.png){kind=icon}
返回
Practical evasion attack against neural network-based macro-malware detection method
.png){kind=icon}
OA
AI
DOI：10.1007/s10586-024-04825-5.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
In recent years, various methods have been proposed to detect unknown malware using machine learning models. These models extract features from malware and classify them as benign or malicious. However, there have been reports of evasion attacks against machine learning-based malware detectors. Previous research has focused on these evasion attacks, particularly against models that detect Visual Basics for Applications (VBA) malware using natural language processing models such as Bag of Words (BoW) and Latent Semantic Indexing (LSI). However, these models rely on word frequency as a feature, overlooking the context, and their evaluation involved an equal number of benign and malicious samples, leaving their effectiveness in real-world scenarios unverified. To address these limitations, our study introduces a tokenizer that preserves word order during token conversion. We evaluated its accuracy using an imbalanced dataset and employed models such as recurrent neural networks (RNNs) and long short-term memory (LSTM) networks to understand the context of words. Its detection rate for malicious malware exceeds 0.8, indicating sufficient performance. Moreover, by incorporating words found only in benign samples as arguments in non-functional operations, we managed to reduce the evasion attack detection rate to as low as 0.89. Ultimately, we confirmed that the detection rate of malicious samples remained consistent in real-world conditions, demonstrating the effectiveness of our approach.
Keyword:
Evasion attack
Macro malware
Natural language processing
Deep neural network
期刊
C
IF:
4.1
论文数:
5.1K
被引数:
7.5K
机构
引用论文
A Feasibility Study on Evasion Attacks Against NLP-Based Macro Malware Detection Algorithms基于NLP的宏恶意软件检测算法规避攻击的可行性研究.png)
IEEE ACCESSOAAI
IEEE ACCESSIF3.6
OAAI分享收藏Tandem silylformylation–allyl(crotyl)silylation: a new approach to polyketide synthesisTetrahedron
TetrahedronIF0
PREAI
分享收藏
查看更多内容