Evasion of Deep Learning Detector for Malware C&C Traffic

# Evasion of Deep Learning Detector for Malware C&C Traffic

https://gcdradar.vercel.app/incidents/evasion-of-deep-learning-detector-for-malware-c-c-traffic · AIR-2020-0032 · closed 2020-12-29

- Lane: Research
- Severity: 1 (Research / proof of concept)
- Fix status: Fix status unknown
- First reported: 2020-12-15 (happened 2020-01-01)
- AI role: Attack on AI
- Products: Palo Alto Networks malware detection system

## Summary

Researchers crafted adversarial HTTP traffic samples to successfully evade a deep learning model designed for malware command and control detection. The exercise highlighted robustness flaws in AI-based network traffic analysis.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2020-12-15: Le, Hung, et al. "URLNet: Learning a URL representation with deep learning for malicious URL detection." arXiv preprint arXiv:1802.03162 (2018). (https://arxiv.org/abs/1802.03162)
- 2020-12-15: Evasion of Deep Learning Detector for Malware C&C Traffic (https://atlas.mitre.org/studies/AML.CS0000)

## Sources

- 2020-12-15 MITRE ATLAS: Evasion of Deep Learning Detector for Malware C&C Traffic https://atlas.mitre.org/studies/AML.CS0000
- 2020-12-15 arXiv: Le, Hung, et al. "URLNet: Learning a URL representation with deep learning for malicious URL detection." arXiv preprint arXiv:1802.03162 (2018). https://arxiv.org/abs/1802.03162

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.