Mimicry Attacks Research Articles

Empirical Evaluation of a System Call-Based Android Malware Detector

The extensive use of smartphones and increased popularity of Android operating system have proliferated in malware attacks. In order to overcome these malicious attacks, numerous malware detectors are now available and have been described in various literature. A majority of detectors rely on system calls, as these are non-bypassable interface for user applications to system services. In order to defeat the system call-based detectors, an adversary usually deploys mimicry attack (see Section 5.2) through which a sequence of system calls are injected into malicious apps to alter the actual sequence. It is evident that signature-based detectors result in high false alarm rate, due to such mimicry attacks. Therefore, in this paper, we propose a non-signature-based malware detector, that is not vulnerable to mimicry attack, by keeping the false alarm rate very low. In the present work, two different environment settings have been created for monitoring the deviation in the behaviour of synthetic user events, against those of real ones, through application executions. Feature selection was carried out by employing “Scatter Assessment” method on 2100 apps. Extensive experimentation has been carried out to select a concise set of features. The proposed method selects features in such a way, that it minimizes and maximizes the intra- and inter-class variances, respectively. Such a variance optimization allows us to evade mimicry attacks. The method has been validated for effectiveness and applicability, by means of two different datasets comprising of real samples. An area under curve of 1.0 with accuracy in the range of 99.8–100% was obtained, proving the efficacy of the proposed malware scanner.

Online masquerade detection resistant to mimicry

Masquerade attackers are internal intruders acting through impersonating legitimate users of the victim system. Most of the proposals for their detection suggested recognition methods based on the comparison of use models of the protected environment. However recent studies have shown their vulnerability against adversarial attacks based on imitating the behavior of legitimate users. In order to contribute to their identification, this article introduces a novel detection method robust against evasion strategies based on mimicry. The proposal described two levels of information processing: analysis and verification. At the analysis stage, local alignment algorithms are implemented. In this way it is possible to score the similarity between action sequences performed by users, bearing in mind their regions of greatest resemblance. On the other hand, a novel validation scheme based on the statistical non-parametric U-test is implemented. Through this it is possible to refine the labeling of sequences to avoid making hasty decisions when their nature is not sufficiently clear. In order to strengthen their effectiveness against mimicry attacks, the analysis of the monitored sequences is performed in concurrency. This involves partitioning long sequences with two purposes: making subsequences of small intrusions more visible and analyzing new sequences when suspicious situations occur, such as the execution of never before seen commands or the discovery of potentially harmful activities. The proposal has been evaluated from the functional standard SEA and mimicry attacks. Promising experimental results have been shown, demonstrating great precision against conventional masqueraders (TPR=98.3%, FPR=0.77%) and a success rate of 80.2% when identifying mimicry attacks, hence outperforming the best contributions of bibliography.

Randomization-Based Intrusion Detection System for Advanced Metering Infrastructure*

Smart grid deployment initiatives have been witnessed in recent years. Smart grids provide bidirectional communication between meters and head-end systems through Advanced Metering Infrastructure (AMI). Recent studies highlight the threats targeting AMI. Despite the need for tailored Intrusion Detection Systems (IDSs) for smart grids, very limited progress has been made in this area. Unlike traditional networks, smart grids have their own unique challenges, such as limited computational power devices and potentially high deployment cost, that restrict the deployment options of intrusion detectors. We show that smart grids exhibit deterministic and predictable behavior that can be accurately modeled to detect intrusion. However, it can also be leveraged by the attackers to launch evasion attacks. To this end, in this article, we present a robust mutation-based intrusion detection system that makes the behavior unpredictable for the attacker while keeping it deterministic for the system. We model the AMI behavior using event logs collected at smart collectors, which in turn can be verified using the invariant specifications generated from the AMI behavior and mutable configuration. Event logs are modeled using fourth-order Markov chain and specifications are written in Linear Temporal Logic (LTL). To counter evasion and mimicry attacks, we propose a configuration randomization module. The approach provides robustness against evasion and mimicry attacks; however, we discuss that it still can be evaded to a certain extent. We validate our approach on a real-world dataset of thousands of meters collected at the AMI of a leading utility provider.

Automatic versus human speaker verification: The case of voice mimicry

In this work, we compare the performance of three modern speaker verification systems and non-expert human listeners in the presence of voice mimicry. Our goal is to gain insights on how vulnerable speaker verification systems are to mimicry attack and compare it to the performance of human listeners. We study both traditional Gaussian mixture model-universal background model (GMM-UBM) and an i-vector based classifier with cosine scoring and probabilistic linear discriminant analysis (PLDA) scoring. For the studied material in Finnish language, the mimicry attack decreased lightly the equal error rate (EER) for GMM-UBM from 10.83 to 10.31, while for i-vector systems the EER increased from 6.80 to 13.76 and from 4.36 to 7.38. The performance of the human listening panel shows that imitated speech increases the difficulty of the speaker verification task. It is even more difficult to recognize a person who is intentionally concealing his or her identity. For Impersonator A, the average listener made 8 errors from 34 trials while the automatic systems had 6 errors in the same set. The average listener for Impersonator B made 7 errors from the 28 trials, while the automatic systems made 7 to 9 errors. A statistical analysis of the listener performance was also conducted. We found out a statistically significant association, with p=0.00019 and R2=0.59, between listener accuracy and self reported factors only when familiar voices were present in the test.

