On the infeasibility of modeling polymorphic shellcode

169 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

A framework for quantitative security analysis of machine learning (2009, background): “In view of the recent surge of interest in machine learning applications in security – accompanied, however, by some skepticism whether machine learning can be ever made secure [1, 10, 12] – such reasoning may be instrumental in steering research into the right direction.”
When a Tree Falls: Using Diversity in Ensemble Classifiers to Identify Evasion in Malware Detectors (2016, background): “Applications of machine learning include clustering of malware families [7], [20], detection of malicious downloads [12], [34], detection of account misuse in social networks [14], [44], and detection of commonly exploited file formats such as Java archives [36] and documents [24], [25], [39].”
McPAD: A multiple classifier system for accurate payload-based anomaly detection (2009, methodology): “Polymorphic shell-code attacks automatically create new variants of the attack code before sending the actual intrusion attempt to a new victim, and are therefore very diﬃcult to detect using signature-based IDS [30].”
Casting out Demons: Sanitizing Training Data for Anomaly Sensors (2008, background): “[23] demonstrate the relative ease with which polymorphic attack engines can overwhelm signature–based detection methods.”