Malicious PowerShell Detection Using Attention against Adversarial Attacks

抄録

<jats:p>Currently, hundreds of thousands of new malicious files are created daily. Existing pattern-based antivirus solutions face difficulties in detecting such files. In addition, malicious PowerShell files are currently being used for fileless attacks. To prevent these problems, artificial intelligence-based detection methods have been suggested. However, methods that use a generative adversarial network (GAN) to avoid AI-based detection have been proposed recently. Attacks that use such methods are called adversarial attacks. In this study, we propose an attention-based filtering method to prevent adversarial attacks. Using the attention-based filtering method, we can obtain restored PowerShell data from fake PowerShell data generated by GAN. First, we show that the detection rate of the fake PowerShell data generated by GAN in an existing malware detector is 0%. Subsequently, we show that the detection rate of the restored PowerShell data generated by attention-based filtering is 96.5%.</jats:p>

収録刊行物

  • Electronics

    Electronics 9 (11), 1817-, 2020-11-02

    MDPI AG

被引用文献 (1)*注記

もっと見る

詳細情報 詳細情報について

問題の指摘

ページトップへ