Poisoning behavioral malware clustering

BIGGIO, BATTISTA;ARIU, DAVIDE;CORONA, IGINO;GIACINTO, GIORGIO;ROLI, FABIO
2014

Abstract

Clustering algorithms have become a popular tool in computer security to analyze the behavior of malware variants, identify novel malware families, and generate signatures for antivirus systems. However, the suitability of clustering algorithms for security-sensitive settings has been recently questioned by showing that they can be significantly compromised if an attacker can exercise some control over the input data. In this paper, we revisit this problem by focusing on behavioral malware clustering approaches, and investigate whether and to what extent an attacker may be able to subvert these approaches through a careful injection of samples with poisoning behavior. To this end, we present a case study on Malheur, an open-source tool for behavioral malware clustering. Our experiments not only demonstrate that this tool is vulnerable to poisoning attacks, but also that it can be significantly compromised even if the attacker can only inject a very small percentage of attacks into the input data. As a remedy, we discuss possible countermeasures and highlight the need for more secure clustering algorithms.
Inglese
Proceedings of the 2014 ACM Workshop on Artificial Intelligence and Security (AISec’14)
978-1-4503-3153-1
ACM
New York
27
36
10
http://dl.acm.org/citation.cfm?doid=2666652.2666666
AISec '14 Proceedings of the 2014 Workshop on Artificial Intelligent and Security Workshop
Esperti anonimi
November, 7 2014
Scottsdale, Arizona, USA
internazionale
scientifica
4 Contributo in Atti di Convegno (Proceeding)::4.1 Contributo in Atti di convegno
Biggio, Battista; Rieck, K; Ariu, Davide; Wressnegger, C; Corona, Igino; Giacinto, Giorgio; Roli, Fabio
273
7
4.1 Contributo in Atti di convegno
reserved
info:eu-repo/semantics/conferencePaper
Files in This Item:
File Size Format  
biggio14-aisec.pdf

Solo gestori archivio

Size 636.09 kB
Format Adobe PDF
636.09 kB Adobe PDF & nbsp; View / Open   Request a copy

Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.

Questionnaire and social

Share on:
Impostazioni cookie