A Survey of Stealth Malware Attacks, Mitigation Measures, and Steps Toward Autonomous Open World Solutions

By Ethan M. Rudd, Andras Rozsa, Manuel Günther, Terrance E. Boult. 2016

166 citations recorded by the source corpus.

As our professional, social, and financial existences become increasingly digitized and as our government, healthcare, and military infrastructures rely more on computer technologies, they present larger and more lucrative targets for malware. Stealth malware in particular poses an increased threat because it is specifically designed to evade detection mechanisms, spreading dormant, in the wild for extended periods of time, gathering sensitive information or positioning itself for a high-impact zero-day attack. Policing the growing attack surface requires the development of efficient anti-malware solutions with improved generalization to detect novel types of malware and resolve these occurrences with as little burden on human experts as possible. In this paper, we survey malicious stealth technologies as well as existing solutions for detecting and categorizing these countermeasures autonomously. While machine learning offers promising potential for increasingly autonomous solutions with improved generalization to new malware types, both at the network level and at the host level, our findings suggest that several flawed assumptions inherent to most recognition algorithms prevent a direct mapping between the stealth malware recognition problem and a machine learning solution. The most notable of these flawed assumptions is the closed world assumption: that no sample belonging to a class outside of a static training set will appear at query time. We present a formalized adaptive open world framework for stealth malware recognition and relate it mathematically to research from other machine learning domains.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Recent Advances in Open Set Recognition: A Survey (2018, background): “More works on intrusion detection in open set scenario can be found in [95].”
Learning and the Unknown: Surveying Steps toward Open World Recognition (2019, background): “The work in this area has received hundreds of citations from a wide range of application areas that need, or are using, OSR including: • Audio analysis (Battaglino, Lepauloux, and (Chiachia et al. 2014; Pinto et al. 2015; Rattani, Scheirer, and Ross 2015; Juefei-Xu and Savvides 2016; G¨unther et al”
Robust Malware Detection for Internet of (Battlefield) Things Devices Using Deep Eigenspace Learning (2019, background): “Intrusion and malware detection and prevention are two active research areas [1], [2], [3], [4], [5].”
Machine Learning in IoT Security: Current Solutions and Future Challenges (2019, background): “[45] outlined in detail, the stealth malware and its mitigation techniques.”
The Evolution of Android Malware and Android Analysis Techniques (2017, background): “For further study on the similarities between traditional and mobile malware construction (e.g., in terms of features, methods, threats) refer to Felt et al. [2011], Branco et al. [2012], Bayer et al. [2009], and Rudd et al. [2016].”