Towards Evolving Antigens for Antivirus Systems

Abstract

Malware are specific programs designed by malicious actors to damage computers, computing systems and networks by extracting personally identifiable information, holding sensitive data to ransom and even completely controlling a computing device without the knowledge of the end-user. To combat these programs/software a variety of antivirus scanners have been developed to detect them and contain their spread. While a typical antivirus scanner scans files in the end users computing environment for the signature patterns to identify the malicious entity, it is well known that even minor modifications to the code structure results in the malware variants being able to evade detection by these antivirus scanners and the majority of successful malware attacks are variants of existing malware that escape detection. To combat this problem, there are two strategies with diametrically opposite perspectives that are used in anti-malware research. The first strategy is a defensive one which employs computational intelligence approaches to detect, classify and predict malware variants by identifying attributes of a malware executable. However, these techniques are reliant on the underlying dataset used for training and classification and are also severly impacted by the shortage of such publicly available labelled datasets. On the other hand, the second strategy is more aggressive and involves generating malware in an effort to proactively identify malware variants. By using adversarial and/or meta-heuristic techniques, there exists a potential to create different malware to aid the antivirus scanners in identifying potentially undiscovered malware variants by creating a dataset of diverse malware variants. This dataset in turn can serve as a reliable database upon which the former (artificial intelligent) algorithms can be trained/tested. This thesis proposes and demonstrates the working of a generic assembly source code based framework that facilitates any population based metaheuristic algorithm to generate valid, diverse..