Fachbereich Informatik - Aktuell
Disputation Nedim Šrndić
am Mittwoch, 4. Oktober 20017 um 16 Uhr in Raum A104, Sand 1, EG.
Machine Learning and Security of Non-Executable Files
Berichterstatter 1: Prof. Dr. Andreas Zell
Berichterstatter 2: Prof. Dr. Michael Menth
Computer malware is a well-known threat in security which, despite the enormous time and effort invested in fighting it, is today more prevalent than ever. Recent years have brought a surge in one particular type: malware embedded in non-executable file formats,e.g., PDF, SWF and various office file formats.
The traditional approach to malware detection – signature matching, heuristics and behavioral profiling – has from its inception been a labor-intensive manual task, always lagging one step behind the attacker. An automated and scalable approach is needed to fill the gap between automated malware adaptation and manual malware detection, and machine learning is emerging as a viable solution. Its branch called adversarial machine learning studies the security of machine learning algorithms and the special conditions that arise when machine learning is applied for security.
Furthermore, the talk presents a framework for security evaluation of machine learning classifiers in a case study performed on an independent PDF malware detector. The results show that the ability to manipulate a part of the classifier’s feature set allows a malicious adversary to disguise malware so that it appears benign to the classifier with a high success rate.