial data manipulation, and experimentally investigate whether it can be implemented using two well known techniques for the construction of multiple classifier systems, namely, bagging and the random subspace method. Our results provide some hints on the potential usefulness of classifier ensembles in adversarial classification tasks, which is different from the motivations suggested so far in the literature. <s> BIB005 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Emerging Host-Based Evasion Techniques <s> Malware continues to remain one of the most important security problems on the Internet today. Whenever an anti-malware solution becomes popular, malware authors typically react promptly and modify their programs to evade defense mechanisms. For example, recently, malware authors have increasingly started to create malicious code that can evade dynamic analysis. One recent form of evasion against dynamic analysis systems is stalling code. Stalling code is typically executed before any malicious behavior. The attacker's aim is to delay the execution of the malicious activity long enough so that an automated dynamic analysis system fails to extract the interesting malicious behavior. This paper presents the first approach to detect and mitigate malicious stalling code, and to ensure forward progress within the amount of time allocated for the analysis of a sample. Experimental results show that our system, called HASTEN, works well in practice, and that it is able to detect additional malicious behavior in real-world malware samples. <s> BIB006 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Emerging Host-Based Evasion Techniques <s> The standard assumption of identically distributed training and test data is violated when test data are generated in response to a predictive model. This becomes apparent, for example, in the context of email spam filtering, where an email service provider employs a spam filter and the spam sender can take this filter into account when generating new emails. We model the interaction between learner and data generator as a Stackelberg competition in which the learner plays the role of the leader and the data generator may react on the leader's move. We derive an optimization problem to determine the solution of this game and present several instances of the Stackelberg prediction game. We show that the Stackelberg prediction game generalizes existing prediction models. Finally, we explore properties of the discussed models empirically in the context of email spam filtering. <s> BIB007 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Emerging Host-Based Evasion Techniques <s> In adversarial classification tasks like spam filtering, intrusion detection in computer networks, and biometric identity verification, malicious adversaries can design attacks which exploit vulnerabilities of machine learning algorithms to evade detection, or to force a classification system to generate many false alarms, making it useless. Several works have addressed the problem of designing robust classifiers against these threats, although mainly focusing on specific applications and kinds of attacks. In this work, we propose a model of data distribution for adversarial classification tasks, and exploit it to devise a general method for designing robust classifiers, focusing on generative classifiers. Our method is then evaluated on two case studies concerning biometric identity verification and spam filtering. <s> BIB008 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Emerging Host-Based Evasion Techniques <s> We investigate the emergence of the exploit-as-a-service model for driveby browser compromise. In this regime, attackers pay for an exploit kit or service to do the "dirty work" of exploiting a victim's browser, decoupling the complexities of browser and plugin vulnerabilities from the challenges of generating traffic to a website under the attacker's control. Upon a successful exploit, these kits load and execute a binary provided by the attacker, effectively transferring control of a victim's machine to the attacker. In order to understand the impact of the exploit-as-a-service paradigm on the malware ecosystem, we perform a detailed analysis of the prevalence of exploit kits, the families of malware installed upon a successful exploit, and the volume of traffic that malicious web sites receive. To carry out this study, we analyze 77,000 malicious URLs received from Google Safe Browsing, along with a crowd-sourced feed of blacklisted URLs known to direct to exploit kits. These URLs led to over 10,000 distinct binaries, which we ran in a contained environment. Our results show that many of the most prominent families of malware now propagate through driveby downloads--32 families in all. Their activities are supported by a handful of exploit kits, with Blackhole accounting for 29% of all malicious URLs in our data, followed in popularity by Incognito. We use DNS traffic from real networks to provide a unique perspective on the popularity of malware families based on the frequency that their binaries are installed by drivebys, as well as the lifetime and popularity of domains funneling users to exploits. <s> BIB009 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Emerging Host-Based Evasion Techniques <s> Pattern recognition and machine learning techniques have been increasingly adopted in adversarial settings such as spam, intrusion, and malware detection, although their security against well-crafted attacks that aim to evade detection by manipulating data at test time has not yet been thoroughly assessed. While previous work has been mainly focused on devising adversary-aware classification algorithms to counter evasion attempts, only few authors have considered the impact of using reduced feature sets on classifier security against the same attacks. An interesting, preliminary result is that classifier security to evasion may be even worsened by the application of feature selection. In this paper, we provide a more detailed investigation of this aspect, shedding some light on the security properties of feature selection against evasion attacks. Inspired by previous work on adversary-aware classifiers, we propose a novel adversary-aware feature selection model that can improve classifier security against evasion attacks, by incorporating specific assumptions on the adversary's data manipulation strategy. We focus on an efficient, wrapper-based implementation of our approach, and experimentally validate its soundness on different application examples, including spam and malware detection. <s> BIB010
