Can genetic algorithms help virus writers reshape their creations and avoid detection?

Abstract

Different attack and defence techniques have been evolved over time as actions and reactions between black-hat and white-hat communities. Encryption, polymorphism, metamorphism and obfuscation are among the techniques used by the attackers to bypass security controls. On the other hand, pattern matching, algorithmic scanning, emulation and heuristic are used by the defence team. The Antivirus (AV) is a vital security control that is used against a variety of threats. The AV mainly scans data against its database of virus signatures. Basically, it claims a virus if a match is found. This paper seeks to find the minimal possible changes that can be made on the virus so that it will appear normal when scanned by the AV. Brute-force search through all possible changes can be a computationally expensive task. Alternatively, this paper tries to apply a Genetic Algorithm in solving such a problem. Our proposed algorithm is tested on seven different malware instances. The results show that in all the tested malware instances only a small change in each instance was good enough to bypass the AV.

Keywords:

• Antivirus
• virus
• genetic algorithm
• optimisation
• evolutionary algorithms
• computer security

Notes

No potential conflict of interest was reported by the authors.

1 The tested malware can be downloaded from this website: http://openmalware.org/. The naming convention used for malware is the one used by ClamAV.