Wojciech Mazurczyk, Luca Caviglione
Information hiding techniques are increasingly utilized by the current malware to hide its existence and communication attempts. In this paper we highlight this new trend by reviewing the most notable examples of malicious software that shows this capability.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
继续探索
Compared to cryptography, steganography is a less discussed domain. However, there is a recent trend of exploiting various information hiding techniques to empower malware, for instance to bypass security frameworks of mobile devices or to exfiltrate sensitive data. This is mostly due to the need to counteract increasingly sophisticated security mechanisms, such as code analysis, runtime countermeasures, or real-time traffic inspection tools. In this perspective, this paper presents malware exploiting information hiding in a broad sense, i.e., it does not focus on classical covert channels, bu…
Malware distribution to the victim network is commonly performed through file attachments in phishing email or from the internet, when the victim interacts with the source of infection. To detect and prevent the malware distribution in the victim machine, the existing end device security applications may leverage techniques such as signature or anomaly-based, machine learning techniques. The well-known file formats Portable Executable (PE) for Windows and Executable and Linkable Format (ELF) for Linux based operating system are used for malware analysis, and the malware detection capabilities …
Delivering malware covertly and evasively is critical to advanced malware campaigns. In this paper, we present a new method to covertly and evasively deliver malware through a neural network model. Neural network models are poorly explainable and have a good generalization ability. By embedding malware in neurons, the malware can be delivered covertly, with minor or no impact on the performance of neural network. Meanwhile, because the structure of the neural network model remains unchanged, it can pass the security scan of antivirus engines. Experiments show that 36.9MB of malware can be embe…
MalModel: Hiding Malicious Payload in Mobile Deep Learning Models with Black-box Backdoor Attack
本研究提出MalModel方法，通过黑盒后门攻击将恶意负载隐藏在移动深度学习模型参数中，实现隐蔽运行恶意软件且对模型性能影响极小。
Hiding Sensitive Information Using PDF Steganography
本文提出一种基于PDF流操作符实值操作数最低有效位插入的新型PDF隐写算法，全面评估Adobe PDF标准中所有操作符的可用性，并通过案例研究展示将恶意软件嵌入PDF文档的能力。
AndroWasm: an Empirical Study on Android Malware Obfuscation through WebAssembly
本文通过实证研究探讨了Android恶意软件利用WebAssembly技术进行混淆和规避检测的方法及效果。
Malwares are continuously growing in sophistication and numbers. Over the last decade, remarkable progress has been achieved in anti-malware mechanisms. However, several pressing issues (e.g., unknown malware samples detection) still need to be addressed adequately. This article first presents a concise overview of malware along with anti-malware and then summarizes various research challenges. This is a theoretical and perspective article that is hoped to complement earlier articles and works.
MTFS: a Moving Target Defense-Enabled File System for Malware Mitigation
本文提出MTFS覆盖文件系统，集成三种移动目标防御技术，延迟攻击者、诱捕递归遍历、隐藏文件类型，实验表明在物联网设备上有效，面对14个勒索软件样本可拯救97%文件。
The Microsoft Malware Classification Challenge was announced in 2015 along with a publication of a huge dataset of nearly 0.5 terabytes, consisting of disassembly and bytecode of more than 20K malware samples. Apart from serving in the Kaggle competition, the dataset has become a standard benchmark for research on modeling malware behaviour. To date, the dataset has been cited in more than 50 research papers. Here we provide a high-level comparison of the publications citing the dataset. The comparison simplifies finding potential research directions in this field and future performance evalua…
Malware continues to be a major cyber threat, despite the tremendous effort that has been made to combat them. The number of malware in the wild steadily increases over time, meaning that we must resort to automated defense techniques. This naturally calls for machine learning based malware detection. However, machine learning is known to be vulnerable to adversarial evasion attacks that manipulate a small number of features to make classifiers wrongly recognize a malware sample as a benign one. The state-of-the-art is that there are no effective countermeasures against these attacks. Inspired…
A common way to get insight into a malicious program's functionality is to look at which API functions it calls. To complicate the reverse engineering of their programs, malware authors deploy API obfuscation techniques, hiding them from analysts' eyes and anti-malware scanners. This problem can be partially addressed by using dynamic analysis; that is, by executing a malware sample in a controlled environment and logging the API calls. However, malware that is aware of virtual machines and sandboxes might terminate without showing any signs of malicious behavior. In this paper, we introduce a…
Nowadays, mobile handsets combine the functionality of mobile phones and PDAs. Unfortunately, mobile handsets development process has been driven by market demand, focusing on new features and neglecting security. So, it is imperative to study the existing challenges that facing the mobile handsets threat containment process, and the different techniques and methodologies that used to face those challenges and contain the mobile handsets malwares. This paper also presents a new approach to group the different malware containment systems according to their typologies.
