Generative adversarial networks (GANS) model for improving malware detection

Abstract

Embodiments of the invention include a Generative Adversarial Networks (GANs) model to produce executable adversarial malware samples against machine learning based malware detectors. The adversarial malware samples can also be used to improve the robustness of the existing malware detectors. The methods described herein can test the robustness of a malware detector and includes steps of: (a) selecting a branch of malwares, (b) extracting Ngram features, (c) using a generator to generate adversarial payloads using the Ngram features, (d) patching the adversarial payloads to the original malware to generate the adversarial malware samples and (e) feeding the adversarial samples to a malware detector to obtain a true positive rate of the malware detector.

Description

GENERATIVE ADVERSARIAL NETWORKS (GANS) MODEL FOR IMPROVING MALWARE DETECTIONTECHNICAL FIELD

[0001] The present disclosure relates generally to cybersecurity, and more specifically, to malware detection systems and methods that use a generative adversarial network (GAN) model.BACKGROUND

[0002] Malware can be defined as any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, deprive access to information, or which unknowingly interferes with the user's computer security and privacy.Researchers often classify malware into one or more sub-types (i.e. computer viruses, worms, Trojan horses, ransomware, spyware, adware, rogue software, wipers and keyloggers).

[0003] Malware poses serious problems to individuals and businesses on the Internet. Cybercrime, which includes malware attacks as well as other crimes committed by computer, was predicted to cost the world economy USD $6 trillion in 2021 and is increasing at a rate of 15% per year. Since 2021 , malware has been designed to target computer systems that run critical infrastructure such as the electricity distribution network.

[0004] The defense strategies against malware differ according to the type of malware but most can be thwarted by installing antivirus software, firewalls, applying regular patches, securing networks from intrusion, having regular backups and isolating infected systems. However, malware can be designed to evade antivirus software detection algorithms and evade other protective efforts.

[0005] The detection of malware typically relies on standard security mechanisms and tools (e.g., anti-virus software) that recognize know malware profiles. The ability of these tools to detect new unknown malware is limited due to their reliance on known malware signatures used for detection. Moreover, when a new malware appears, it takes anti-virus developers time to update their tools with the new signature because this only occurs after domain experts perform a malware investigation. During this time, cloud infrastructures are vulnerable to new malware and the malware can evolve and mutate further, rendering the new signature irrelevant.

[0006] There is thus a need for methods of detecting unknown (i.e., previously unencountered) malware that are robust and effective in various environments. Recent efforts have used artificial intelligence (Al) to improve these efforts. However, cybercriminals have also begun using Al to implement more sophisticated attacks which can be difficult to detect. Embodiments of the invention include a method that uses a generative adversarial network (GAN) model to generate adversarial samples to improve the robustness of malware detection systems.SUMMARY OF INVENTION

[0007] The following summary is provided to facilitate an understanding of some of the innovative features unique to the disclosed embodiment and is not intended to be a full description. A full appreciation of the various aspects of the embodiments disclosed herein can be gained by taking into consideration the entire specification, claims, drawings, and abstract as a whole.

[0008] Conventional efforts at preventing cyberattacks generally rely on signatures and are time-consuming for updates and often do not recognize many types of attacks.Deep learning (DL), specifically generative methods demonstrate potential in detecting intrusions through network data analysis. Embodiments include a generative adversarial network (GAN) to improve the robustness of cyberattacks detection systems.

[0009] Embodiments include a system and method for improving the adversarial robustness of a deep neural network (DNN) for cyber security using adversarial training.

[0010] The invention is lightweight which requires few computation resources and transferrable which can be apply to any Byte feature based detectors and deep learning detectors. It can be used to test malware detection systems and improve the system robustness.

[0011] The invention can produce real executable adversarial malware samples, which is more practical in adversarial attack and adversarial training. It can be used with other deep learning malware detectors.

[0012] In aspects, the system and methods described herein use a feature extractor to first extract features from a dataset. Thereafter, a GAN model can use the extracted features to train iteratively until the generator can produce effective adversarial payloads, such that after the payload is added, the pre-recognized malware samples can evade detection by the black-box detectors. In aspects, a binary editor then produces the real adversarial malware files based on the generated adversarial payloads.

[0013] Embodiments of the invention also include a method that uses a generative adversarial network (GAN) model to generate adversarial samples to improve the robustness of malware detection systems. Aspects include a GAN model to produce executable adversarial malware samples against machine learning based malware detectors. The adversarial malware samples can also be used to improve the robustness of the existing malware detectors.

[0014] In embodiments, the system uses a feature extractor to first extract features from a dataset. Next, the GAN model uses the extracted features to train iteratively until the generator can produce effective adversarial payloads, such that after the payload isadded, the pre-recognized malware samples can evade detection by the black-box detectors. The binary editor then produces the real adversarial malware files based on the generated adversarial payloads.

[0015] Embodiments also include a method of producing adversarial malware samples for machine learning that includes steps of: (a) using a feature extractor to extract features from a dataset, (b) using the extracted features to iteratively train until a generator can produce adversarial payloads, and (c) using a binary editor to produce adversarial malware samples based on the adversarial payloads. In aspects, the step of generating adversarial payloads uses a GAN model.

[0016] Embodiments also include a method of improving the robustness of a neural network-based cyber security system. The method can include a step of training a deep neural network (DNN) model using the obtained adversarial malware samples. In aspects, the step of extracting features includes computing a mutual information (Ml) value to extract feature N-grams. In aspects, the method includes a step of encoding feature vectors into numerical values.

