InfoBlender Webinar

Flow-based Detection and Proxy-based Evasion of Encrypted Malware C2 Traffic

Abstract:

State of the art deep learning techniques are known to be vulnerable to evasion attacks where an adversarial sample is generated from a malign sample and misclassified as benign. Detection of encrypted malware command and control traffic based on TCP/IP flow features can be framed as a learning task and is thus vulner- able to evasion attacks. However, unlike e.g. in image processing where generated adversarial samples can be directly mapped to images, going from flow features to actual TCP/IP packets requires crafting the sequence of packets, with no established approach for such crafting and a limitation on the set of modifiable features that such crafting allows. In this paper we discuss learning and evasion consequences of the gap between generated and crafted adversarial samples. We exemplify with a deep neural network detector trained on a public C2 traffic dataset, white-box adversarial learning, and a proxy-based approach for crafting longer flows. Our results show 1) the high evasion rate obtained by using generated adversarial sam- ples on the detector can be significantly reduced when using crafted adversarial samples; 2) robustness against adversarial samples by model hardening varies according to the crafting approach and cor- responding set of modifiable features that the attack allows for; 3) incrementally training hardened models with adversarial samples can produce a level playing field where no detector is best against all attacks and no attack is best against all detectors, in a given set of attacks and detectors. To the best of our knowledge this is the first time that level playing field feature set- and iteration-hardening are analyzed in encrypted C2 malware traffic detection.

Biography:

Ricardo Morla is an assistant professor at the University of Porto. His research interests are in network security and AI, mostly looking at sidechannel attacks on encrypted traffic for privacy protection and for malware C2 traffic detection. He tries to understand the adversarial nature and the AI on big data challenges of these attacks. Ricardo teaches and does research at the Electrical and Computer Engineering Department at FEUP and at INESC TEC. He holds a PhD in Computing from Lancaster University. He was a lecturer and post-doc at UC Irvine in 2007, and a visiting faculty at Carnegie Mellon University in 2010 under the CMU-Portugal program. He currently runs FEUP's Network Lab.

Notes:

Please register here until November 25, in order to have access to the link for the Zoom session. The webinar will be recorded.