Bringing a GAN to a Knife-Fight: Adapting Malware Communication to Avoid Detection

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21230%2F18%3A00322702" target="_blank" >RIV/68407700:21230/18:00322702 - isvavai.cz</a>

Výsledek na webu

<a href="https://ieeexplore.ieee.org/document/8424635/?part=1" target="_blank" >https://ieeexplore.ieee.org/document/8424635/?part=1</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1109/SPW.2018.00019" target="_blank" >10.1109/SPW.2018.00019</a>

Jazyk výsledku

angličtina

Název v původním jazyce

Bringing a GAN to a Knife-Fight: Adapting Malware Communication to Avoid Detection

Popis výsledku v původním jazyce

Generative Adversarial Networks (GANs) have been successfully used in a large number of domains. This paper proposes the use of GANs for generating network traffic in order to mimic other types of traffic. In particular, our method modifies the network behavior of a real malware in order to mimic the traffic of a legitimate application, and therefore avoid detection. By modifying the source code of a malware to receive parameters from a GAN, it was possible to adapt the behavior of its Command and Control (C2) channel to mimic the behavior of Facebook chat network traffic. In this way, it was possible to avoid the detection of new-generation Intrusion Prevention Systems that use machine learning and behavioral characteristics. A real-life scenario was successfully implemented using the Stratosphere behavioral IPS in a router, while the malware and the GAN were deployed in the local network of our laboratory, and the C2 server was deployed in the cloud. Results show that a GAN can successfully modify the traffic of a malware to make it undetectable. The modified malware also tested if it was being blocked and used this information as a feedback to the GAN. This work envisions the possibility of self-adapting malware and self-adapting IPS.

Název v anglickém jazyce

Bringing a GAN to a Knife-Fight: Adapting Malware Communication to Avoid Detection

Popis výsledku anglicky

Generative Adversarial Networks (GANs) have been successfully used in a large number of domains. This paper proposes the use of GANs for generating network traffic in order to mimic other types of traffic. In particular, our method modifies the network behavior of a real malware in order to mimic the traffic of a legitimate application, and therefore avoid detection. By modifying the source code of a malware to receive parameters from a GAN, it was possible to adapt the behavior of its Command and Control (C2) channel to mimic the behavior of Facebook chat network traffic. In this way, it was possible to avoid the detection of new-generation Intrusion Prevention Systems that use machine learning and behavioral characteristics. A real-life scenario was successfully implemented using the Stratosphere behavioral IPS in a router, while the malware and the GAN were deployed in the local network of our laboratory, and the C2 server was deployed in the cloud. Results show that a GAN can successfully modify the traffic of a malware to make it undetectable. The modified malware also tested if it was being blocked and used this information as a feedback to the GAN. This work envisions the possibility of self-adapting malware and self-adapting IPS.

Druh

D - Stať ve sborníku

CEP obor

—

OECD FORD obor

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Projekt

<a href="/cs/project/TH02010990" target="_blank" >TH02010990: Ludus: Kolaborativní obrana proti internetovým útokům pomocí stojového učení a teorie her</a><br>

Návaznosti

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Rok uplatnění

2018

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název statě ve sborníku

Proceedings of 2018 IEEE Symposium on Security and Privacy Workshops

ISBN

978-1-5386-8276-0

ISSN

—

e-ISSN

—

Počet stran výsledku

6

Strana od-do

70-75

Název nakladatele

IEEE Computer Society

Místo vydání

USA

Místo konání akce

San Francisco

Datum konání akce

24. 5. 2018

Typ akce podle státní příslušnosti

WRD - Celosvětová akce

Kód UT WoS článku

—