[0017] Embodiments also include a system for producing adversarial malware samples for machine learning to prevent a cyberattack. The system can include: (a) a feature extraction module for extracting features from a dataset, (b) a GAN model to iteratively train to produce adversarial payloads, (c) a binary editor to produce adversarial malware files based on the adversarial payloads. In aspects, the GAN model includes a generator, a feature transformer, a discriminator and a black-box detector. The generator can use a neural network to generate adversarial payload vectors. The feature transformer can estimate adversarial malware features and the discriminator can mimic responses of the black-box detector.

[0018] Embodiments also include a method of testing robustness of a malware detector that includes steps of: (a) selecting a branch of malwares, (b) extracting Ngram features, (c) using a generator to generate adversarial payloads using the Ngramfeatures, (d) patching the adversarial payloads to the original malware to generate the adversarial malware samples, and (e) feeding the adversarial samples to a malware detector to obtain a true positive rate of the malware detector.

[0019] Embodiments also include a method to improve the robustness of malware detectors to prevent a cyberattack that includes steps of: (a) using a feature extractor to first extract features from a dataset and (b) using a GAN model to train iteratively until the generator can produce effective adversarial pay loads. In aspects, after the pay load is added, the pre-recognized malware samples can evade detection by black-box detectors. The method can also include a step of taking one or more remedial actions to prevent a cyberattack.

[0020] In aspects, the system and method described herein is useful with large amounts of data (e.g., malware with a size larger than 2MB).

[0021] The system and methods described herein can solve the problem that machine learning based malware detectors are typically vulnerable to adversarial attacks.

[0022] The system and methods described herein can be used to test the robustness of existing malware detectors and improve the detector robustness (e.g., by cybersecurity companies and IT professionals).Definitions

[0023] Reference in this specification to "one embodiment / aspect" or "an embodiment / aspect" means that a particular feature, structure, or characteristic described in connection with the embodiment / aspect is included in at least one embodiment / aspect of the disclosure. The use of the phrase "in one embodiment / aspect" or "in another embodiment / aspect" in various places in the specification are not necessarily all referring to the same embodiment / aspect, nor are separate or alternative embodiments / aspects mutually exclusive of other embodiments / aspects. Moreover, various features are described which may beexhibited by some embodiments / aspects and not by others. Similarly, various requirements are described which may be requirements for some embodiments / aspects but not other embodiments / aspects. Embodiment and aspect can in certain instances be used interchangeably.

[0024] The terms used in this specification generally have their ordinary meanings in the art, within the context of the disclosure, and in the specific context where each term is used. Certain terms that are used to describe the disclosure are discussed below, or elsewhere in the specification, to provide additional guidance to the practitioner regarding the description of the disclosure. It will be appreciated that the same thing can be said in more than one way.

[0025] The term “intrusion detection system” or “IDS" refers to a network security tool that monitors network traffic and devices for known malicious activity, suspicious activity or security policy violations. An IDS can help accelerate and automate network threat detection by alerting security administrators to known or potential threats, or by sending alerts to a centralized security tool. A centralized security tool such as a security information and event management (SIEM) system can combine data from other sources to help security teams identify and respond to cyberthreats that might slip by other security measures. An IDS cannot stop security threats on its own. Today IDS capabilities are typically integrated with — or incorporated into — intrusion prevention systems (IPSs), which can detect security threats and automatically act to prevent them.

[0026] The term “virus” or “computer virus” refers to software usually hidden within another seemingly innocuous program that can produce copies of itself and insert them into other programs or files, and that usually performs a harmful action (such as destroying data). They have been likened to biological viruses. An example of this is a portable execution infection, a technique, usually used to spread malware, that inserts extra data or executable code into PE files. A computer virus is software that embeds itself in some other executable software (including the operating system itself) on thetarget system without the user's knowledge and consent and when it is run, the virus is spread to other executable files.

[0027] The term “worm” refers to a stand-alone malware software that actively transmits itself over a network to infect other computers and can copy itself without infecting files. These definitions lead to the observation that a virus requires the user to run an infected software or operating system for the virus to spread, whereas a worm spreads itself.

[0028] The term “rootkits” refers to software designed to conceal malicious software. Once malicious software is installed on a system, it is essential that it stays concealed, to avoid detection. Software packages known as rootkits allow this concealment, by modifying the host's operating system so that the malware is hidden from the user. Rootkits can prevent a harmful process from being visible in the system's list of processes or keep its files from being read.

[0029] The term “backdoor” is a broad term for a computer program that allows an attacker persistent unauthorised remote access to a victim's machine often without their knowledge. The attacker typically uses another attack (such as a trojan, worm or virus) to bypass authentication mechanisms usually over an unsecured network such as the Internet to install the backdoor application. A backdoor can also be a side effect of a software bug in legitimate software that is exploited by an attacker to gain access to a victim's computer or network.

[0030] The term “Trojan horse” refers to software that misrepresents itself to masquerade as a regular, benign program or utility in order to persuade a victim to install it. A Trojan horse usually carries a hidden destructive function that is activated when the application is started. Trojan horses are generally spread by some form of social engineering, for example, where a user is duped into executing an email attachment disguised to be unsuspicious, (e.g., a routine form to be filled in), or by drive-by download. Although their payload can be anything, many modern forms act as a backdoor, contacting a controller (phoning home) which can then have unauthorizedaccess to the affected computer, potentially installing additional software such as a keylogger to steal confidential information, crypto-mining software or adware to generate revenue to the operator of the trojan.

[0031] The term “droppers” refers to a sub-type of Trojans that solely aim to deliver malware upon the system that they infect with the desire to subvert detection through stealth and a light payload.

