Pesidious - Malware Mutation Using Reinforcement Learning and

项目说明

!Logo

Malware Mutation using Deep Reinforcement Learning and GANs

The purpose of the tool is to use artificial intelligence to mutate a malware (PE32 only) sample to bypass AI powered classifiers while keeping its functionality intact. In the past, notable work has been done in this domain with researchers either looking at reinforcement learning or generati networks as their weapons of choice to modify the states of a malware executable in order to decei agents. Our solution makes use of a combination of deep reinforcement learning and GANs in order to o some of the limitations faced while using these approaches independently as showen below.

!Diagram.png)

Find our full documentation for the tool here

Installation Instructions

> :warning: Since this tool deals with malware files, it is strongly recommended to use a machine. After installation of the tool, make sure to disconnect from the network.

The following steps will guide you through all the installations required to set up the en.

1. Install and set up Python 3.6.

1. Clone the repository.

1. Move into the project directory.

1. Set up and activate a en with Python 3.6
> It is recommended to use a en to avoid conflicts between packages used by different applications

1. Make sure that you have pip 8.1.1 installed and set up.
> This is due to later of pip not playing well with the PyTorch libary.

1. Install all the required libraries, by installing the requirements.txt file.

Mutate Your Malware

The output from GAN has already been stored as (RL_Features/ad.pk and RL_Features/ad.pk) which will be used for when adding imports and sections to the malware for mutation.

1. You can test the sample classifier to score malware files.

1. Run the mutate.py python script to mutate your malware samples.

1. The mutated malware files will be stored in a directory called Mutated_malware in the following format

1. Once the malware files are mutated, you can run the classifier again to score the mutated malware.

Known Issues and Fixes

> :warning: WARNING: This segment is currently under construction. We apologize for any incon caused. Please proceed to the next section. click here

1. pip install -r requirements.txt gives you an error.

Solution:

1. ModuleNotFoundError: No module named 'tensorboardX' error while running python main_malgan.py script.

Solution:

1. Error with the execution of import-append, section-append (not found)

Solution
Gi permission to these executables using the following commands on your terminal

Built With

* PyTorch - Open source machine learning library based on the Torch library.
* Lief - A cross platform library which can parse, modify and abstract ELF, PE and MachO formats.
* PE Bliss - PE libarry for rebuilding PE files, written in C++.
* Gym-Malware - Malware manipulation en for OpenAI's gym.
* MalwareGAN - Ad Malware Generation Using GANs.

Authors

* Chandni Vaya - *X-Force Incident Response, IBM Security* - Github
* Bedang Sen - *X-Force Incident Response, IBM Security* - Github

Acknowledgments

* Gym-Malware En: The en was modified to add GAN and the mutations were added/changed/removed to improve the e of the malware and maintain functionality.
* Yanming Lai's () and
* Zayd Hammoudeh's () work on implementation on Han and Tan's MalGAN played a crucial role in our understanding of the architecture. A majority of the implementation of the MalGAN used in this project has been forked off Hammoudeh's work.

References

Anderson, H., Kharkar, A., Filar, B., Evans, D. and Roth, P. (2018). Learning to Evade Static PE Machine Learning Malware Models Learning. [online] arXiv.org. A at:

Docs.microsoft.com. (n.d.). PE Format - Windows applications. [online] A at:

Fang, Z., Wang, J., Li, B., Wu, S., Zhou, Y. and Huang, H. (2019). E Anti-Malware Engines With Deep Reinforcement Learning. [online] Ieeexplore.ieee.org. A at: [Accessed 25 Aug. 2019].
(2019).

Malware Researcher’s Handbook (Demystifying PE File). [online] A at:

Hu, W. and Tan, Y. (2018). Generating Ad Malware Examples for Black-Box Attacks Based on GAN. [online] arXiv.org. A at:

项目信息

开发语言：C++

Star 数：175

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Malware Mutation Using Reinforcement Learning and Generative Adversarial Networks展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。