Mimicking anti-viruses with machine learning and entropy profiles

Menéndez, Héctor D. ORCID: https://orcid.org/0000-0002-6314-3725 and Llorente, José Luis (2019) Mimicking anti-viruses with machine learning and entropy profiles. Entropy, 21 (5) , 513. ISSN 1099-4300 [Article] (doi:10.3390/e21050513)

Preview

PDF - Published version (with publisher's formatting) Available under License Creative Commons Attribution 4.0. Download (967kB) | Preview

Abstract

The quality of anti-virus software relies on simple patterns extracted from binary files. Although these patterns have proven to work on detecting the specifics of software, they are extremely sensitive to concealment strategies, such as polymorphism or metamorphism. These limitations also make anti-virus software predictable, creating a security breach. Any black hat with enough information about the anti-virus behaviour can make its own copy of the software, without any access to the original implementation or database. In this work, we show how this is indeed possible by combining entropy patterns with classification algorithms. Our results, applied to 57 different anti-virus engines, show that we can mimic their behaviour with an accuracy close to 98% in the best case and 75% in the worst, applied on Windows’ disk resident malware.

Actions (login required)

View Item

Statistics

DownloadsShow export options

Export as CSVXMLJSON

Activity Overview

6 month trend

102Downloads

6 month trend

138Hits

Additional statistics are available via IRStats2.