MADAR: Efficient Continual Learning for Malware Analysis with Distribution-Aware Replay
针对恶意软件分类中持续学习表现不佳的问题，提出考虑恶意软件数据分布独特性质的MADAR框架，在大规模Windows和Android数据集上显著优于现有方法。
Addressing malware family concept drift with triplet autoencoder
本文提出一种结合三元组损失的有监督自编码器和DBSCAN算法的方法，通过构建清晰稳健的聚类来有效识别新出现的恶意软件家族，从而解决恶意软件检测中的概念漂移问题，并在Android和Windows数据集上验证了其显著提升效果。
Obfuscated Malware Detection: Investigating Real-world Scenarios through Memory Analysis
本文提出基于内存转储分析和多种机器学习算法的低成本混淆恶意软件检测系统，并在CIC-MalMem-2022数据集上评估决策树、集成方法和神经网络等算法在真实场景下的检测效果，为增强网络安全提供参考。
Malwares are big threat to digital world and evolving with high complexity. It can penetrate networks, steal confidential information from computers, bring down servers and can cripple infrastructures etc. To combat the threat/attacks from the malwares, anti- malwares have been developed. The existing anti-malwares are mostly based on the assumption that the malware structure does not changes appreciably. But the recent advancement in second generation malwares can create variants and hence posed a challenge to anti-malwares developers. To combat the threat/attacks from the second generation m…
Combining Different Existing Methods for Describing Steganography Hiding Methods
本文以教程形式介绍隐写术描述性方法的概念，旨在说明如何结合现有描述与分类对象，以实现对网络隐写术隐藏方法的详细分类和描述，并辅以真实案例帮助研究社区。
Researchers and commercial companies have made a lot of efforts on detecting malware in Android platform. However, a recent malware threat, App collusion, makes malware detection challenging. In App collusion, two or more Apps collaborate to perform malicious actions by communicating with each other, which makes single App analysis insufficient. In this paper, we first introduce Android security mechanism and communication channels used by android Applications. Then we summarize the security vulnerabilities and potential threats introduced by App communication. Finally, we discuss state of art…
Empirical Analysis of Evasion and Poisoning Against Malware Data Drift Detection
本研究实证分析了针对恶意软件数据漂移检测器与恶意软件分类器组合的规避、投毒攻击，发现数据漂移检测器的独特特性会使针对恶意软件分类器的攻击产生不同效果。
Feature-Oriented IoT Malware Analysis: Extraction, Classification, and Future Directions
本综述全面梳理物联网恶意软件特征提取技术，涵盖静态、动态及混合方法，并探讨图学习表示策略，比较优劣，指出挑战与未来方向。
Malware still constitutes a major threat in the cybersecurity landscape, also due to the widespread use of infection vectors such as documents. These infection vectors hide embedded malicious code to the victim users, facilitating the use of social engineering techniques to infect their machines. Research showed that machine-learning algorithms provide effective detection mechanisms against such threats, but the existence of an arms race in adversarial settings has recently challenged such systems. In this work, we focus on malware embedded in PDF files as a representative case of such an arms…
Network steganography is the art of hiding secret information within innocent network transmissions. Recent findings indicate that novel malware is increasingly using network steganography. Similarly, other malicious activities can profit from network steganography, such as data leakage or the exchange of pedophile data. This paper provides an introduction to network steganography and highlights its potential application for harmful purposes. We discuss the issues related to countering network steganography in practice and provide an outlook on further research directions and problems.
