Abusing File Processing in Malware Detectors for Fun and Profit

By Suman Sekhar Jana, Vitaly Shmatikov. 2012

95 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Practical Evasion of a Learning-Based Classifier: A Case Study (2014, background): “Our implementation takes a malicious file and simply attempts to modify all of its modifiable features at once to take on the values of the features of a chosen mimicry target, a benign file.”
NEZHA: Efficient Domain-Independent Differential Testing (2017, methodology): “PDF, or XZ (a popular archive format), according to their respective specifications, in order to accurately detect malicious content hidden in such files [41].”
Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations (2014, background): “The class of certificate validation vulnerabilities analyzed in this paper is complementary to and has little overlap with the vulnerabilities discovered in [29, 31].”
Looking at the bag is not enough to find the bomb: an evasion of structural methods for malicious PDF files detection (2013, background): “In a recent work, Jana and Shmatikov [23] showed that such kind of errors are pretty common in malware detectors, and actually represent the weakest link of malware defense.”
Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues (2013, background): “In this case, an adversary can easily create new malware instances that defeat such measurement heuristics [72].”
CryptoLock (and Drop It): Stopping Ransomware Attacks on User Data (2016, background): “Furthermore, recent research has shown that evading signature detection is possible with relative ease when the malware signatures used are too rigid [9], [24], [32], [33].”
The Art, Science, and Engineering of Fuzzing: A Survey (2018, background): “ing [140], [232], kernel testing [226], [204], [193], representation dependence testing [125], function detection [237], robustness evaluation [233], exploit development [115], GUI testing [206], signature generation [75], penetration testing [84], [162], embedded devices [161], and neural network t”
When a Tree Falls: Using Diversity in Ensemble Classifiers to Identify Evasion in Malware Detectors (2016, background): “One of the main weaknesses of systems that employ machine learning classification in adversarial environments is their susceptibility to evasion attacks.”
Detection of Malicious PDF Files Based on Hierarchical Document Structure (2013, background): “This reduces the opportunity for evasion techniques exploiting the ambiguities in file processing [16].”
Pattern Recognition Systems under Attack: Design Issues and Research Challenges (2014, background): “4.1, and how to re-engineer their design cycle, using a proactive approach.”
On the feasibility of online malware detection with performance counters (2013, background): “In a recent paper, Jana and Shmatikov [9] found that all of the 36 commercially available AV systems they examined could be bypassed.”