Getting ahead of the Arms Race: Hothousing the Coevolution of VirusTotal with a Packer

Malware detection is in a coevolutionary arms race where the attackers and defenders are constantly seeking advantage. This arms race is asymmetric: detection is harder and more expensive than evasion. White hats must be conservative to avoid false positives when searching for malicious behaviour. We seek to redress this imbalance. Most of the time, black hats need only make incremental changes to evade them. On occasion, white hats make a disruptive move and find a new technique that forces black hats to work harder. Examples include system calls, signatures and machine learning. We present a method, called Hothouse, that combines simulation and search to accelerate the white hat’s ability to counter the black hat’s incremental moves, thereby forcing black hats to perform disruptive moves more often. To realise Hothouse, we evolve EEE, an entropy-based polymorphic packer for Windows executables. Playing the role of a black hat, EEE uses evolutionary computation to disrupt the creation of malware signatures. We enter EEE into the detection arms race with VirusTotal, the most prominent cloud service for running anti-virus tools on software. During our 6 month study, we continually improved EEE in response to VirusTotal, eventually learning a packer that produces packed malware whose evasiveness goes from an initial 51.8% median to 19.6%. We report both how well VirusTotal learns to detect EEE-packed binaries and how well VirusTotal forgets in order to reduce false positives. VirusTotal’s tools learn and forget fast, actually in about 3 days. We also show where VirusTotal focuses its detection efforts, by analysing EEE’s variants.

Download Full-text

Monkeying around with venom: an increased resistance to α-neurotoxins supports an evolutionary arms race between Afro-Asian primates and sympatric cobras

BMC Biology ◽

10.1186/s12915-021-01195-x ◽

2021 ◽

Vol 19 (1) ◽

Author(s):

Richard J. Harris ◽

K. Anne-Isola Nekaris ◽

Bryan G. Fry

Keyword(s):

Nicotinic Acetylcholine Receptors ◽

Acetylcholine Receptors ◽

Selection Pressure ◽

Arms Race ◽

Last Common Ancestor ◽

Geographic Ranges ◽

Venomous Snakes ◽

Snake Detection ◽

Coevolutionary Arms Race

Abstract Background Snakes and primates have a multi-layered coevolutionary history as predators, prey, and competitors with each other. Previous work has explored the Snake Detection Theory (SDT), which focuses on the role of snakes as predators of primates and argues that snakes have exerted a selection pressure for the origin of primates’ visual systems, a trait that sets primates apart from other mammals. However, primates also attack and kill snakes and so snakes must simultaneously avoid primates. This factor has been recently highlighted in regard to the movement of hominins into new geographic ranges potentially exerting a selection pressure leading to the evolution of spitting in cobras on three independent occasions. Results Here, we provide further evidence of coevolution between primates and snakes, whereby through frequent encounters and reciprocal antagonism with large, diurnally active neurotoxic elapid snakes, Afro-Asian primates have evolved an increased resistance to α-neurotoxins, which are toxins that target the nicotinic acetylcholine receptors. In contrast, such resistance is not found in Lemuriformes in Madagascar, where venomous snakes are absent, or in Platyrrhini in the Americas, where encounters with neurotoxic elapids are unlikely since they are relatively small, fossorial, and nocturnal. Within the Afro-Asian primates, the increased resistance toward the neurotoxins was significantly amplified in the last common ancestor of chimpanzees, gorillas, and humans (clade Homininae). Comparative testing of venoms from Afro-Asian and American elapid snakes revealed an increase in α-neurotoxin resistance across Afro-Asian primates, which was likely selected against cobra venoms. Through structure-activity studies using native and mutant mimotopes of the α-1 nAChR receptor orthosteric site (loop C), we identified the specific amino acids responsible for conferring this increased level of resistance in hominine primates to the α-neurotoxins in cobra venom. Conclusion We have discovered a pattern of primate susceptibility toward α-neurotoxins that supports the theory of a reciprocal coevolutionary arms-race between venomous snakes and primates.

Download Full-text

Adversarial Machine Learning in Malware Detection: Arms Race between Evasion Attack and Defense

2017 European Intelligence and Security Informatics Conference (EISIC) ◽

10.1109/eisic.2017.21 ◽

2017 ◽

Cited By ~ 14

Author(s):

Lingwei Chen ◽

Yanfang Ye ◽

Thirimachos Bourlai

Keyword(s):

Machine Learning ◽

Malware Detection ◽

Arms Race ◽

Attack And Defense

Download Full-text

Time-frame Analysis of System Calls Behavior in Machine Learning-Based Mobile Malware Detection

2019 International Conference on Cyber Security for Emerging Technologies (CSET) ◽

10.1109/cset.2019.8904908 ◽

2019 ◽

Author(s):

