Palo Alto Networks security team demonstrates evasion of deep learning malware detector

# Palo Alto Networks security team demonstrates evasion of deep learning malware detector

https://gcdradar.vercel.app/incidents/palo-alto-networks-security-team-demonstrates-evasion-of-dee · AIR-2023-0007 · closed 2023-04-14

- Lane: Research
- Severity: 1 (Research / proof of concept)
- Fix status: Fix status unknown
- First reported: 2023-03-31
- AI role: Attack on AI
- Products: Palo Alto Networks C&C Traffic Detector

## Summary

Researchers built a replica deep learning model for malware traffic detection and crafted adversarial HTTP samples to successfully evade it. The finding highlights vulnerability to adversarial perturbation.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2023-03-31: Le, Hung, et al. "URLNet: Learning a URL representation with deep learning for malicious URL detection." arXiv preprint arXiv:1802.03162 (2018). (https://arxiv.org/abs/1802.03162)
- 2023-03-31: Evasion of Deep Learning Detector for Malware C&C Traffic (https://atlas.mitre.org/studies/AML.CS0000)
- 2023-03-31: AVID-2023-V001: The Palo Alto Networks Security AI research team tested a deep learning model for malware command and control (C&C) traffic detection in HTTP traffic. (https://github.com/avidml/avid-db/blob/main/vulnerabilities/2023/AVID-2023-V001.json)

## Sources

- 2023-03-31 AVID: AVID-2023-V001: The Palo Alto Networks Security AI research team tested a deep learning model for malware command and control (C&C) traffic detection in HTTP traffic. https://github.com/avidml/avid-db/blob/main/vulnerabilities/2023/AVID-2023-V001.json
- 2023-03-31 MITRE ATLAS: Evasion of Deep Learning Detector for Malware C&C Traffic https://atlas.mitre.org/studies/AML.CS0000
- 2023-03-31 arXiv: Le, Hung, et al. "URLNet: Learning a URL representation with deep learning for malicious URL detection." arXiv preprint arXiv:1802.03162 (2018). https://arxiv.org/abs/1802.03162

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.