On the security of machine learning in malware C&C detection: a survey

Joseph Gardiner, Shishir Nagaraja

Research output: Contribution to journalArticle

24 Citations (Scopus)

Abstract

One of the main challenges in security today is defending against malware attacks. As trends and anecdotal evidence show, preventing these attacks, regardless of their indiscriminate or targeted nature, has proven difficult: intrusions happen and devices get compromised, even at security-conscious organizations. As a consequence, an alternative line of work has focused on detecting and disrupting the individual steps that follow an initial compromise and are essential for the successful progression of the attack. In particular, several approaches and techniques have been proposed to identify the command and control (C&C) channel that a compromised system establishes to communicate with its controller. A major oversight of many of these detection techniques is the design's resilience to evasion attempts by the well-motivated attacker. C&C detection techniques make widespread use of a machine learning (ML) component. Therefore, to analyze the evasion resilience of these detection techniques, we first systematize works in the field of C&C detection and then, using existing models from the literature, go on to systematize attacks against the ML components used in these approaches. © 2016 ACM 0360-0300/2016/12-ART59 $15.00.
LanguageEnglish
Article number59
Number of pages38
JournalACM Computing Surveys
Volume49
Issue number3
DOIs
Publication statusPublished - 31 Dec 2016

Fingerprint

Malware
Learning systems
Machine Learning
Attack
Resilience
Controllers
Command and Control
Progression
Controller
Line
Alternatives

Keywords

  • botnets
  • command and control channels
  • data mining
  • machine learning
  • network intrusion
  • artificial intelligence

Cite this

@article{fb8abbc73777496a824460958df61f14,
title = "On the security of machine learning in malware C&C detection: a survey",
abstract = "One of the main challenges in security today is defending against malware attacks. As trends and anecdotal evidence show, preventing these attacks, regardless of their indiscriminate or targeted nature, has proven difficult: intrusions happen and devices get compromised, even at security-conscious organizations. As a consequence, an alternative line of work has focused on detecting and disrupting the individual steps that follow an initial compromise and are essential for the successful progression of the attack. In particular, several approaches and techniques have been proposed to identify the command and control (C&C) channel that a compromised system establishes to communicate with its controller. A major oversight of many of these detection techniques is the design's resilience to evasion attempts by the well-motivated attacker. C&C detection techniques make widespread use of a machine learning (ML) component. Therefore, to analyze the evasion resilience of these detection techniques, we first systematize works in the field of C&C detection and then, using existing models from the literature, go on to systematize attacks against the ML components used in these approaches. {\circledC} 2016 ACM 0360-0300/2016/12-ART59 $15.00.",
keywords = "botnets, command and control channels, data mining, machine learning, network intrusion, artificial intelligence",
author = "Joseph Gardiner and Shishir Nagaraja",
note = "{\circledC} ACM, 2016. This is the author's version of the work. It is posted here by permission of ACM for your personal use. Not for redistribution. The definitive version was published in ACM Computing Surveys. 2016 ; Vol. 49, No. 3. http://doi.acm.org/10.1145/003816",
year = "2016",
month = "12",
day = "31",
doi = "10.1145/3003816",
language = "English",
volume = "49",
journal = "ACM Computing Surveys",
issn = "0360-0300",
number = "3",

}

On the security of machine learning in malware C&C detection : a survey. / Gardiner, Joseph; Nagaraja, Shishir.

In: ACM Computing Surveys, Vol. 49, No. 3, 59, 31.12.2016.

Research output: Contribution to journalArticle

TY - JOUR

T1 - On the security of machine learning in malware C&C detection

T2 - ACM Computing Surveys

AU - Gardiner, Joseph

AU - Nagaraja, Shishir

N1 - © ACM, 2016. This is the author's version of the work. It is posted here by permission of ACM for your personal use. Not for redistribution. The definitive version was published in ACM Computing Surveys. 2016 ; Vol. 49, No. 3. http://doi.acm.org/10.1145/003816

PY - 2016/12/31

Y1 - 2016/12/31

N2 - One of the main challenges in security today is defending against malware attacks. As trends and anecdotal evidence show, preventing these attacks, regardless of their indiscriminate or targeted nature, has proven difficult: intrusions happen and devices get compromised, even at security-conscious organizations. As a consequence, an alternative line of work has focused on detecting and disrupting the individual steps that follow an initial compromise and are essential for the successful progression of the attack. In particular, several approaches and techniques have been proposed to identify the command and control (C&C) channel that a compromised system establishes to communicate with its controller. A major oversight of many of these detection techniques is the design's resilience to evasion attempts by the well-motivated attacker. C&C detection techniques make widespread use of a machine learning (ML) component. Therefore, to analyze the evasion resilience of these detection techniques, we first systematize works in the field of C&C detection and then, using existing models from the literature, go on to systematize attacks against the ML components used in these approaches. © 2016 ACM 0360-0300/2016/12-ART59 $15.00.

AB - One of the main challenges in security today is defending against malware attacks. As trends and anecdotal evidence show, preventing these attacks, regardless of their indiscriminate or targeted nature, has proven difficult: intrusions happen and devices get compromised, even at security-conscious organizations. As a consequence, an alternative line of work has focused on detecting and disrupting the individual steps that follow an initial compromise and are essential for the successful progression of the attack. In particular, several approaches and techniques have been proposed to identify the command and control (C&C) channel that a compromised system establishes to communicate with its controller. A major oversight of many of these detection techniques is the design's resilience to evasion attempts by the well-motivated attacker. C&C detection techniques make widespread use of a machine learning (ML) component. Therefore, to analyze the evasion resilience of these detection techniques, we first systematize works in the field of C&C detection and then, using existing models from the literature, go on to systematize attacks against the ML components used in these approaches. © 2016 ACM 0360-0300/2016/12-ART59 $15.00.

KW - botnets

KW - command and control channels

KW - data mining

KW - machine learning

KW - network intrusion

KW - artificial intelligence

U2 - 10.1145/3003816

DO - 10.1145/3003816

M3 - Article

VL - 49

JO - ACM Computing Surveys

JF - ACM Computing Surveys

SN - 0360-0300

IS - 3

M1 - 59

ER -