[0048] It is important not to confuse a dropper with a loader or stager. A loader or stager will merely load an extension of the malware (for example a collection of malicious functions through reflective dynamic link library injection) into memory. The purpose is to keep the initial stage light and undetectable. A dropper merely downloads further malware to the system.

[0032] The term “ransomware” refers to malicious software that prevents a user from accessing their files until a ransom is paid. There are two variations of ransomware, being crypto ransomware and locker ransomware. Locker ransomware just locks down a computer system without encrypting its contents, whereas crypto ransomware locks down a system and encrypts its contents. For example, programs such as CryptoLocker encrypt files securely, and only decrypt them on payment of a substantial sum of money.

[0033] The term “grayware” refers to any unwanted application or file that can worsen the performance of computers and may cause security risks but which there is insufficient consensus or data to classify them as malware. Types of greyware typically includes spyware, adware, fraudulent dialers, joke programs ("jokeware") and remote access tools. For example, at one point, Sony BMG compact discs silently installed a rootkit on purchasers' computers with the intention of preventing illicit copying.

[0034] The term “potentially unwanted programs" or “PUPs” refers to applications that would be considered unwanted despite often being intentionally downloaded by the user. PUPs include spyware, adware, and fraudulent dialers.

[0035] The term “spyware” refers to programs designed to monitor users' web browsing, display unsolicited advertisements, or redirect affiliate marketing revenues are called spyware. Spyware programs do not spread like viruses; instead they are generally installed by exploiting security holes. They can also be hidden and packaged together with unrelated user-installed software. The Sony BMG rootkit was intended to prevent illicit copying; but also reported on users' listening habits, and unintentionally created extra security vulnerabilities.

[0036] The term "advanced persistent threat” or “APT” refers to a stealthy threat actor, typically a state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period. In recent times, the term may also refer to non-state-sponsored groups conducting large-scale targeted intrusions for specific goals. Such threat actors' motivations are typically political or economic. Every major business sector has recorded instances of cyberattacks by advanced actors with specific goals, whether to steal, spy, or disrupt. These targeted sectors include government, defense, financial services, legal services, industrial, telecoms, consumer goods and many more. Some groups utilize traditional espionage vectors, including social engineering, human intelligence and infiltration to gain access to a physical location to enable network attacks. The purpose of these attacks is to install custom malware (i.e. , malicious software).

[0037] The term “classifier” refers to the mathematical function, implemented by a classification algorithm that maps input data to a category. An algorithm that implements classification, especially in a concrete implementation, is known as a classifier.

[0038] The term “software as a service” or “SaaS” refers to a software licensing and delivery model in which software is licensed on a subscription basis and is centrally hosted. SaaS is also known as on-demand software, web-based software, or web- hosted software. SaaS is considered to be part of cloud computing, along with several other as a service business models. SaaS apps are typically accessed by users of aweb browser (a thin client). SaaS became a common delivery model for many business applications, including office software, messaging software, development software, gamification, virtualization, etc.

[0039] The term “artificial Intelligence” or “Al” refers to intelligence exhibited by machines, rather than humans. The term, as applied herein, refers to when a machine mimics "cognitive" functions that humans associate with other human minds, such as "learning" and "problem solving."

[0040] The term “computer learning” or “machine learning” refers to an application of artificial intelligence (Al) that provides systems the ability to automatically learn and improve from experience without being explicitly programmed. Machine learning focuses on the development of computer programs that can access data and use it to learn for themselves.

[0041] The term “machine learning software” generally refers to a type of software application that uses artificial intelligence to make predictions or decisions based on data.

[0042] The term “deep learning” generally refers to a type of machine learning based on artificial neural networks in which multiple layers of processing are used to extract progressively higher-level features from data.

[0043] The term “module” such as that used in “deep learning module” generally refers to an extension to a software application’s main program that is dedicated to a specific function. For example, a “deep learning module” refers to an extension dedicated to deep learning which can perform all deep learning functions automatically without additional programming.

[0044] The term “neural network” refers to a method in artificial intelligence that teaches computers to process data in a way that is inspired by the human brain. It is a type ofmachine learning process, called deep learning, that uses interconnected nodes or neurons in a layered structure that resembles the human brain.

[0045] “Artificial neural networks” or “ANNs” are distributed computing systems that include a number of neurons interconnected through connection points called synapses. Each synapse encodes the strength of the connection between the output of one neuron and the input of another. The output of each neuron is determined by the aggregate input received from other neurons that are connected to it. Thus, the output of a given neuron is based on the outputs of connected neurons from preceding layers and the strength of the connections as determined by the synaptic weights. An ANN is trained to solve a specific problem (e g., pattern recognition) by adjusting the weights of the synapses such that a particular class of inputs produce a desired output.

[0046] Various algorithms may be used for this learning process. Certain algorithms may be suitable for specific tasks such as image recognition, speech recognition, or language processing. Training algorithms lead to a pattern of synaptic weights that, during the learning process, converges toward an optimal solution of the given problem.

[0047] Artificial neural networks include, for example, a feedforward neural network, a radial basis function network, a self-organizing map, learning vector quantization, a recurrent neural network, a Hopfield network, a Boltzmann machine, an echo state network, long short term memory, a bi-directional recurrent neural network, a hierarchical recurrent neural network, a stochastic neural network, a modular neural network, an associative neural network, a deep neural network, a deep belief network, a convolutional neural networks, a convolutional deep belief network, a large memory storage and retrieval neural network, a deep Boltzmann machine, a deep stacking network, a tensor deep stacking network, a spike and slab restricted Boltzmann machine, a compound hierarchical-deep model, a deep coding network, a multilayer kernel machine, or a deep Q-network.