We briefly review some techniques on the host side used by malware in the wild to evade detection. Recently, there has been an increasing amount of malware that provides methods of evading current detection and analytical systems. Evading signatures. Traditional defense systems (e.g., traditional antivirus and intrusion detection) often rely on signatures to detect attacks or malicious code. A signature characterizes a known attack by defining its characteristics. For example, in the context of malware, a signature could be a regular expression that matches the bytes found in a specific malicious file. Unfortunately, several obfuscation techniques have been proposed (and are used extensively) to counter signature-based detection. For example, polymorphism  ] is a technique that enables an attacker to mutate an existing malicious binary and create a completely new version from it while retaining its original functionality but remaining undetected by current signatures. The antivirus vendor Kaspersky recently reported detecting more than two unique malicious samples per second, likely the result of extensive application of polymorphic techniques  ]. Evading dynamic analysis systems. To overcome the limitations of signature-based analysis of malicious code, researchers use dynamic analysis tools, also called sandboxes BIB003 . These tools execute a binary in an instrumented environment and classify it as either benign or malicious depending on the observed behavior. To thwart automated dynamic analysis, malware authors have developed several checks (so-called red pills). To detect sandboxes, the checks leverage differences in execution characteristics between a real host and virtualized environments BIB001 or emulated systems BIB004 ]. Further, malware may execute its malicious payload or specific parts of its code only when some "trigger" fires (i.e., only when some specific precondition is satisfied) BIB002 . As another evasion technique, malware may use stalling code BIB006 , which delays execution of malicious activity just long enough that the automated analysis system stops the analysis having observed benign activity only and moves on. This technique simply leverages the fact that to analyze a large volume of programs, an analysis system must bound the time that it spends executing a single sample to a limited time (in the order of few minutes). Evading reputation systems. Another defensive approach that has gained traction in the past few years is the use of reputation information for network entities (servers or domain names). Malware authors have a crude but effective attack against such reputation blacklists: they use a certain server or domain for malicious purposes only for a very limited amount of time. Recent data from researchers at Google shows that this strategy is well in use: they studied domains hosting exploit kits used in driveby downloads and found that their median lifetime is only 2.5 hours BIB009 . Clearly, an effective blacklist should be able to detect the malicious domain and distribute this knowledge to all enforcement devices before the domain has been abandoned. It is unclear why secure ML algorithms are not in more widespread use within the field of C&C detection. In the following, we discuss possible reasons as to why secure ML is not in use. Lack of awareness. One obvious reason is simply a lack of awareness of secure ML algorithms. Unless one specifically looks toward the secure ML field, they are unlikely to be aware of the more secure algorithms, or even that the vulnerabilities in the simpler algorithms exist. Ease of access. More specifically, we mean access to an implementation of the code, either through an open source piece of available software, API, or an algorithm that is easy to implement by an academic. Even if a piece of software or API exists, it may not be available for the desired scenario without large amounts of preprocessing on the data to ensure that it is in the correct format. If we compare this to popular algorithms such as k-means or SVM, these have many implementations (in both software and libraries) that can easily be applied to almost any dataset. Reduced performance. It may be the case that secure ML algorithms, when compared to the nonsecure counterparts, achieve lower performance in terms of both processing time and key metrics (TPR/FPR and similar). When evaluating detection systems, these metrics are key selling points that elevate new work mentioned previously. Although this assumption is not true for all works, there are some examples in the literature. For example, BIB007 demonstrate an increase in execution time in the multiclassifier system from approximately 10 1 to more than 10 3 seconds using the largest training set. In terms of accuracy, some works BIB010 BIB008 ] show a reduction in performance when not under attack, whereas others show a slight increase BIB005 . Lack of clear security metrics. When choosing an ML algorithm, it is common to look to the standard performance metrics (TP/FP rates, precision, recall, computation efficiency, etc.) . In a nonsecure setting, these are usually sufficient in choosing one algorithm over another. However, as far as we are aware, there are currently no clear metrics for measuring the evasion resilience of ML algorithms. We believe that a lack of these metrics is one of the reasons more secure ML algorithms are not in use-there is currently no way to see a measurable benefit to their use over the simpler algorithms. This is not a trivial problem due to the large range of threat models that need to be considered, as the threat model in use impacts the achieved level of evasion resilience. Lack of evidence of attacks. The reason for not using secure algorithms could be purely because there is little to no evidence of attacks targeting ML in practical applications. Attackers are likely to evade detection using simpler methods instead of attacking ML algorithms. However, as systems mature, we should expect attackers to become more sophisticated in succeeding in their efforts to subvert it, and thus it is only a matter of time before attacks against ML become more commonplace.