Code transplantation for adversarial malware

Cortellazzi, Jacopo (2018) Code transplantation for adversarial malware. [Laurea magistrale], Università di Bologna, Corso di Studio in Ingegneria informatica [LM-DM270]
Documenti full-text disponibili:
[img] Documento PDF (Thesis)
Disponibile con Licenza: Salvo eventuali più ampie autorizzazioni dell'autore, la tesi può essere liberamente consultata e può essere effettuato il salvataggio e la stampa di una copia per fini strettamente personali di studio, di ricerca e di insegnamento, con espresso divieto di qualunque utilizzo direttamente o indirettamente commerciale. Ogni altro diritto sul materiale è riservato

Download (3MB)


In the nefarious fight against attackers, a wide range of smart algorithms have been introduced, in order to block and even prevent new families of malware before their appearance. Machine learning, for instance, recently gained a lot of attention thanks to its ability to use generalization to possibly detect never-before-seen attacks or variants of a known one. During the past years, a lot of works have tested the strength of machine learning in the cybersecurity field, exploring its potentialities and weaknesses. In particular, various studies highlighted its robustness against adversarial attacks, proposing strategies to mitigate them . Unfortunately, all these findings have focused in testing their own discoveries just operating on the dataset at feature layer space, which is the virtual data representation space, without testing the current feasibility of the attack at the problem space level, modifying the current adversarial sample . For this reason, in this dissertation, we will introduce PRISM, a framework for executing an adversarial attack operating at the problem space level. Even if this framework focuses only on Android applications, the whole methodology can be generalized on other platforms, like Windows, Mac or Linux executable files. The main idea is to successfully evade a classifier by transplanting chunks of code, taken from a set of goodware to a given malware. Exactly as in medicine, we have a donor who donates organs and receivers who receive them, in this case, goodware applications are our donors, the organs are the needed code and the receiver is the targeted malware. In the following work we will discuss about concepts related to a wide variety of topics, ranging from machine learning, due to the target classifier, to static analysis, due to the possible countermeasures considered, to program analysis, due to the extraction techniques adopter, ending in mobile application, because the target operating system is Android.

Tipologia del documento
Tesi di laurea (Laurea magistrale)
Autore della tesi
Cortellazzi, Jacopo
Relatore della tesi
Correlatore della tesi
Corso di studio
Ordinamento Cds
Parole chiave
Malware,Machine Learning,Static Analysis,Android
Data di discussione della Tesi
19 Dicembre 2018

Altri metadati

Statistica sui download

Gestione del documento: Visualizza il documento