Home > Research > Publications & Outputs > On the security of machine learning in malware ...

Electronic data

Links

Text available via DOI:

View graph of relations

On the security of machine learning in malware C & C detection: a survey

Research output: Contribution to Journal/MagazineJournal articlepeer-review

Published
Article number59
<mark>Journal publication date</mark>18/12/2016
<mark>Journal</mark>ACM Computing Surveys
Issue number3
Volume49
Number of pages39
Publication StatusPublished
<mark>Original language</mark>English

Abstract

One of the main challenges in security today is defending against malware attacks. As trends and anecdotal evidence show, preventing these attacks, regardless of their indiscriminate or targeted nature, has proven difficult: intrusions happen and devices get compromised, even at security-conscious organizations. As a consequence, an alternative line of work has focused on detecting and disrupting the individual steps that follow an initial compromise and are essential for the successful progression of the attack. In particular, several approaches and techniques have been proposed to identify the command and control (C&C) channel that a compromised system establishes to communicate with its controller. A major oversight of many of these detection techniques is the design's resilience to evasion attempts by the well-motivated attacker. C&C detection techniques make widespread use of a machine learning (ML) component. Therefore, to analyze the evasion resilience of these detection techniques, we first systematize works in the field of C&C detection and then, using existing models from the literature, go on to systematize attacks against the ML components used in these approaches.