Next Article in Journal
Entropy Generation of Forced Convection during Melting of Ice Slurry
Previous Article in Journal
Magnetic Otto Engine for an Electron in a Quantum Dot: Classical and Quantum Approach
Open AccessArticle

Mimicking Anti-Viruses with Machine Learning and Entropy Profiles

1
Computer Science Department, University College London, London WC1E 6BT, UK
2
Hoffmann-La Roche, 28027 Madrid, Spain
*
Author to whom correspondence should be addressed.
Entropy 2019, 21(5), 513; https://doi.org/10.3390/e21050513
Received: 1 April 2019 / Revised: 17 May 2019 / Accepted: 20 May 2019 / Published: 21 May 2019
(This article belongs to the Section Multidisciplinary Applications)
The quality of anti-virus software relies on simple patterns extracted from binary files. Although these patterns have proven to work on detecting the specifics of software, they are extremely sensitive to concealment strategies, such as polymorphism or metamorphism. These limitations also make anti-virus software predictable, creating a security breach. Any black hat with enough information about the anti-virus behaviour can make its own copy of the software, without any access to the original implementation or database. In this work, we show how this is indeed possible by combining entropy patterns with classification algorithms. Our results, applied to 57 different anti-virus engines, show that we can mimic their behaviour with an accuracy close to 98% in the best case and 75% in the worst, applied on Windows’ disk resident malware. View Full-Text
Keywords: anti-virus; classification; malware; mimicking; mimickAV; entropy profiles anti-virus; classification; malware; mimicking; mimickAV; entropy profiles
Show Figures

Figure 1

MDPI and ACS Style

Menéndez, H.D.; Llorente, J.L. Mimicking Anti-Viruses with Machine Learning and Entropy Profiles. Entropy 2019, 21, 513.

Show more citation formats Show less citations formats
Note that from the first issue of 2016, MDPI journals use article numbers instead of page numbers. See further details here.

Article Access Map by Country/Region

1
Back to TopTop