Malware detection is challenging when faced with automatically generated and polymorphic malware, as well as with rootkits, which are exceptionally hard to detect. In an attempt to contribute towards addressing these challenges, we conducted a proof of concept study that explored the use of power consumption for detection of malware presence in a general-purpose computer. The results of our experiments indicate that malware indeed leaves a signal on the power consumption of a general-purpose computer. Specifically, for the case study based on two different rootkits, the data collected at the +…
New computing paradigms, modern feature-rich programming languages and off-the-shelf software libraries enabled the development of new sophisticated malware families. Evidence of this phenomena is the recent growth of fileless malware attacks. Fileless malware or memory resident malware is an example of an Advanced Volatile Threat (AVT). In a fileless malware attack, the malware writes itself directly onto the main memory (RAM) of the compromised device without leaving any trace on the compromised device's file system. For this reason, fileless malware presents a difficult challenge for tradit…
Empirical Evaluation of SMOTE in Android Malware Detection with Machine Learning: Challenges and Performance in CICMalDroid 2020
本研究评估了SMOTE在Android恶意软件检测中的效果，发现其在CICMalDroid 2020数据集中并未提升性能，而基于树的算法如XGBoost表现更优。
Machine Learning for Windows Malware Detection and Classification: Methods, Challenges and Ongoing Research
本章探讨了如何应用机器学习构建 Windows 恶意软件检测系统，介绍了机器学习管道组件、基于特征和深度学习的最先进检测器，并分析了概念漂移和对抗攻击等主要挑战及对抗防御的持续研究。
Catch'em all: Classification of Rare, Prominent, and Novel Malware Families
针对现有机器学习方法在类别不平衡下难检测新型恶意软件、分类效果不佳的问题，提出降维与特征提取框架MalwareDNA，可在不平衡场景下稳定完成两类任务，仅伴随弃权率上升的权衡。
SoK: An Essential Guide For Using Malware Sandboxes In Security Applications: Challenges, Pitfalls, and Lessons Learned
本文系统化整理84篇文献，提出简化沙箱组件的新框架与实用指南，证明其能显著提升沙箱可观察活动及分类准确率，并建议用户据此定义分析范围与威胁模型。
User-space library rootkits revisited: Are user-space detection mechanisms futile?
本文重新审视用户空间库rootkit，指出用户空间检测机制无法有效检测此类rootkit，并通过实验展示规避方法及改进检测工具的指导。
Recent works have shown promise in using microarchitectural execution patterns to detect malware programs. These detectors belong to a class of detectors known as signature-based detectors as they catch malware by comparing a program's execution pattern (signature) to execution patterns of known malware programs. In this work, we propose a new class of detectors - anomaly-based hardware malware detectors - that do not require signatures for malware detection, and thus can catch a wider range of malware including potentially novel ones. We use unsupervised machine learning to build profiles of …
In today's world the art of sending & displaying the hidden information especially in public places, has received more attention and faced many challenges. Therefore, different methods have been proposed so far for hiding information in different cover media. In this paper a method for hiding of information on the billboard display is presented. It is well known that encryption provides secure channels for communicating entities. However, due to lack of covertness on these channels, an eavesdropper can identify encrypted streams through statistical tests and capture them for further cryptanaly…
Large Capacity Data Hiding in Binary Image black and white mixed regions
本文提出在二值图像黑白混合区域进行信息隐藏以降低视觉失真，并设计高效编码实现高容量隐藏，计算成本低，适用于实时应用。
Explainable Artificial Intelligence (XAI) for Malware Analysis: A Survey of Techniques, Applications, and Open Challenges
本文系统综述了可解释人工智能（XAI）在恶意软件分析中的技术、应用与开放挑战，旨在帮助研究者在保持检测性能的同时提升模型可解释性。
HilEnT: Hilbert, Entropy Transformed Image Based Malware Detection
提出基于希尔伯特曲线变换与熵特征比较的恶意软件二进制到图像转换技术HilEnT，用机器学习检测，进行多分类评估，研究特征降维技术，在四个数据集上获最优结果。
Semantic Steganography: A Framework for Robust and High-Capacity Information Hiding using Large Language Models
提出基于LLMs的语义隐写框架，通过构建语义空间和本体-实体树映射秘密消息，提升嵌入容量、鲁棒性及隐写文本质量。
In this paper, we argue that machine learning techniques are not ready for malware detection in the wild. Given the current trend in malware development and the increase of unconventional malware attacks, we expect that dynamic malware analysis is the future for antimalware detection and prevention systems. A comprehensive review of machine learning for malware detection is presented. Then, we discuss how malware detection in the wild present unique challenges for the current state-of-the-art machine learning techniques. We defined three critical problems that limit the success of malware dete…
