Getting ahead of the arms race: hothousing the coevolution of VirusTotal with a Packer

Menéndez, Héctor D. ORCID: https://orcid.org/0000-0002-6314-3725, Clark, David and T. Barr, Earl (2021) Getting ahead of the arms race: hothousing the coevolution of VirusTotal with a Packer. Entropy, 23 (4) , e395. ISSN 1099-4300 [Article] (doi:10.3390/e23040395)

[img] PDF - Published version (with publisher's formatting)
Available under License Creative Commons Attribution.

Download (436kB)

Abstract

Malware detection is in a coevolutionary arms race where the attackers and defenders are constantly seeking advantage. This arms race is asymmetric: detection is harder and more expensive than evasion. White hats must be conservative to avoid false positives when searching for malicious behaviour. We seek to redress this imbalance. Most of the time, black hats need only make incremental changes to evade them. On occasion, white hats make a disruptive move and find a new technique that forces black hats to work harder. Examples include system calls, signatures and machine learning. We present a method, called Hothouse, that combines simulation and search to accelerate the white hat’s ability to counter the black hat’s incremental moves, thereby forcing black hats to perform disruptive moves more often. To realise Hothouse, we evolve EEE, an entropy-based polymorphic packer for Windows executables. Playing the role of a black hat, EEE uses evolutionary computation to disrupt the creation of malware signatures. We enter EEE into the detection arms race with VirusTotal, the most prominent cloud service for running anti-virus tools on software. During our 6 month study, we continually improved EEE in response to VirusTotal, eventually learning a packer that produces packed malware whose evasiveness goes from an initial 51.8% median to 19.6%. We report both how well VirusTotal learns to detect EEE-packed binaries and how well VirusTotal forgets in order to reduce false positives. VirusTotal’s tools learn and forget fast, actually in about 3 days. We also show where VirusTotal focuses its detection efforts, by analysing EEE’s variants.

Item Type: Article
Keywords (uncontrolled): coevolution, adversarial machine learning, malware arm race, EEE, VirusTotal, hothouse
Research Areas: A. > School of Science and Technology > Computer Science
Item ID: 32879
Notes on copyright: Copyright: © 2021 by the authors. Licensee MDPI, Basel, Switzerland.
This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/)
Useful Links:
Depositing User: Jisc Publications Router
Date Deposited: 07 Apr 2021 11:54
Last Modified: 21 Apr 2021 01:17
URI: https://eprints.mdx.ac.uk/id/eprint/32879

Actions (login required)

View Item View Item

Statistics

Downloads
Activity Overview
3Downloads
22Hits

Additional statistics are available via IRStats2.