English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools annual

Global: Zendy Free Plan

Global: Zendy Tools monthly

Global: Zendy Plus monthly

State of the art deep learning techniques are known to be vulnerable toevasion attacks where an adversarial sample is generated from a malign sampleand misclassified as benign. Detection of encrypted malware command and controltraffic based on TCP/IP flow features can be framed as a learning task and isthus vulnerable to evasion attacks. However, unlike e.g. in image processingwhere generated adversarial samples can be directly mapped to images, goingfrom flow features to actual TCP/IP packets requires crafting the sequence ofpackets, with no established approach for such crafting and a limitation on theset of modifiable features that such crafting allows. In this paper we discusslearning and evasion consequences of the gap between generated and craftedadversarial samples. We exemplify with a deep neural network detector trainedon a public C2 traffic dataset, white-box adversarial learning, and aproxy-based approach for crafting longer flows. Our results show 1) the highevasion rate obtained by using generated adversarial samples on the detectorcan be significantly reduced when using crafted adversarial samples; 2)robustness against adversarial samples by model hardening varies according tothe crafting approach and corresponding set of modifiable features that theattack allows for; 3) incrementally training hardened models with adversarialsamples can produce a level playing field where no detector is best against allattacks and no attack is best against all detectors, in a given set of attacksand detectors. To the best of our knowledge this is the first time that levelplaying field feature set- and iteration-hardening are analyzed in encrypted C2malware traffic detection.

Flow-based detection and proxy-based evasion of encrypted malware C2 traffic