In malware detection, dynamic analysis extracts the runtime behavior of malware samples in a controlled environment and static analysis extracts features using reverse engineering tools. While the former faces the challenges of anti-virtualization and evasive behavior of malware samples, the latter faces the challenges of code obfuscation. To tackle these drawbacks, prior works proposed to develop detection models by aggregating dynamic and static features, thus leveraging the advantages of both approaches. However, simply concatenating dynamic and static features raises an issue of imbalanced…
A survey on hardware-based malware detection approaches
该综述聚焦基于硬件的恶意软件检测方法，梳理其框架、常用技术与优势，指出当前准确率提升、分类错误解决等挑战，并提出软硬件协同、硬件监控单元升级等未来方向。
Coping with malware is getting more and more challenging, given their relentless growth in complexity and volume. One of the most common approaches in literature is using machine learning techniques, to automatically learn models and patterns behind such complexity, and to develop technologies to keep pace with malware evolution. This survey aims at providing an overview on the way machine learning has been used so far in the context of malware analysis in Windows environments, i.e. for the analysis of Portable Executables. We systematize surveyed papers according to their objectives (i.e., th…
Performance analysis of Machine learning algorithms for predicting malware
本研究针对恶意软件检测难题，提出基于机器学习的检测框架，评估对比多种算法，发现XGBoost准确率达98.62%最优，还基于Flask开发了实时检测系统，为网络安全方案提供支撑。
Deep Learning Based XIoT Malware Analysis: A Comprehensive Survey, Taxonomy, and Research Challenges
本文系统综述了基于深度学习的XIoT恶意软件分析方法，涵盖IIoT、IoMT、IoV和IoBT等类别，并提出分类法及未来研究挑战。
"Digital Camouflage": The LLVM Challenge in LLM-Based Malware Detection
本文实证评估ChatGPT-4o、Gemini Flash 2.5和Claude Sonnet 4对LLVM编译器级混淆的鲁棒性，发现其检测精确率、召回率和F1分数显著下降，揭示LLM易被编译器混淆策略误导的关键局限，并探讨了抗混淆防御方向。
Exploring LLMs for Malware Detection: Review, Framework Design, and Countermeasure Approaches
针对LLMs被用于生成传播恶意软件的网络安全挑战，本文综述了LLMs在恶意软件检测中的五类应用，提出了性能评估指标、风险缓解框架，并验证了策略有效性，给出了未来研究方向。
This paper focuses on the anticipatory enhancement of methods of detecting stealth software. Cyber security detection tools are insufficiently powerful to reveal the most recent cyber-attacks which use malware. In this paper, we will present first an idea of the highest stealth malware, as this is the most complicated scenario for detection because it combines both existing anti-forensic techniques together with their potential improvements. Second, we present new detection methods, which are resilient to this hidden prototype. To help solve this detection challenge, we have analyzed Windows m…
The challenge in engaging malware activities involves the correct identification and classification of different malware variants. Various malwares incorporate code obfuscation methods that alters their code signatures effectively countering antimalware detection techniques utilizing static methods and signature database. In this study, we utilized an approach of converting a malware binary into an image and use Random Forest to classify various malware families. The resulting accuracy of 0.9562 exhibits the effectivess of the method in detecting malware
Phantomware: a Data Augmentation Framework for the Detection of Emerging Malware Campaigns
Phantomware是面向极端数据稀缺场景的数据增强框架，通过在预训练恶意软件检测器的表示空间中生成合成恶意软件表示，提升了未知恶意软件变体的检测能力与鲁棒性。
A Research and Development Portfolio of GNN Centric Malware Detection, Explainability, and Dataset Curation
本文通过六个相关研究，探讨了基于GNN的恶意软件检测中的可扩展性、可解释性和数据集问题，提出了新的图简化方法、双解释技术及集成模型，同时发布了控制流图数据集以支持未来研究。
The Road Less Traveled: Investigating Robustness and Explainability in CNN Malware Detection
本研究通过结合定量分析与Occlusion Maps、HiResCAM和SHAP等可解释性工具，探究了CNN恶意软件检测的决策行为，发现混淆技术可使准确率降低50%并提出缓解策略，提升了深度学习入侵检测系统的可解释性与鲁棒性。
Case Study: Neural Network Malware Detection Verification for Feature and Image Datasets
本文以案例研究形式评估神经网络恶意软件检测的验证过程，使用NNV和nnenum工具在特征与图像数据集上展示认证鲁棒性，并提出改进验证的挑战与未来方向。
