Pseudo-Malware Generation for Black Box Malware Scanner Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity systems face challenges in detecting malware generated by generative AI models, as content filters are easily bypassed, and open-source models can be used maliciously without restrictions.
Innovation Solution
Decompose cyberattack modalities into primitives, generate primitive codes using a large language model (LLM) to create pseudo-malware, and test malware scanning engines against this pseudo-malware to evaluate detection effectiveness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If content filters are used to block malicious code generation, then safety is improved, but the filters are easily bypassed by using variables instead of actual terms
Solution Approach 1:
The patent creates pseudo-malware that copies the structural and behavioral characteristics of actual malware without executing harmful code. The pseudo-malware replicates malware patterns, APIs called, and execution flows for testing purposes, allowing security systems to be evaluated against realistic threats without actual harm being inflicted.
Solution Approach 2:
The patent introduces an intermediary testing framework that mediates between malicious code generation and security detection. The framework generates pseudo-malware samples that simulate attack behaviors while containing no actual harmful code, serving as a safe intermediary for evaluating security systems.
2Ease of operation
If open source generative AI models are used, then accessibility is improved, but they can be used to generate malware without restrictions
Solution Approach 1:
The patent uses generative AI models to create pseudo-malware that copies the structural and behavioral characteristics of actual malware. The AI models generate code samples that replicate malware patterns, API calls, and execution flows without containing actual harmful code, enabling research and testing while maintaining safety.
Solution Approach 2:
The patent converts the potential harm of unrestricted AI-generated code into a beneficial testing resource. By generating pseudo-malware that simulates attack behaviors, the system creates valuable test samples for improving security detection capabilities without the actual risks of real malware.
3Measurement precision
If malware scanning engines are tested with real malware, then detection accuracy is improved, but the testing process becomes complex and risky
Solution Approach 1:
The patent creates pseudo-malware that copies the essential characteristics of real malware including structural patterns, API calls, and execution flows. These pseudo-malware samples maintain the complexity and challenge of real malware testing while eliminating the risks associated with handling actual malicious code.
Solution Approach 2:
The patent uses disposable pseudo-malware samples that can be generated, tested, and discarded without risk. The pseudo-malware is created specifically for testing purposes and contains no persistent harmful code, allowing safe and repeated evaluation of scanning engines.
Data Source
AI summary
Disclosed is a system and method of black box testing a cybersecurity system. An attack chain or an element of the attack chain is decomposed into constituent primitives. Primitive codes for the primitives are generated by a generative artificial intelligence (AI) model. The primitive codes are assembled into a pseudo-malware. A malware scanning engine is black box tested against the pseudo-malware to determine whether the malware scanning engine can detect the pseudo-malware.