A Game-Based Framework to Compare Program Classifiers and Evaders
Algorithm classification consists in determining which algorithm a program implements, given a finite set of candidates. Classifiers are used in applications such malware identification and plagiarism detection. There exist many ways to implement classifiers. There are also many ways to implement evaders to deceive the classifiers. This paper analyzes the state-of-the-art classification and evasion techniques. To organize this analysis, this paper brings forward a system of four games that matches classifiers and evaders. Games vary according to the amount of information that is given to each player. This setup lets us analyze a space formed by the combination of nine program encodings; seven obfuscation passes; and six stochastic classification models. Observations from this study include: (i) we could not measure substantial advantages of recent vector-based program representations over simple histograms of opcodes; (ii) deep neural networks recently proposed for program classification are no better than random forests; (iii) program optimizations are almost as effective as classic obfuscation techniques to evade classifiers; (iv) off-the-shelf code optimizations can completely remove the evasion power of naïve obfuscators; (v) control-flow flattening and bogus-control flow tend to resist the normalizing power of code optimizations.
Mon 27 FebDisplayed time zone: Eastern Time (US & Canada) change
15:40 - 17:00 | Session 3 -- PotpourriMain Conference at Montreal 1-2-3 Chair(s): Bernhard Egger Seoul National University | ||
15:40 26mTalk | Fast Polynomial Evaluation for Correctly Rounded Elementary Functions using the RLIBM Approach Main Conference DOI | ||
16:06 26mTalk | A Game-Based Framework to Compare Program Classifiers and Evaders Main Conference Thaís Regina Damásio Federal University of Minas Gerais, Michael Canesche Federal University of Minas Gerais, Vinícius Pacheco Federal University of Minas Gerais, Marcus Botacin Texas A&M University, Anderson Faustino da Silva State University of Maringá, Fernando Magno Quintão Pereira Federal University of Minas Gerais DOI | ||
16:33 26mTalk | WARDen: Specializing Cache Coherence for High-Level Parallel Languages Main Conference Michael Wilkins Northwestern University, Sam Westrick Carnegie Mellon University, Vijay Kandiah Northwestern University, Alex Bernat Northwestern University, Brian Suchy Northwestern University, Enrico Armenio Deiana Northwestern University, Simone Campanoni Northwestern University, Umut A. Acar Carnegie Mellon University, Peter Dinda Northwestern University, Nikos Hardavellas Northwestern University DOI |