With explosive growth in the number of mobile devices, the mobile malware is rapidly spreading as well, and the number of encountered malware families is increasing. Existing solutions, which are mainly based on one malware detector running on the phone or in the cloud, are no longer effective. Main problem lies in the fact that it might be impossible to create a unique mobile malware detector that would be able to detect different malware families with high accuracy, being at the same time lightweight enough not to drain battery quickly and fast enough to give results of detection promptly. T…
Explainable Android Malware Detection and Malicious Code Localization Using Graph Attention
本文提出XAIDroid方法，利用图神经网络和图注意力机制对安卓恶意软件API调用图进行建模，自动定位恶意代码片段，从而提升恶意软件分析的可解释性与可扩展性。
Attributing a piece of malware to its creator typically requires threat intelligence. Binary attribution increases the level of difficulty as it mostly relies upon the ability to disassemble binaries to identify authorship style. Our survey explores malicious author style and the adversarial techniques used by them to remain anonymous. We examine the adversarial impact on the state-of-the-art methods. We identify key findings and explore the open research challenges. To mitigate the lack of ground truth datasets in this domain, we publish alongside this survey the largest and most diverse meta…
Research shows that over the last decade, malware has been growing exponentially, causing substantial financial losses to various organizations. Different anti-malware companies have been proposing solutions to defend attacks from these malware. The velocity, volume, and the complexity of malware are posing new challenges to the anti-malware community. Current state-of-the-art research shows that recently, researchers and anti-virus organizations started applying machine learning and deep learning methods for malware analysis and detection. We have used opcode frequency as a feature vector and…
CITADEL: A Semi-Supervised Active Learning Framework for Malware Detection Under Continuous Distribution Drift
CITADEL通过恶意软件特定的增强方法和多标准主动学习策略，在对抗持续分布漂移的情况下，以较少的标注样本实现了更高的恶意软件检测精度。
Security through the Eyes of AI: How Visualization is Shaping Malware Detection
本文综述了100多篇论文，提出新框架系统分析可视化技术在恶意软件检测中的应用，揭示挑战并展望未来方向。
Harnessing the Speed and Accuracy of Machine Learning to Advance Cybersecurity
本文综述监督/无监督学习、深度学习与强化学习等ML技术在恶意软件检测中的应用、挑战及未来方向，凸显其提升检测速度与准确性、增强网络安全的潜力。
Android is one of the leading operating systems for smart phones in terms of market share and usage. Unfortunately, it is also an appealing target for attackers to compromise its security through malicious applications. To tackle this issue, domain experts and researchers are trying different techniques to stop such attacks. All the attempts of securing Android platform are somewhat successful. However, existing detection techniques have severe shortcomings, including the cumbersome process of feature engineering. Designing representative features require expert domain knowledge. There is a ne…
Malware is being increasingly threatening and malware detectors based on traditional signature-based analysis are no longer suitable for current malware detection. Recently, the models based on machine learning (ML) are developed for predicting unknown malware variants and saving human strength. However, most of the existing ML models are black-box, which made their pre-diction results undependable, and therefore need further interpretation in order to be effectively deployed in the wild. This paper aims to examine and categorize the existing researches on ML-based malware detector interpretab…
Malware classification is a difficult problem, to which machine learning methods have been applied for decades. Yet progress has often been slow, in part due to a number of unique difficulties with the task that occur through all stages of the developing a machine learning system: data collection, labeling, feature creation and selection, model selection, and evaluation. In this survey we will review a number of the current methods and challenges related to malware classification, including data collection, feature extraction, and model construction, and evaluation. Our discussion will include…
LLMs Caught in the Crossfire: Malware Requests and Jailbreak Challenges
针对大语言模型在代码生成场景下越狱攻击 vulnerability 研究不足的问题，提出包含3520条提示的MalwareBench基准，实验发现主流LLM恶意内容平均拒绝率仅60.93%，结合越狱攻击后降至39.92%，凸显其代码安全挑战。
扫码添加微信好友，提出您的宝贵建议 👇
💡 备注请填写：网站反馈
发表机构由 AI 从论文文本抽取，如发现错误，欢迎反馈修正建议。