[0048] A “Convolutional neural network” or “CNN” refers to a class of deep, feed-forward artificial neural networks, most commonly applied to analyzing visual imagery. CNNs use a variation of multilayer perceptrons designed to require minimal preprocessing. A CNN consists of an input and an output layer, as well as multiple hidden layers. The hidden layers of a CNN typically consist of convolutional layers, pooling layers, fully connected layers and normalization layers. Convolutional layers apply a convolution operation to the input, passing the result to the next layer. Local or global pooling layers combine the outputs of neuron clusters at one layer into a single neuron in the next layer. Fully connected layers connect every neuron in one layer to every neuron in another layer. CNNs use relatively little pre-processing compared to other image classification algorithms. This means that the network learns the filters that in traditional algorithms were hand-engineered. This independence from prior knowledge and human effort in feature design is a major advantage.

[0049] The term “black box testing” refers to a software testing methodology in which the tester analyzes application functionality without a thorough knowledge of its internal design. Conversely, “white box testing” refers to a software testing methodology in which the tester’s knowledge of the application’s internal workings is leveraged during testing. The term “black box” symbolizes a black outer covering of the application, preventing testers from seeing its inner workings and compelling them to examine only the end-user experience. Likewise, the term “white box signifies” the application’s transparency, allowing the tester to see through the outer box and into the inner code.

[0050] The term “autoencoder” refers to a neural network that learns to compress data from the input layer into a short code, and then uncompress that code into something that closely matches the original data. This forces the autoencoder to engage in dimensionality reduction, for example by learning how to ignore noise. Autoencoders are also useful as generative models. An autoencoder can be used for anomaly detection. It learns a compact representation of healthy data. If there is a failure in detection of a particular data instance, there is a high probability that it encountered an anomaly. An autoencoder can be used for integration with a quantum circuit due to theirbottleneck-like architecture. They compress their input, which enables passing highdimensional classical data into small Noisy Intermediate-Scale Quantum (NISQ) computers.

[0051] A variational autoencoder or “VAE” refers to an artificial neural network architecture of the families of probabilistic graphical models and variational Bayesian methods. Variational autoencoders are often associated with the autoencoder model because of its architectural affinity, but with significant differences in the goal and mathematical formulation. Variational autoencoders are probabilistic generative models that require neural networks as only a part of their overall structure. The neural network components are typically referred to as the encoder and decoder for the first and second component respectively. The first neural network maps the input variable to a latent space that corresponds to the parameters of a variational distribution. In this way, the encoder can produce multiple different samples that all come from the same distribution. The decoder has the opposite function, which is to map from the latent space to the input space, in order to produce or generate data points. Both networks are typically trained together with the usage of the reparameterization trick, although the variance of the noise model can be learned separately.

[0052] The term “bottleneck” in a neural network refers to a layer with fewer neurons than the layer below or above it. Having such a layer encourages the network to compress feature representations (of salient features for the target variable) to best fit in the available space. Improvements to compression occur due to the goal of reducing the cost function, as for all weight updates. In a CNN, bottleneck layers are added to reduce the number of feature maps (aka channels) in the network, which, otherwise, tend to increase in each layer. This is achieved by using 1x1 convolutions with fewer output channels than input channels.

[0053] Other technical terms used herein have their ordinary meaning in the art that they are used, as exemplified by a variety of technical dictionaries. The particular values and configurations discussed in these non-limiting examples can be varied and are citedmerely to illustrate at least one embodiment and are not intended to limit the scope thereof.BRIEF DESCRIPTION OF THE DRAWINGS

[0054] The accompanying drawings illustrate aspects of the present invention. In such drawings:

[0055] FIG. 1 depicts the overall architecture of InfoGramGAN model and its components (i.e. , generator, discriminator, black-box detector and feature transformer) according to embodiments.

[0056] FIG. 2A and 2B depict two different structures of neural networks of the generator component according to embodiments.

[0057] FIG. 3A and 3B depict two different structures of the neural networks of the discriminator component according to embodiments.DETAILED DESCRIPTION

[0058] It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are intended to provide further explanation of the subject technology as claimed. Additional features and advantages of the subject technology are set forth in the description below, and in part will be apparent from the description, or may be learned by practice of the subject technology. The advantages of the subject technology will be realized and attained by the methods and systems particularly pointed out in the written description and claims hereof.

[0059] Artificial intelligence (Al) has made significant strides in transforming various industries in recent years. From autonomous vehicles to medical diagnostics, Al- powered systems have shown remarkable capabilities. However, as Al becomes moreintegrated into business tools and functions, adversarial Al has quickly emerged as a new threat. With the use and reliance of Al, adversarial attacks have become more common and sophisticated.

[0060] An adversarial attack is a malicious attempt to trick a machine learning model into making a mistake by creating an input that resembles a valid input to a human. The input, called an adversarial example, is designed to cause the model to misclassify data or make false predictions. To humans, adversarial examples look identical to the original, but to machines, they work like an optical illusion. Adversarial attacks can severely degrade the performance of Al systems, so researchers are actively developing strategies to defend against them.

[0061] Adversarial attacks generally aim to deteriorate the output of machine learning models to force wrong, inferior, or even dangerous decisions. Adversarial Al manipulates ML systems by creating inputs that misinterpret data. This challenges cybersecurity professionals who must develop advanced defense mechanisms against these threats. Adversarial attacks can designed either using white-box or black-box approaches (i.e., with or without knowledge about the details of the machine learning models under attack). Such adversarial attacks pose a threat to production companies with high levels of automation and machine learning-based decision-making. Aspects of the present invention include the use of a generative adversarial network (GAN) model for detecting and preventing such attacks.Generative Adversarial Network (GAN)

[0062] A generative adversarial network (GAN) is a class of machine learning frameworks and a prominent framework for approaching generative Al. In a GAN, two neural networks contest with each other in the form of a zero-sum game, where one agent's gain is another agent's loss.

