@ericyocam6Professor, California Polytechnic State University
Shipped: AI Malware Detection Under Code Obfuscation
A machine-learning cybersecurity proof of concept evaluating how simulated obfuscation affects neural-network-based malware classification.
Using the BODMAS malware dataset and a TensorFlow/Keras classifier, the experiment evaluates performance across different simulated obfuscation conditions using accuracy, precision, recall, F1 score, and ROC AUC.
The project incorporates preprocessing, hyperparameter tuning, and cross-validation to study the relationship between feature transformations and malware detection performance.
Results are specific to the dataset and simulated transformations; they do not establish resistance to real-world malware packing or adaptive evasion attacks.
AI SecurityMalware DetectionMachine LearningAdversarial AICybersecurityDeep LearningMalware AnalysisAI Robustness
Comments2
Running iContact, I saw spam filters stuck in a constant race with senders who kept changing how their emails looked to slip through, and the filter that adjusted fastest was the one customers trusted. Your note that the results don't cover real-world packing or attackers who keep adapting is exactly that race, so a follow-up showing how the detector holds up against disguises it has never seen would answer the first question a security team will ask.
Great comparison, Ryan! The ongoing evolution of spam filters and evasion techniques is a good analogy for adversarial machine learning. A model that performs well against known obfuscation methods may struggle when attackers introduce new transformations designed to evade detection.
I agree that testing against previously unseen obfuscation techniques would be a valuable next step. It would also be interesting to compare detection performance before and after retraining the model on those new techniques, while measuring false positives and computational overhead.
Ultimately, the real measure of an AI-powered malware detector isn't just its accuracy on a static dataset, but how well it generalizes and adapts as threats evolve. Appreciate the suggestion and your perspective from iContact!
2 comments
Running iContact, I saw spam filters stuck in a constant race with senders who kept changing how their emails looked to slip through, and the filter that adjusted fastest was the one customers trusted. Your note that the results don't cover real-world packing or attackers who keep adapting is exactly that race, so a follow-up showing how the detector holds up against disguises it has never seen would answer the first question a security team will ask.
Great comparison, Ryan! The ongoing evolution of spam filters and evasion techniques is a good analogy for adversarial machine learning. A model that performs well against known obfuscation methods may struggle when attackers introduce new transformations designed to evade detection.
I agree that testing against previously unseen obfuscation techniques would be a valuable next step. It would also be interesting to compare detection performance before and after retraining the model on those new techniques, while measuring false positives and computational overhead.
Ultimately, the real measure of an AI-powered malware detector isn't just its accuracy on a static dataset, but how well it generalizes and adapts as threats evolve. Appreciate the suggestion and your perspective from iContact!