Differentiating malware is important to determine their behaviors and level
of threat; as well as to devise defensive strategy against them. In response,
various anti-malware systems have been developed to distinguish between
different malwares. However, most of the recent malware families are Artificial
Intelligence (AI) enable and can deceive traditional anti-malware systems using
different obfuscation techniques. Therefore, only AI-enabled anti-malware
system is robust against these techniques and can detect different features in
the malware files that aid in malicious activities. In this study we review two
AI-enabled techniques for detecting malware in Windows and Android operating
system, respectively. Both the techniques achieved perfect accuracy in
detecting various malware families.

该研究评估了两种基于人工智能技术的恶意软件检测技术，分别适用于 Windows 和 Android 操作系统，结果表明这两种技术均可高度精确地检测出不同家族的恶意软件。

基于深度学习的 Android 和 Windows 系统恶意软件检测综述

Review of Deep Learning-based Malware Detection for Android and Windows  System

Antivirus developers are increasingly embracing machine learning as a key
component of malware defense. While machine learning achieves cutting-edge
outcomes in many fields, it also has weaknesses that are exploited by several
adversarial attack techniques. Many authors have presented both white-box and
black-box generators of adversarial malware examples capable of bypassing
malware detectors with varying success. We propose to combine contemporary
generators in order to increase their potential. Combining different generators
can create more sophisticated adversarial examples that are more likely to
evade anti-malware tools. We demonstrated this technique on five well-known
generators and recorded promising results. The best-performing combination of
AMG-random and MAB-Malware generators achieved an average evasion rate of 15.9%
against top-tier antivirus products. This represents an average improvement of
more than 36% and 627% over using only the AMG-random and MAB-Malware
generators, respectively. The generator that benefited the most from having
another generator follow its procedure was the FGSM injection attack, which
improved the evasion rate on average between 91.97% and 1,304.73%, depending on
the second generator used. These results demonstrate that combining different
generators can significantly improve their effectiveness against leading
antivirus programs.

研究如何通过结合多种生成器来创造更复杂的对抗性恶意软件，以提高其通过抗病毒工具的效果。

将对抗性恶意软件生成器组合以增加逃避率

Combining Generators of Adversarial Malware Examples to Increase Evasion  Rate

We develop a game theoretic model of malware protection using the
state-of-the-art sandbox method, to characterize and compute optimal defense
strategies for anti-malware. We model the strategic interaction between
developers of malware (M) and anti-malware (AM) as a two player game, where AM
commits to a strategy of generating sandbox environments, and M responds by
choosing to either attack or hide malicious activity based on the environment
it senses. We characterize the condition for AM to protect all its machines,
and identify conditions under which an optimal AM strategy can be computed
efficiently. For other cases, we provide a quadratically constrained quadratic
program (QCQP)-based optimization framework to compute the optimal AM strategy.
In addition, we identify a natural and easy to compute strategy for AM, which
as we show empirically, achieves AM utility that is close to the optimal AM
utility, in equilibrium.

开发了一个博弈论模型，使用最先进的沙箱方法进行恶意软件防护，并计算出了最优的防御策略。该模型考虑了恶意软件开发者和防恶意软件之间的策略互动，以及防恶意软件生成沙箱环境的策略和恶意软件依据环境感测本身的攻击或隐藏恶意活动的策略。该模型能够保护所有的机器并计算出最优策略，其中，使用了一个基于 QCQP 的优化框架来处理一些特殊情况，并且发现了一个自然易于计算的方法可以接近最优效用平衡。

反恶意软件沙箱游戏

Anti-Malware Sandbox Games

Anti-malware engines are the first line of defense against malicious
software. While widely used, feature engineering-based anti-malware engines are
vulnerable to unseen (zero-day) attacks. Recently, deep learning-based static
anti-malware detectors have achieved success in identifying unseen attacks
without requiring feature engineering and dynamic analysis. However, these
detectors are susceptible to malware variants with slight perturbations, known
as adversarial examples. Generating effective adversarial examples is useful to
reveal the vulnerabilities of such systems. Current methods for launching such
attacks require accessing either the specifications of the targeted
anti-malware model, the confidence score of the anti-malware response, or
dynamic malware analysis, which are either unrealistic or expensive. We propose
MalRNN, a novel deep learning-based approach to automatically generate evasive
malware variants without any of these restrictions. Our approach features an
adversarial example generation process, which learns a language model via a
generative sequence-to-sequence recurrent neural network to augment malware
binaries. MalRNN effectively evades three recent deep learning-based malware
detectors and outperforms current benchmark methods. Findings from applying our
MalRNN on a real dataset with eight malware categories are discussed.

本文提出了一种基于深度学习的 MalRNN 方法来生成恶意软件的变种，无需访问目标防病毒模型的规格、置信度分数或动态恶意软件分析等限制，同时对三个深度学习恶意软件检测器进行了有效的躲避，具有较强的实用价值。