[0063] Given a training set, this technique learns to generate new data with the same statistics as the training set. For example, a GAN trained on photographs can generatenew photographs that look at least superficially authentic to human observers, having many realistic characteristics. Though originally proposed as a form of generative model for unsupervised learning, GANs have also proved useful for semi-supervised learning, fully supervised learning, and reinforcement learning.

[0064] The core idea of a GAN is based on the "indirect" training through the discriminator, another neural network that can tell how "realistic" the input seems, which itself is also being updated dynamically. This means that the generator is not trained to minimize the distance to a specific image, but rather to fool the discriminator. This enables the model to learn in an unsupervised manner.N-gram Features

[0065] An n-gram is a sequence of n adjacent symbols in particular order. The symbols may be n adjacent letters (including punctuation marks and blanks), syllables, or rarely whole words found in a language dataset; or adjacent phonemes extracted from a speech-recording dataset, or adjacent base pairs extracted from a genome. They are collected from a text corpus or speech corpus. If Latin numerical prefixes are used, then n-gram of size 1 is called a "unigram", size 2 a "bigram" (or, less commonly, a "digram") etc. If, instead of the Latin ones, the English cardinal numbers are furtherly used, then they are called "four-gram", "five-gram", etc. Similarly, using Greek numerical prefixes such as "monomer", "dimer", "trimer", "tetramer", "pentamer", etc., or English cardinal numbers, "one-mer", "two-mer", "three-mer", etc. are used in computational biology, for polymers or oligomers of a known size, called k-mers. When the items are words, n-grams may also be called shingles.

[0066] In the context of Natural language processing (NLP), the use of n-grams allows bag-of-words models to capture information such as word order, which would not be possible in the traditional bag of words setting.Feature Extraction

[0067] Feature extraction entails identifying and extracting important features from raw data to create a more informative dataset. The feature extraction modules of the invention can extract features from malware and benign datasets in several steps:Extract N-grams:- For a given sample (i.e. , a malware file or benign file), the file is read as a byte sequence.- Each byte of the byte sequence is treated as one gram; N consecutive grams are treated as one N-gram.

[0068] Conventional approaches use N-gram frequency to select important N-grams as features. In contrast, the present invention uses mutual information (Ml) values which quantifies the statistical dependency between two variables.Extract Feature N-grams:- Across all malware and benign samples, the mutual information (Ml) between the frequency of appeared N-grams and the sample labels is computed.- K important N-grams are selected as features by most Ml value.Extract Feature vector:- For each malware and benign sample, extract N-gram frequency if the N-gram is a feature and use this frequency as the feature value.- Normalized the feature vector such that the sum of the single vector equals to 1.

[0069] At the feature extraction, each sample is converted to a K dimensional numerical vector, with each digit in a range 0 to 1. This is different from other works that use N- gram existence to from one-hot encoding feature vectors. In contrast, this approach uses N-gram frequency as feature values.GANs Model Training

[0070] The GAN model includes four main components: a generator, a discriminator, a black-box detector, and a feature transformer, as depicted in FIG. 1 . It is trained iteratively until the generator can produce effective adversarial payloads, such that after the payload is added, the pre-recognized malware samples can evade detection by the black-box detectors.Generator

[0071] The purpose of the Generator is to generate adversarial pay load vectors. It is implemented as a neural network. Two different structures are presented herein (e.g., example section) and depicted in FIG. 2A and 2B. A network structure can be implemented based on one’s particular needs.- Input: Malware features + Noise vector: (K + Z) dimensional.- Configuration parameter: N-gram Append Ratio (t): configure ratio of total number of N-grams (important N-grams) in the original malware. This will control the number of N-grams in the generated adversarial payload.Output: Adversarial payload: (K) dimensional vector, with each element indicating how many corresponding N-grams should be appendedFeature Transformer

[0072] The adversarial malware features are estimated as if the payloads were appended to the original malware files.- Input: Malware features: (K) dimensional; Adversarial payloads: (K) dimensional- Output: Adversarial malware feature: (K) dimensional

[0073] For Example, if we assume N = 2, K = 3, given feature N-grams are [(0, 0), (1 , 255), (255, 1)], a sample with feature vector [0.2, 0.7, 0.1] and a generated adversarial payload vector [0.2, 0, 0.2], The unnormalized adversarial feature will be calculated as follows: a) First element (0, 0): 0.2 + 0.1 * 2 = 0.4. Append n (0, 0) will actually introduce 2*n (0, 0) 2-grams. b) Second element: 0.7 + 0.2 = 0.9. Append n (255, 1) will also introduce n (1 , 255). c) Third element: 0.1 + 0.2 = 0.3

[0074] Next, the adversarial feature is normalized: Divide each element by the sum of all elements in the unnormalized adversarial feature: a) Normalized first element: 0.4 / 1 .6 = 0.25 b) Normalized second element: 0.9 / 1.6 = 0.5625c) Normalized third element: 0.31 1.6 = 0.1875

[0075] The normalized adversarial feature will be [0.4 / 1.6, 0.9 / 1.6, 0.3 / 1.6] = [0.25, 0.5625, 0.1875], which is the output of the Feature Transformer.Black-box detectorsThe attack target also acts as an oracle during the training process. Black-box detectors are trained for the experiment. Unlike conventional approaches, this demonstrates that the black-box detector is resilient to random noise perturbation, such as directly adding random values to the original features. This confirms that using GANs to attack is necessary. Other approaches typically miss this step.- Input: Adversarial malware features or Benign features- Output: Suspicious scoreDiscriminator

