AIセキュリティポータル K Program
On the Role of Similarity in Detecting Masquerading Files
Share
Abstract
Similarity has been applied to a wide range of security applications, typically used in machine learning models. We examine the problem posed by masquerading samples; that is samples crafted by bad actors to be similar or near identical to legitimate samples. We find that these samples potentially create significant problems for machine learning solutions. The primary problem being that bad actors can circumvent machine learning solutions by using masquerading samples. We then examine the interplay between digital signatures and machine learning solutions. In particular, we focus on executable files and code signing. We offer a taxonomy for masquerading files. We use a combination of similarity and clustering to find masquerading files. We use the insights gathered in this process to offer improvements to similarity based and machine learning security solutions.
Exorcist: Automated differential analysis to detect compromises in closed-source software supply chains
Frederick Barr-Smith, Tim Blazytko, Richard Baker, Ivan Martinovic
Published: 2022
Identifying almost identical files using context triggered piecewise hashing
Jesse Kornblum
Published: 2006
Internet security under attack: The undermining of digital certificates
Neal Leavitt
Published: 2011
ENISA Threat Landscape for Supply Chain Attacks
Ifigeneia Lella, Marianthi Theocharidou, Eleni Tsekmezoglou, Apostolos Malatras, Sebastián García
Published: 2021
Software supply chain attacks, a threat to global cybersecurity: Solarwinds’ case study
Jeferson Martínez, Javier M Durán
Published: 2021
Intriguing properties of neural networks
C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, R. Fergus
Published: 2014
Share