[SOLVED] CS6264 Project 7

Assignment 7:

“…and we aim to show stronger improvements starting next fiscal quarter.” This all-hands call is taking forever, you think to yourself while daydreaming about where you should go for your holiday in two weeks.

“…will be taking the lead with our next client. We expect great things from them.”
Wait. Did your boss just say your name?

“The client is an IDS vendor whose product uses machine learning models to identify malware. However, they have noticed that their models are frequently evaded and hope that we can find out why.”

You don’t remember being told about this, but at this point, you guess you’re used to it. You’re just thankful your coworker was taking notes

Actions

 during the meeting and he gave you some

Actions

 tutorials

Actions

 on MLSploit, a framework you are expected to use. And later, you found some information about the attack.

  Assignment

The purpose of this assignment is to gain experience with training machine learning (ML) and deep learning (DL) models classifying Windows portable executable (PE) malware into families. Specifically, the models will be given two different datasets: benign PE files and malicious PE files from multiple families. After training a DL models, you will attack those models using an evasion attack called the Mimicry Attack. Then, you will be tasked with improving the models which were attacked. Finally, you will train a ML model using different features and see if the mimicry attack still work. You will write a report about your experiences and observations.

Note: Please use https://cs6264-4.gtisc.gatech.eduLinks to an external site. instead of https://mlsploit.orgLinks to an external site.. We will make a few more server sites available if needed. 

There are 5 tasks and a bonus task you will need to complete for this assignment. They include:

• Training DL Models (10%): Train LSTM, CNN, and RNN models on  API call sequences.
• Attacking DL Models (10%): Attack models via mimicry attack.
• Detecting Attack (20%): Train model based on static features to detect the attack sample. 
• Training ML Models (10%): Train classical ML models on API call existence, frequency, and arguments.
• Transferring Attack (10%):  Run the mimicry attacks in controlled environment and evaluate the ML models. 
• Attack ML Model using RL (10% bonus): Train ML model using ember and train RL model to evade the ML model. 

You will also need to compile a report (40%) that should contain screenshots of your findings and explanations for why the certain screenshot happened. For example, if your screenshot is comparing the results of how well different models detected the attack in Task 2, then an explanation for why the results differed should be included.

To complete the tasks, you will also need these files Download these files. 

Supplementary Material:

Lab 7_Supplementary_Material.pdf

Actions

, Task 3 TemplateDownload Task 3 Template

  Deliverables

Compress the deliverables for each task into a .tar.gz file called [GT Username]_cs6264_lab07.tar.gz with the following directory layout:

• task1/
  • pe.model.zip
  • prediction.zip
  • *.log.txt files
• task2/
  • attack-exe.zip: the attack samples generated from MLSploit to evade your models
  • attack-feature.zip
  • attack-prediction.zip
  • attack.cfg.zip: Configuration file from MLSploit
  • *.log.txt files
• task3.a/
  • detection1.py: Source code (preferably in Python)  that will train a new model that will detect the attack from the previous task
  • detection2.py
  • detection3.py
  • (others here if you wish)
• task3.b/
  • model1.zip
  • model2.zip
  • model3.zip
  • (others here if you wish)
• task4/
  • pe.model.zip
  • prediction.zip
  • *.log.txt files
• task5/
  • task1 model/
    • prediction.zip
    • *.log.txt files
  • task4 model/
    • prediction.zip
    • *.log.txt files
• report.pdf: This report should contain screenshots of your findings and explanations for why the certain screenshot happened. For example, if your screenshot is comparing the results of how well different models detected the attack in part 2, then an explanation for why the results differed should be included.
• bonus/
  • model.zip
  • *.log.txt files
  • ember-attack.zip
  • *.log.txt files

 Warning:

Warning: The malware binary we provide you (and the malware produced by MLSploit) is real malware. Do not under any circumstances execute these malware EVER. It is a compiled form of the rbot malware family and antivirus companies are well-aware of their existence (https://github.com/ytisf/theZooLinks to an external site.). We have not applied any static obfuscation to them so they should be easily detectable by AV companies. You are to use these binaries responsibly by only reading their byte contents (e.g., using tools like https://github.com/erocarrera/pefileLinks to an external site.).

PreviousNext