[0076] The purpose of the Discriminator is to mimic the response of the black-box detector. It is implemented as a neural network. Two different structures are described herein (below examples) and shown in FIG. 3. However, users can implement their own network structure that is conducive to their needs.- Input: Adversarial malware features or Benign features- Output: Suspicious scoreOperating Environment

[0077] The Al / machine learning software of the present invention is compatible with any operating system, including but not limited to: Mac OS, Microsoft Windows, Linux, Arthur, ARX, MOS, RISC iX, RISC OS, Fire OS, AmigaOS, Amiga Unix, AMSDOS, Contiki, CP / M 2.2, CP / M Plus, SymbOS, IBM, IBM AIX, Newton OS, iPadOS, watchOS, tvOS, bridgeOS, visionOS, XTS-400, BeOS, BelA, Unix, MINI-UNIX, PWB / UNIX, CB UNIX, BESYS, Inferno, Burroughs MCP, GEOS, AmigaOS, AROS Research Operating System, SCOPE, Chippewa Operating System, MACE, Kronos, NOS, SIPROS, Puffin OS, CTOS, AOS, DG / UX, RDOS, CTOS, Deos, HeartOS, CP / M, Personal CP / M, CP / MPlus, CP / M-68K, CP / M-8000, CP / M-86 Plus, Personal CP / M-86, MP / M, MP / M II, FlexOS, Novell, or any other known operating system in the art.

[0078] The Al / machine learning software of the present invention is also compatible with myriad graphical user interfaces. Compatible graphical user interfaces include those hosted on desktop computer monitors, laptop computer monitors, smartphone screens, smartwatch screens, television monitors, projection screens, multiplexed screens, LCD displays or any other hosted graphical user interface known in the art.

[0079] The invention may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. The computer program and data may be fixed in any form (e.g., source code form, computer executable form, or an intermediate form) either permanently or transitorily in a tangible storage medium, such as a semiconductor memory device (e.g., a RAM, ROM, PROM, EEPROM, or Flash-Programmable RAM), a magnetic memory device (e.g., a diskette or fixed hard disk), an optical memory device (e.g., a CD-ROM or DVD), a PC card (e.g., PCMCIA card), or other memory device. The computer program and data may be fixed in any form in a signal that is transmittable to a computer using any of various communication technologies, including, but in no way limited to, analog technologies, digital technologies, optical technologies, wireless technologies, networking technologies, and internetworking technologies. The computer program and data may be distributed in any form as a removable storage medium with accompanying printed or electronic documentation (e.g., shrink wrapped software or a magnetic tape), preloaded with a computer system (e.g., on system ROM or fixed disk), or distributed from a server or electronic bulletin board over the communication system (e.g., the Internet or World Wide Web). It is appreciated that any of the software components of the present invention may, if desired, be implemented in ROM (read-only memory) form. The software components may, generally, be implemented in hardware, if desired, using conventional techniques.

[0080] The invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices. Practitioners of ordinary skill will recognize that the invention may be executed on one or more computer processors that are linked using a data network, including, for example, the Internet. In another embodiment, different steps of the process can be executed by one or more computers and storage devices geographically separated but connected by a data network in a manner so that they operate together to execute the process steps. In one embodiment, a user's computer can run an application that causes the user's computer to transmit a stream of one or more data packets across a data network to a second computer, referred to here as a server. The server, in turn, may be connected to one or more mass data storage devices where the database is stored. The server can execute a program that receives the transmitted packet and interpret the transmitted data packets in order to extract database query information. The server can then execute the remaining steps of the invention by means of accessing the mass storage devices to derive the desired result of the query. Alternatively, the server can transmit the query information to another computer that is connected to the mass storage devices, and that computer can execute the invention to derive the desired result. The result can then be transmitted back to the user's computer by means of another stream of one or more data packets appropriately addressed to the user's computer. In one embodiment, the relational database may be housed in one or more operatively connected servers operatively connected to computer memory, for example, disk drives. In yet another embodiment, the initialization of the relational database may be prepared on the set of servers and the interaction with the user's computer occur at a different place in the overall process.

[0081] Further illustration of the present invention is shown in the working examples produced below.EXAMPLES

[0082] The following non-limiting examples are provided for illustrative purposes only in order to facilitate a more complete understanding of representative embodiments now contemplated. These examples are intended to be a mere subset of all possible contexts in which the components of the formulation may be combined. Thus, these examples should not be construed to limit any of the embodiments described in the present specification, including those pertaining to the type of components and / or methods and uses thereof.Example 1True Positive Rates (TPRs) of different Malware detector when facing adversarial malware samples generated different implementations of InfoGramGAN under different configurations.

[0083] This experiment explored and compared the effectiveness of different implementations of the InfoGramGAN when attack on different detectors under different configurations. It included six different InfoGramGAN implementations:1) BCE-MLP: Binary Cross Entropy Loss and MLP implementation of Generator and Discriminator2) MSE-MLP: Means Square Error Loss and MLP implementation of Generator and Discriminator3) W-MLP: Wasserstein Distance and MLP implementation of Generator and Discriminator4) BCE-CNN: Binary Cross Entropy Loss and CNN implementation of Generator and Discriminator5) MSE-CNN: Means Square Error Loss and CNN implementation of Generator and Discriminator6) W-CNN: Wasserstein Distance and CNN implementation of Generator and Discriminator

[0084] Three different Block-box Detectors and attack parameters were used:1) MLP_0.025: attack on a MLP malware detector with 2.5% of adversarial payload respect to the number of feature malware2) LR_0.05: attack on a LR malware detector with 5% of adversarial payload respect to the number of feature malware3) SVM_0.1 : attack on a SVM malware detector with 10% of adversarial payload respect to the number of feature malware

[0085] Two different attack configurations were used:1) Configuration 1 : The InfoGramGAN and the Malware detector use the same set of Malware to train.2) Configuration 2: The InfoGramGAN and the Malware detector use two different set of Malware to train

[0086] The results are listed below in Table 1 .Table 1Example 2Generate adversarial malware samples against self-designed malware detectors.

