Mimicking anti-viruses with machine learning and entropy profiles

Menéndez, Héctor D. ORCID logoORCID: https://orcid.org/0000-0002-6314-3725 and Llorente, José Luis (2019) Mimicking anti-viruses with machine learning and entropy profiles. Entropy, 21 (5) , 513. ISSN 1099-4300 [Article] (doi:10.3390/e21050513)

PDF - Published version (with publisher's formatting)
Available under License Creative Commons Attribution 4.0.

Download (967kB) | Preview


The quality of anti-virus software relies on simple patterns extracted from binary files. Although these patterns have proven to work on detecting the specifics of software, they are extremely sensitive to concealment strategies, such as polymorphism or metamorphism. These limitations also make anti-virus software predictable, creating a security breach. Any black hat with enough information about the anti-virus behaviour can make its own copy of the software, without any access to the original implementation or database. In this work, we show how this is indeed possible by combining entropy patterns with classification algorithms. Our results, applied to 57 different anti-virus engines, show that we can mimic their behaviour with an accuracy close to 98% in the best case and 75% in the worst, applied on Windows’ disk resident malware.

Item Type: Article
Keywords (uncontrolled): anti-virus; classification; malware; mimicking; mimickAV; entropy profiles
Research Areas: A. > School of Science and Technology > Computer Science
Item ID: 28780
Notes on copyright: © 2019 by the authors.
Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (http://creativecommons.org/licenses/by/4.0/).
Useful Links:
Depositing User: Hector Menendez Benito
Date Deposited: 02 Feb 2020 19:06
Last Modified: 05 Feb 2020 11:20
URI: https://eprints.mdx.ac.uk/id/eprint/28780

Actions (login required)

View Item View Item


Activity Overview
6 month trend
6 month trend

Additional statistics are available via IRStats2.