TWC: Small: A Moving Target Approach to Enhancing Machine Learning-Based Malware Defense

TWC：小型：增强基于机器学习的恶意软件防御的移动目标方法

• 批准号: 1618631
• 负责人: Guanhua Yan
• 金额: $ 34.99万
• 依托单位: SUNY at Binghamton
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2016
• 资助国家: 美国
• 起止时间: 2016-09-01 至 2021-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1618631&HistoricalAwards=false
• 关键词: TWC; Small; Moving; Target; Approach

The ever-growing malware threats call for effective, yet efficient, mitigation techniques. Machine learning offers a promising solution to malware defense due to the scalability and automation that it brings. Machine learning techniques are however not a panacea for advanced malware attacks where cyber criminals can carefully craft malware features to evade detection. The root cause of such attacks can be attributed to the passive nature of existing machine learning-based malware defense systems. Our project aims to enhance these systems with a novel moving target strategy. Our method differs from traditional methods that use feature selection schemes to search for a static subset of features for malware detection or classification. In contrast, our approach dynamically changes the features used to train a classification model for predicting future malware attacks. To prevent adversarial correlation analysis, our method uses a random walk technique to ensure that features used across different predictive models have low mutual information. We further study the effectiveness of the moving target approach in enhancing machine learning-based malware defense under various evasion strategies by malware attackers. If successful, this research will introduce a promising new strategy for mitigating the ever-growing malware threats.

不断增长的恶意软件威胁需要有效且高效的缓解技术。机器学习因其所带来的可扩展性和自动化能力，为恶意软件防御提供了一种有前景的解决方案。然而，机器学习技术并不是高级恶意软件攻击的灵丹妙药，网络犯罪分子可以精心设计恶意软件功能来逃避检测。此类攻击的根本原因可归因于现有基于机器学习的恶意软件防御系统的被动性。我们的项目旨在通过新颖的移动目标策略来增强这些系统。我们的方法不同于传统方法，传统方法使用特征选择方案来搜索静态特征子集以进行恶意软件检测或分类。相比之下，我们的方法动态地改变用于训练分类模型以预测未来恶意软件攻击的特征。为了防止对抗性相关分析，我们的方法使用随机游走技术来确保不同预测模型中使用的特征具有较低的互信息。我们进一步研究了移动目标方法在恶意软件攻击者的各种规避策略下增强基于机器学习的恶意软件防御的有效性。如果成功，这项研究将引入一种有前景的新策略来减轻不断增长的恶意软件威胁。