[0087] This Experiment used a trained InfoGramGAN model to generate real adversarial malware. Then features were extracted from these adversarial malwares and tested on malware detectors. It aimed to show that the patched adversarial malwares preserve the attack effectiveness. It also demonstrated that generating and patching real malwares required less than 5 seconds. Further, the size of the adversarial malware increased less than 8%.

[0088] The results are listed below in Table 2.Table 2Example 3Generate adversarial malware samples against State-of-the-Art malware detectors: MalConv.

[0089] This experiment trained 10 distinct MalConv models using a set of malware samples and then tested them on TPR using a separate set of malware samples, which yielded the TPR_original result. Subsequently, the InfoGramGAN was employed to generate adversarial malware samples, which were then tested by the MalConv model. This process yielded the TPRJnfo value. Similarly, randomly generated payloads were patched based on the test set, tested by the MalConv, to yield the TPR_noise values. It demonstrated that the InfoGramGAN could be used to attack on MalConv models and will achieve a good result.

[0090] The results are listed below in Table 3.Table 3Example 4Using adversarial sample to train MalConv

[0091] The experiment employed the InfoGramGAN to generate adversarial malware samples based on the MalConv train dataset. These adversarial samples were then utilized to retrain the InfoGramGAN. The retained model was subsequently employed to assess the adversarial malware samples generated based on the MalConv test data set. The results are shown as TPR_adver_train. The objective of this experiment was to demonstrate that adversarial training significantly improves the robustness of the MalConv against InfoGramGAN samples and also improves the performance of MalConv against randomly generated payloads.

[0092] The results are listed below in Table 4.Table 4

[0093] Based on these results, it is clear that the assessed Al algorithm is accurate for recognizing anomalies among large amounts of data. The assessed Al model can improve identification and allow remedial actions to improve cybersecurity and prevent attacks.* * *

[0094] In closing, it is to be understood that although aspects of the present specification are highlighted by referring to specific embodiments, one skilled in the art will readily appreciate that these disclosed embodiments are only illustrative of the principles of the subject matter disclosed herein. Therefore, it should be understood that the disclosed subject matter is in no way limited to a particular compound, composition, article, apparatus, methodology, protocol, and / or reagent, etc., described herein, unless expressly stated as such. In addition, those of ordinary skill in the art will recognize that certain changes, modifications, permutations, alterations, additions, subtractions and sub-combinations thereof can be made in accordance with the teachings herein without departing from the spirit of the present specification. It is therefore intended that the following appended claims and claims hereafter introduced are interpreted to include all such changes, modifications, permutations, alterations, additions, subtractions and sub-combinations as are within their true spirit and scope.

[0095] Certain embodiments of the present invention are described herein, including the best mode known to the inventors for carrying out the invention. Of course, variations on these described embodiments will become apparent to those of ordinary skill in the art upon reading the foregoing description. The inventor expects skilled artisans to employ such variations as appropriate, and the inventors intend for the present invention to be practiced otherwise than specifically described herein. Accordingly, this invention includes all modifications and equivalents of the subject matter recited in the claims appended hereto as permitted by applicable law. Moreover, any combination of the above-described embodiments in all possible variations thereof is encompassed by the invention unless otherwise indicated herein or otherwise clearly contradicted by context.

[0096] Groupings of alternative embodiments, elements, or steps of the present invention are not to be construed as limitations. Each group member may be referred toand claimed individually or in any combination with other group members disclosed herein. It is anticipated that one or more members of a group may be included in, or deleted from, a group for reasons of convenience and / or patentability. When any such inclusion or deletion occurs, the specification is deemed to contain the group as modified thus fulfilling the written description of all Markush groups used in the appended claims.

[0097] Unless otherwise indicated, all numbers expressing a characteristic, item, quantity, parameter, property, term, and so forth used in the present specification and claims are to be understood as being modified in all instances by the term “about.” As used herein, the term “about” means that the characteristic, item, quantity, parameter, property, or term so qualified encompasses a range of plus or minus ten percent above and below the value of the stated characteristic, item, quantity, parameter, property, or term. Accordingly, unless indicated to the contrary, the numerical parameters set forth in the specification and attached claims are approximations that may vary. For instance, as mass spectrometry instruments can vary slightly in determining the mass of a given analyte, the term "about" in the context of the mass of an ion or the mass / charge ratio of an ion refers to + / -0.50 atomic mass unit. At the very least, and not as an attempt to limit the application of the doctrine of equivalents to the scope of the claims, each numerical indication should at least be construed in light of the number of reported significant digits and by applying ordinary rounding techniques.

[0098] Use of the terms “may” or “can” in reference to an embodiment or aspect of an embodiment also carries with it the alternative meaning of “may not” or “cannot.” As such, if the present specification discloses that an embodiment or an aspect of an embodiment may be or can be included as part of the inventive subject matter, then the negative limitation or exclusionary proviso is also explicitly meant, meaning that an embodiment or an aspect of an embodiment may not be or cannot be included as part of the inventive subject matter. In a similar manner, use of the term “optionally” in reference to an embodiment or aspect of an embodiment means that such embodiment or aspect of the embodiment may be included as part of the inventive subject matter ormay not be included as part of the inventive subject matter. Whether such a negative limitation or exclusionary proviso applies will be based on whether the negative limitation or exclusionary proviso is recited in the claimed subject matter. Further, the use of the terms “include,” “includes” and “including” means include, includes and or including as well as include, includes and including, but not limited to.

