论文标题
厄运：一种新型的基于对抗性DRL的OP代码级变质恶意软件混淆器，用于增强ID
DOOM: A Novel Adversarial-DRL-Based Op-Code Level Metamorphic Malware Obfuscator for the Enhancement of IDS
论文作者
论文摘要
我们设计和开发了厄运（基于对抗性-DRL的OpCode级别混淆器来生成变质恶意软件），这是一种新型的系统，它使用对抗性深度强化学习来在OP代码级别粘合恶意软件，以增强IDS。厄运的最终目标不是在网络攻击者的手中提供有力的武器，而是要对高级零日攻击产生防御力机制。实验结果表明，厄运产生的混淆恶意软件可以有效地模仿零日攻击。据我们所知，Doom是第一个可以生成详细介绍到单个OP代码级别的混淆的恶意软件的系统。 Doom也是有史以来第一个在恶意软件产生和防御领域使用有效的基于基于持续动作控制的深度强化学习的系统。实验结果表明，厄运产生的变质恶意软件中有67％可以轻松地从最有效的ID中逃避检测。与此一样，这一成就具有重要的意义，即使是通过高级路由子系统的IDS增强，Doom产生的恶意软件也很容易避免。
We designed and developed DOOM (Adversarial-DRL based Opcode level Obfuscator to generate Metamorphic malware), a novel system that uses adversarial deep reinforcement learning to obfuscate malware at the op-code level for the enhancement of IDS. The ultimate goal of DOOM is not to give a potent weapon in the hands of cyber-attackers, but to create defensive-mechanisms against advanced zero-day attacks. Experimental results indicate that the obfuscated malware created by DOOM could effectively mimic multiple-simultaneous zero-day attacks. To the best of our knowledge, DOOM is the first system that could generate obfuscated malware detailed to individual op-code level. DOOM is also the first-ever system to use efficient continuous action control based deep reinforcement learning in the area of malware generation and defense. Experimental results indicate that over 67% of the metamorphic malware generated by DOOM could easily evade detection from even the most potent IDS. This achievement gains significance, as with this, even IDS augment with advanced routing sub-system can be easily evaded by the malware generated by DOOM.
