- author = "Ritwik Murali and C. Shunmuga Velayutham",
- title = "Adapting Novelty towards Generating Antigens for Antivirus systems",
- booktitle = "Proceedings of the 2022 Genetic and Evolutionary Computation Conference",
- year = "2022",
- editor = "Alma Rahat and Jonathan Fieldsend and Markus Wagner and Sara Tari and Nelishia Pillay and Irene Moser and Aldeida Aleti and Ales Zamuda and Ahmed Kheiri and Erik Hemberg and Christopher Cleghorn and Chao-li Sun and Georgios Yannakakis and Nicolas Bredeche and Gabriela Ochoa and Bilel Derbel and Gisele L. Pappa and Sebastian Risi and Laetitia Jourdan and Hiroyuki Sato and Petr Posik and Ofer Shir and Renato Tinos and John Woodward and Malcolm Heywood and Elizabeth Wanner and Leonardo Trujillo and Domagoj Jakobovic and Risto Miikkulainen and Bing Xue and Aneta Neumann and Richard Allmendinger and Inmaculada Medina-Bulo and Slim Bechikh and Andrew M. Sutton and Pietro Simone Oliveto",
- pages = "1254--1262",
- address = "Boston, USA",
- series = "GECCO '22",
- month = "9-13 " # jul,
- organisation = "SIGEVO",
- publisher = "Association for Computing Machinery",
- publisher_address = "New York, NY, USA",
- keywords = "genetic algorithms, genetic programming, malware, malware generation, virus, evolutionary algorithm, application of evolutionary algorithms, proactive defence",
- isbn13 = "978-1-4503-9237-2",
-
URL = "
https://human-competitive.org/sites/default/files/ritwik_gecco_humies_2023.txt",
-
URL = "
https://human-competitive.org/sites/default/files/paper_b_ritwik.pdf",
-
DOI = "
doi:10.1145/3512290.3528693",
-
video_url = "https://vimeo.com/723510265",
- size = "9 pages",
- abstract = "It is well known that anti-malware scanners depend on malware signatures to identify malware. However, even minor modifications to malware code structure results in a change in the malware signature thus enabling the variant to evade detection by scanners. Therefore, there exists the need for a proactively generated malware variant dataset to aid detection of such diverse variants by automated antivirus scanners. This paper proposes and demonstrates a generic assembly source code based framework that facilitates any evolutionary algorithm to generate diverse and potential variants of an input malware, while retaining its maliciousness, yet capable of evading antivirus scanners. Generic code transformation functions and a novelty search supported quality metric have been proposed as components of the framework to be used respectively as variation operators and fitness function, for evolutionary algorithms. The results demonstrate the effectiveness of the framework in generating diverse variants and the generated variants have been shown to evade over 98percent of popular antivirus scanners. The malware variants evolved by the framework can serve as antigens to assist malware analysis engines to improve their malware detection algorithms.",
-
notes = "Finalist 2023 HUMIES Also known as
\cite{murali2022adapting}
GECCO-2022 A Recombination of the 31st International Conference on Genetic Algorithms (ICGA) and the 27th Annual Genetic Programming Conference (GP)",