[0099] Notwithstanding that the numerical ranges and values setting forth the broad scope of the invention are approximations, the numerical ranges and values set forth in the specific examples are reported as precisely as possible. Any numerical range or value, however, inherently contains certain errors necessarily resulting from the standard deviation found in their respective testing measurements. Recitation of numerical ranges of values herein is merely intended to serve as a shorthand method of referring individually to each separate numerical value falling within the range. Unless otherwise indicated herein, each individual value of a numerical range is incorporated into the present specification as if it were individually recited herein.

[0100] All patents, patent publications, and other publications referenced and identified in the present specification are individually and expressly incorporated herein by reference in their entirety for the purpose of describing and disclosing, for example, the compositions and methodologies described in such publications that might be used in connection with the present invention. These publications are provided solely for their disclosure prior to the filing date of the present application. Nothing in this regard should be construed as an admission that the inventors are not entitled to antedate such disclosure by virtue of prior invention or for any other reason. All statements as to the date or representation as to the contents of these documents is based on the information available to the applicants and does not constitute any admission as to the correctness of the dates or contents of these documents.

[0101] The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention.In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order or out of order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flowchart illustration, and combinations of blocks in the block diagrams and / or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

[0102] Lastly, the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of the present invention, which is defined solely by the claims. Accordingly, the present invention is not limited to that precisely as shown and described.

[0103] Although embodiments of the current disclosure have been described comprehensively in considerable detail to cover the possible aspects, those skilled in the art would recognize that other versions of the disclosure are also possible.

[0104] While the present invention has been described in terms of particular embodiments and applications, in both summarized and detailed forms, it is not intended that these descriptions in any way limit its scope to any such embodiments and applications, and it will be understood that many substitutions, changes and variations in the described embodiments, applications and details of the method and system illustrated herein and of their operation can be made by those skilled in the art without departing from the spirit of this invention.

Claims

CLAIMSWhat is Claimed is:

1. A method of producing adversarial malware samples for machine learning, the method comprising steps of:(a) using a feature extractor to extract features from a dataset,(b) using the extracted features to iteratively train until a generator can produce adversarial payloads,(c) using a binary editor to produce adversarial malware samples based on the adversarial payloads, wherein the step of generating adversarial payloads uses a GAN model.

2. A method of improving the robustness of a neural network-based cyber security system, the method comprising a step of training a neural network (DNN) model using the adversarial malware samples of claim 1.

3. The method of claim 1 , wherein the step of extracting features comprises computing a mutual information (Ml) value to extract feature N-grams.

4. The method of claim 1 , further comprising a step of encoding feature vectors into numerical values.

5. A system for producing adversarial malware samples for machine learning to prevent a cyberattack, the system comprising:(a) a feature extraction module for extracting features from a dataset,(b) a GAN model to iteratively train to produce adversarial payloads,(c) a binary editor to produce adversarial malware files based on the adversarial payloads. wherein the GAN model is comprised of a generator, a feature transformer, a discriminator and a black-box detector.wherein the generator uses a neural network to generate adversarial payload vectors, wherein the feature transformer estimates adversarial malware features, and wherein the discriminator mimics responses of the black-box detector.

6. The method of claim 5, further comprising a step of demonstrating that the blackbox detector is resistant to randomly generated adversarial samples.

7. The method of claim 5, wherein feature extraction module computes a mutual information (Ml) value to extract feature N-grams.

8. The method of claim 5, the GAN model generates adversarial payloads for creating adversarial malware file.

9. A method of testing robustness of a malware detector, the method comprising steps of:(a) selecting a branch of malwares,(b) extracting Ngram features,(c) using a generator to generate adversarial payloads using the Ngram features,(d) patching the adversarial payloads to the original malware to generate the adversarial malware samples, and(e) feeding the adversarial samples to a malware detector to obtain a true positive rate of the malware detector.

10. The method of claim 9, wherein the step of extracting features comprises computing a mutual information (Ml) value to extract feature N-grams.

11. The method of claim 9, further comprising a step of encoding feature vectors into numerical values.

12. The method of claim 9, further comprising a step of demonstrating that a blackbox detector is resistant to randomly generated adversarial samples.

14. The method of claim 9, wherein the generator generates adversarial pay loads for creating real adversarial malware files.

15. A method of identifying malware to prevent a cyberattack, the method comprising steps of:(a) using a feature extractor to first extract features from a dataset,(b) using a GAN model to train iteratively until the generator can produce effective adversarial payloads, wherein after the payload is added, the pre-recognized malware samples can evade detection by black-box detectors.(c) taking one or more remedial actions to prevent the cyberattack.

16. A malware detection system that uses a generative adversarial network (GAN) model, wherein the GAN model produces executable adversarial malware samples against machine learning based malware detectors and the adversarial malware samples are used to improve the robustness of the malware detection system.

17. The malware detection system of claim 16, wherein the GAN model is comprised of a generator, a feature transformer, a discriminator and a black-box detector.

18. The malware detection system of claim 17, wherein the generator uses a neural network to generate adversarial payload vectors19. The malware detection system of claim 17, wherein the feature transformer estimates adversarial malware features.

20. The malware detection system of claim 17, wherein the discriminator mimics responses of the black-box detector.

Images