A Semantic Approach to Host-Based Intrusion Detection Systems Using Contiguousand Discontiguous System Call Patterns

Host-based anomaly intrusion detection system design is very challenging due to the notoriously high false alarm rate. This paper introduces a new host-based anomaly intrusion detection methodology using discontiguous system call patterns, in an attempt to increase detection rates whilst reducing false alarm rates. The key concept is to apply a semantic structure to kernel level system calls in order to reflect intrinsic activities hidden in high-level programming languages, which can help understand program anomaly behaviour. Excellent results were demonstrated using a variety of decision engines, evaluating the KDD98 and UNM data sets, and a new, modern data set. The ADFA Linux data set was created as part of this research using a modern operating system and contemporary hacking methods, and is now publicly available. Furthermore, the new semantic method possesses an inherent resilience to mimicry attacks, and demonstrated a high level of portability between different operating system versions.

Software Behavior Model Based on System Objects

以传统有限自动机(finite state automata,简称FSA)为基础,从系统调用参数中解析出系统对象,提出了一种基于系统对象的软件行为模型(model of software behavior based on system objects,简称SBO).该模型的行为状态由软件所关联的所有系统对象表示,从而赋予状态的语义信息,解决了不同行为迹中PC(program counter)值的语义不相关问题;同时,该模型可以对抗系统调用参数的直接和间接修改,从而可以检测基于数据语义的攻击.最后,实现了基于SBO 的软件异常检测原型工具(intrusion detection prototype system based on SBO,简称SBOIDS),其实验和分析结果表明,该模型可以有效地检测基于控制流的攻击、模仿攻击以及针对数据语义的攻击,并给出了该工具的性能开销.;On the basis of traditional FSA (finite state automaton), system objects can be resolved from the parameters of system call, and a Software Behavior model based on system object (SBO) is presented. This model defines the software state as all states of system objects, which are owned by the software, and then each state in the model has been assigned semantic information. Therefore, SBO can solve a problem of irrelevant semantics between different traces using the semantic information, and it can detect data semantic attacks, which directly or indirectly modifies system call parameters. Finally, a software anomaly intrusion detection prototype system based on SBO (SBOIDS) is implemented. The experimental and analysis results show that SBO can effectively detect data semantic attack and control the flow-based and mimicry attacks.

Masquerade mimicry attack detection: A randomised approach

A masquerader is an (often external) attacker who, after succeeding in obtaining a legitimate user’s credentials, attempts to use the stolen identity to carry out malicious actions. Automatic detection of masquerading attacks is generally undertaken by approaching the problem from an anomaly detection perspective: a model of normal behaviour for each user is constructed and significant departures from it are identified as potential masquerading attempts. One potential vulnerability of these schemes lies in the fact that anomaly detection algorithms are generally susceptible to deception. In this work, we first investigate how a resourceful masquerader can successfully evade detection while still accomplishing his goals. For this, we introduce the concept of masquerade mimicry attacks, consisting of carefully constructed attacks that are not identified as anomalous. We then explore two different detection schemes to thwart such attacks. We first study the introduction of a blind randomisation strategy into a baseline anomaly detector. We then propose a more accurate algorithm, called Probabilistic Padding Identification (PPI) and based on the Kullback–Leibler divergence, which attempts to identify if a sufficiently anomalous attack is present within an apparently normal behavioural pattern. Our experimental results indicate that the PPI algorithm achieves considerably better detection quality than both blind randomised strategies and adversarial-unaware approaches.

Beyond Output Voting: Detecting Compromised Replicas Using HMM-Based Behavioral Distance

Many host-based anomaly detection techniques have been proposed to detect code-injection attacks on servers. The vast majority, however, are susceptible to attacks in which the injected code masquerades as the original server software, including returning the correct service responses, while conducting its attack. Behavioral distance, by which two diverse replicas processing the same inputs are continually monitored to detect divergence in their low-level (system-call) behaviors and hence potentially the compromise of one of them, has been proposed for detecting mimicry attacks. In this paper, we present a novel approach to behavioral distance measurement using a new type of hidden Markov model, and present an architecture realizing this new approach. We evaluate the detection capability of this approach using synthetic workloads and recorded workloads of production Web and game servers, and show that it detects intrusions with substantially greater accuracy than a prior proposal on measuring behavioral distance. We also detail the design and implementation of a new architecture, which takes advantage of virtualization to measure behavioral distance. We apply our architecture to implement intrusion-tolerant Web and game servers, and through trace-driven simulations demonstrate that it experiences moderate performance costs even when thresholds are set to detect stealthy mimicry attacks.

Static extracting method of software intended behavior based on API functions invoking

The method of extracting and describing the intended behavior of software precisely has become one of the key points in the fields of software behavior’s dynamic and trusted authentication. In this paper, the author proposes a specified measure of extracting SIBDS (software intended behaviors describing sets) statically from the binary executable using the software’s API functions invoking, and also introduces the definition of the structure used to store the SIBDS in detail. Experimental results demonstrate that the extracting method and the storage structure definition offers three strong properties: (i) it can describe the software’s intended behavior accurately; (ii) it demands a small storage expense; (iii) it provides strong capability to defend against mimicry attack.