التفاصيل البيبلوغرافية
| العنوان: |
基于深度强化学习的恶意ELF文件检测对抗方法. (Chinese) |
| Alternate Title: |
Adversarial method for malicious ELF file detection based on deep reinforcement learning. (English) |
| المؤلفون: |
孙贺, 张博成, 耿嘉炫, 吴迪, 王俊峰, 方智阳 |
| المصدر: |
Chinese Journal of Network & Information Security; Oct2024, Vol. 10 Issue 5, p152-162, 11p |
| Abstract (English): |
In recent years, research on detecting malicious executable and linkable format (ELF) files based on deep learning had made significant progress. At the same time, adversarial attacks on models had also gained widespread attention. Attackers could generate adversarial examples to mislead neural networks, causing malicious software to be misclassified as benign, thereby evading detection. Although various methods for generating adversarial examples had been proposed, they were often not suitable for modifying ELF files or lacked the ability to transfer across different detection models. To overcome the limitations of existing methods, an adversarial example generation method based on deep reinforcement learning was proposed. This method generated adversarial examples by constructing optimal perturbation bytes for the target detection model while preserving the original functionality of the ELF files, without relying on the internal details of the target model. The experimental results showed that the adversarial examples generated by this method achieved a 76.80% success rate in evading the target detection model, and could enhance the robustness of the model through adversarial training. [ABSTRACT FROM AUTHOR] |
| Abstract (Chinese): |
近年来, 基于深度学习的恶意可执行与可链接格式（executable and linkable format, ELF）文件检 测研究取得了显著进展。同时, 关于模型对抗性攻击的研究也得到了广泛关注, 攻击者可以通过生成对抗 样本误导神经网络, 使恶意软件被错误归类为良性软件, 从而逃逸检测。尽管已有多种生成对抗样本的方 法被提出, 但它们通常不适合对ELF文件进行修改, 或缺乏在不同检测模型之间迁移的能力。为克服现有 方法的局限性, 提出了一种基于深度强化学习的恶意ELF文件检测对抗方法, 该方法通过构造目标检测模 型的最优扰动字节序列, 能够在保留ELF文件原有功能的前提下生成对抗样本, 而无须依赖目标模型的内 部实现细节。实验结果表明, 该方法生成的对抗样本针对目标检测模型的逃逸成功率达到76.80%, 并能通 过对抗训练提升目标检测模型的鲁棒性. [ABSTRACT FROM AUTHOR] |
|
Copyright of Chinese Journal of Network & Information Security is the property of Beijing Xintong Media Co., Ltd. and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.) |
| قاعدة البيانات: |
Complementary Index |