Alejandro Guerra-Manzanares ◽

Sven Nomm ◽

Hayretdin Bahsi

Keyword(s):

Machine Learning ◽

Frame Analysis ◽

Malware Detection ◽

Time Frame ◽

System Calls ◽

Mobile Malware ◽

Mobile Malware Detection

Download Full-text

Exchange Spin Coupling from Gaussian Process Regression

10.26434/chemrxiv.12589541.v3 ◽

2020 ◽

Author(s):

Marc Philipp Bahlke ◽

Natnael Mogos ◽

Jonny Proppe ◽

Carmen Herrmann

Keyword(s):

Machine Learning ◽

Gaussian Process ◽

Gaussian Process Regression ◽

Molecular Magnets ◽

Molecular Structures ◽

Spin Coupling ◽

Structure Property ◽

Data Set ◽

Uncertainty Estimates

Heisenberg exchange spin coupling between metal centers is essential for describing and understanding the electronic structure of many molecular catalysts, metalloenzymes, and molecular magnets for potential application in information technology. We explore the machine-learnability of exchange spin coupling, which has not been studied yet. We employ Gaussian process regression since it can potentially deal with small training sets (as likely associated with the rather complex molecular structures required for exploring spin coupling) and since it provides uncertainty estimates (“error bars”) along with predicted values. We compare a range of descriptors and kernels for 257 small dicopper complexes and find that a simple descriptor based on chemical intuition, consisting only of copper-bridge angles and copper-copper distances, clearly outperforms several more sophisticated descriptors when it comes to extrapolating towards larger experimentally relevant complexes. Exchange spin coupling is similarly easy to learn as the polarizability, while learning dipole moments is much harder. The strength of the sophisticated descriptors lies in their ability to linearize structure-property relationships, to the point that a simple linear ridge regression performs just as well as the kernel-based machine-learning model for our small dicopper data set. The superior extrapolation performance of the simple descriptor is unique to exchange spin coupling, reinforcing the crucial role of choosing a suitable descriptor, and highlighting the interesting question of the role of chemical intuition vs. systematic or automated selection of features for machine learning in chemistry and material science.

Download Full-text

Leveraging Machine Learning to Characterize the Role of Socio-Economic Determinants on Physical Health and Well-Being Among Veterans

SSRN Electronic Journal ◽

10.2139/ssrn.3686845 ◽

2020 ◽

Author(s):

Christos Makridis ◽

David Zhao ◽

Cosmin (Adi) Bejan ◽

Gil Alterovitz

Keyword(s):

Machine Learning ◽

Physical Health ◽

Well Being ◽

Economic Determinants ◽

Health And Well Being

Download Full-text

Android Malware Detection Techniques: A Literature Review

Recent Patents on Engineering ◽

10.2174/1872212114999200710143847 ◽

2020 ◽

Vol 14 ◽

Author(s):

Meghna Dhalaria ◽

Ekta Gandotra

Keyword(s):

Machine Learning ◽

Deep Learning ◽

Malware Detection ◽

Future Research ◽

Android Malware ◽

Detection Techniques ◽

Android Malware Detection ◽

Future Research Directions ◽

To Come ◽

Tools And Techniques

Purpose: This paper provides the basics of Android malware, its evolution and tools and techniques for malware analysis. Its main aim is to present a review of the literature on Android malware detection using machine learning and deep learning and identify the research gaps. It provides the insights obtained through literature and future research directions which could help researchers to come up with robust and accurate techniques for classification of Android malware. Design/Methodology/Approach: This paper provides a review of the basics of Android malware, its evolution timeline and detection techniques. It includes the tools and techniques for analyzing the Android malware statically and dynamically for extracting features and finally classifying these using machine learning and deep learning algorithms. Findings: The number of Android users is expanding very fast due to the popularity of Android devices. As a result, there are more risks to Android users due to the exponential growth of Android malware. On-going research aims to overcome the constraints of earlier approaches for malware detection. As the evolving malware are complex and sophisticated, earlier approaches like signature based and machine learning based are not able to identify these timely and accurately. The findings from the review shows various limitations of earlier techniques i.e. requires more detection time, high false positive and false negative rate, low accuracy in detecting sophisticated malware and less flexible. Originality/value: This paper provides a systematic and comprehensive review on the tools and techniques being employed for analysis, classification and identification of Android malicious applications. It includes the timeline of Android malware evolution, tools and techniques for analyzing these statically and dynamically for the purpose of extracting features and finally using these features for their detection and classification using machine learning and deep learning algorithms. On the basis of the detailed literature review, various research gaps are listed. The paper also provides future research directions and insights which could help researchers to come up with innovative and robust techniques for detecting and classifying the Android malware.

Download Full-text