Detecting poisoning attacks on hierarchical malware classification systems

Dan P. Guralnik; Bill Moran; Ali Pezeshki; Omur Arslan

doi:10.1117/12.2266556

1 May 2017 Detecting poisoning attacks on hierarchical malware classification systems

Dan P. Guralnik, Bill Moran, Ali Pezeshki, Omur Arslan

Proceedings Volume 10185, Cyber Sensing 2017; 101850E (2017) https://doi.org/10.1117/12.2266556
Event: SPIE Defense + Security, 2017, Anaheim, CA, United States

Abstract

Anti-virus software based on unsupervised hierarchical clustering (HC) of malware samples has been shown to be vulnerable to poisoning attacks. In this kind of attack, a malicious player degrades anti-virus performance by submitting to the database samples specifically designed to collapse the classification hierarchy utilized by the anti-virus (and constructed through HC) or otherwise deform it in a way that would render it useless. Though each poisoning attack needs to be tailored to the particular HC scheme deployed, existing research seems to indicate that no particular HC method by itself is immune. We present results on applying a new notion of entropy for combinatorial dendrograms to the problem of controlling the influx of samples into the data base and deflecting poisoning attacks. In a nutshell, effective and tractable measures of change in hierarchy complexity are derived from the above, enabling on-the-fly flagging and rejection of potentially damaging samples. The information-theoretic underpinnings of these measures ensure their indifference to which particular poisoning algorithm is being used by the attacker, rendering them particularly attractive in this setting.

Conference Presentation

Citation Download Citation

Dan P. Guralnik, Bill Moran, Ali Pezeshki, and Omur Arslan "Detecting poisoning attacks on hierarchical malware classification systems", Proc. SPIE 10185, Cyber Sensing 2017, 101850E (1 May 2017); https://doi.org/10.1117/12.2266556

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available