UCL Discovery
UCL home » Library Services » Electronic resources » UCL Discovery

Getting Ahead of the Arms Race: Hothousing the Coevolution of VirusTotal with a Packer

Menéndez, HD; Clark, D; T Barr, E; (2021) Getting Ahead of the Arms Race: Hothousing the Coevolution of VirusTotal with a Packer. Entropy , 23 (4) , Article 395. 10.3390/e23040395. Green open access

[thumbnail of entropy-23-00395-v2.pdf]
Preview
Text
entropy-23-00395-v2.pdf - Published Version

Download (436kB) | Preview

Abstract

Malware detection is in a coevolutionary arms race where the attackers and defenders are constantly seeking advantage. This arms race is asymmetric: detection is harder and more expensive than evasion. White hats must be conservative to avoid false positives when searching for malicious behaviour. We seek to redress this imbalance. Most of the time, black hats need only make incremental changes to evade them. On occasion, white hats make a disruptive move and find a new technique that forces black hats to work harder. Examples include system calls, signatures and machine learning. We present a method, called Hothouse, that combines simulation and search to accelerate the white hat's ability to counter the black hat's incremental moves, thereby forcing black hats to perform disruptive moves more often. To realise Hothouse, we evolve EEE, an entropy-based polymorphic packer for Windows executables. Playing the role of a black hat, EEE uses evolutionary computation to disrupt the creation of malware signatures. We enter EEE into the detection arms race with VirusTotal, the most prominent cloud service for running anti-virus tools on software. During our 6 month study, we continually improved EEE in response to VirusTotal, eventually learning a packer that produces packed malware whose evasiveness goes from an initial 51.8% median to 19.6%. We report both how well VirusTotal learns to detect EEE-packed binaries and how well VirusTotal forgets in order to reduce false positives. VirusTotal's tools learn and forget fast, actually in about 3 days. We also show where VirusTotal focuses its detection efforts, by analysing EEE's variants.

Type: Article
Title: Getting Ahead of the Arms Race: Hothousing the Coevolution of VirusTotal with a Packer
Location: Switzerland
Open access status: An open access version is available from UCL Discovery
DOI: 10.3390/e23040395
Publisher version: https://doi.org/10.3390/e23040395
Language: English
Additional information: © 2021 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
Keywords: EEE, VirusTotal, adversarial machine learning, coevolution, hothouse, malware arm race
UCL classification: UCL
UCL > Provost and Vice Provost Offices > UCL BEAMS
UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science
UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science > Dept of Computer Science
URI: https://discovery.ucl.ac.uk/id/eprint/10126052
Downloads since deposit
41Downloads
Download activity - last month
Download activity - last 12 months
Downloads by country - last 12 months

Archive Staff Only

View Item View Item