- Adversarial machine learning (ML) attacks can undermine the effectiveness of ML models and their ability to detect malware through strategies such as using static ML evasion to modify known malware variants .
- CrowdStrike Improves Detection Capabilities by Red Teaming Proprietary ML Malware Classifiers with Automated Tools to Generate New Adversarial Samples
- of cloud strike Adversarial Pipeline can automatically generate millions of unique adversarial samples based on a set of generators with configurable attacks
- Using new out-of-sample adversarial samples in the ML model training data showed a 19% increase in malware sample retention at high confidence levels.
The power of the CrowdStrike Falcon® The platform is power of the cloud Professionally built machine learning (ML) models.
Falcon’s on-sensor and cloud ML capabilities in real-world conditions and independent third-party evaluations achieve consistently excellent results Across Windows, Linux and mac OS platform. This is especially impressive given that ML does not use signatures, so the Falcon platform can identify malicious intent based solely on file attributes. This result reflects the effectiveness of CrowdStrike’s multi-level ML approach, which incorporates not only file analysis, but also behavioral analysis and indicators of attack (IOAs).
but, ML is not infallibleIt becomes susceptible to adversarial attacks from humans and other ML algorithms. Examples of the latter include introducing compromised data during the training process or subtly modifying an existing malware version.
CrowdStrike’s Adversarial Pipeline is a tool to combat static ML evasion, one of the most commonly used adversarial ML tactics. Our research team used this pipeline to simulate new and modified versions of known malware using a series of generators with configurable attacks, resulting in large numbers of You can generate new unique adversarial samples. These samples are used to train ML models to significantly increase the efficiency of detecting cyber-attacks that use static ML evasion..
The industry-leading CrowdStrike Falcon platform sets a new standard in cybersecurity. Check out this demo to see the Falcon platform in action..
The Growing Threat of Adversarial ML Attacks
Five years ago, adversarial ML attacks were relatively rare, but by 2020 the threat had grown to the point that MITER released it. ATLAS (Adversarial Threat Landscape Against Artificial Intelligence Systems) Threat Matrix.
Adversarial ML, or adversarial attacks, includes a wide range of methods to trick ML into providing unexpected or incorrect output. Some examples are:
- By making targeted mathematical changes to the panda image, we force the classifier to say that the panda image is a gibbon.
- Adds text extracted from a clean Windows executable to the detected malicious file to trick the classifier into thinking it is clean
- Infiltrate and sneak into a company’s internal network and insert millions of pictures of traffic lights labeled “ducks” into an image database
Attacks can come from multiple stages of a model’s development lifecycle. Data can be weaponized during training. Inserting incorrectly labeled data During classification, as MITER states, by creating data that either adds to the training set or leverages the model (and other models subsequently trained using that corpus). Existing malware can be modified to avoid detection by ML models that scan for specific signatures. Naturally, these techniques can be chained, combined, and merged to increase the effectiveness of attacks. Successful adversarial ML attacks produce malware that can sneakily evade trained and production-ready ML models.
No wonder the subject of adversarial attacks is of great interest across the field of ML, including malware detection. object recognition, autonomous driving, medical systems and other applications. Researchers across the ML field have worked to improve model robustness and detect adversarial attacks based on malicious inputs.
In security terms, completely undetectable malware is malicious software that has never been seen before. Therefore, it cannot be detected by antivirus software that relies on databases of known virus definitions and signatures. Modifying existing malware samples to achieve completely undetectable malware or to evade specified antivirus detection (either static or ML-enabled) is one way to . Oldest trick in the book used by the red team and attackers.
Small, targeted changes in the analyzed sample can lead to significantly different results in detection efficiency. Static rule-based detections are also susceptible to this type of attack and have been successfully applied in practice. Emotet and other sophisticated threat actors.
research paper Issued in March 2022 Here is an overview of the challenges in combating this form of adversarial malware.
“Traditional approaches based on analyzing static signatures (such as hashes) of malware binaries are increasingly being defeated by the prevalence of polymorphism and program obfuscation tools. Such tools allow malware authors to quickly generate thousands of binary variants of functionally identical samples, effectively circumventing signature-based approaches.”
CrowdStrike has rigorous processes to protect its corpus from adversarial ML attacks. Our threat researchers also employ advanced techniques to defend against them. We then examine one of the methods he uses to continuously enhance detection coverage: CrowdStrike’s Adversarial Pipeline tool.
Will the real hostile creators rise up?
CrowdStrike basically improves the detection capabilities of ML models in the following ways: red team our own classifier. While dynamic adversarial emulation and other standard methods of exploiting ML have been adopted as part of red teaming, the CrowdStrike Adversarial Pipeline stands out as a unique and advanced approach. Designed to be automated and extensible, we can quickly integrate a variety of attacks described by our threat research team and external open source researchers (the open source community has seen a proliferation of ways to circumvent ML models). are available).
Figure 1. Framework for hardening models against adversarial attacks (click to enlarge)
The CrowdStrike Adversarial Pipeline architecture consists of various “generators” of supported file formats with configurable attack lists. For example, a generator can add whole megabytes of random English words or sections of clean code to a malware sample without affecting its functionality. These generators work in parallel and provide flexible tools for generating adversarial samples that fit the classifier. The Adversarial Pipeline can support fast generation of millions of unique samples, making it a very powerful tool. Also, to improve the robustness or stability of the ML classifier, the generated samples are actually executable binaries that can be run on Falcon sensors. In contrast, other mathematical techniques use perturbation techniques that render sterile adversarial samples.
Figure 2. Examples of adversarial attack generators against various file types (click to enlarge)
bright side
The situation may seem grim and overlapping to parents, but the good news is that it is possible to harden each stage of ML model development against adversarial attacks. CrowdStrike threat researchers employ multiple tactics, including corpus cleaning, deduplication, adding adversarial samples to training data, and improving feature extraction capabilities.
Additionally, recognizing that static ML is only one layer of defense, CrowdStrike’s threat researchers focus on behavior, IOA, and IOA powered by AI It provides an extra layer of protection that is difficult to get around at the same time. This comprehensive approach to protection is why the CrowdStrike Falcon platform continues to lead the industry. Received first-ever SE Labs AAA Advanced Security (Ransomware) Awardachieve 100% ransomware protection with zero false positives.
See for yourself how the industry-leading CrowdStrike Falcon platform protects against the latest threats. Start your 15-day free trial now.
The value of generating adversarial samples
We found that including new out-of-sample adversarial samples in the ML model training data increased retention of malware samples at high confidence levels by 19%. It does this with little deviation from the original sample verdict, thus limiting the impact of the attack itself.
For a subset of the data chosen to closely reflect real-world sample characteristics, the experimental detectable true positive rate (TPR) is 80% increased through several stages 90% It achieves a fixed false positive rate (FPR) by incrementally adding more and more adversarial samples in the model training process. This performance improvement was observed extensively, not just for a single his FPR. The results are shown in Figure 3.
Figure 3. Improving true positive rate (TPR) performance by incrementally adding more adversarial samples in the model training process (click to enlarge)
READY FOR CONTINUOUS RESEARCH
The research highlights the value of CrowdStrike. A feature in the Adversarial Pipeline that generates “new” adversarial sample variations to enhance the detection coverage and effectiveness of CrowdStrike’s ML models. Using this tool in the model training process continuously improves the model’s effectiveness against adversarial attacks employing completely undetectable malware ML strategies.
CrowdStrike researchers continuously explore theoretical and applied ML research to advance and improve detection and detection. ML model effectiveness featuresprotects customers from advanced threats and adversaries, and sets the industry standard to stop breaches.
