Scholarlink

In recent years, dependence on digital technology has increased, raising the risk of cyber attacks. Particularly, PowerShell, known for its high convenience, has been exploited by many attackers. Prior research has proposed methods using natural language processing and machine learning to detect malicious PowerShell. On the other hand, there have been reports of the potential for evasion attacks against detectors using machine learning or neural networks. Nevertheless, the assessment of evasion attacks against malicious PowerShell detectors remains inadequate. Particularly, there have been no reported evaluations of evasion attacks targeted at detectors utilizing neural networks. In this study, we examined the feasibility of evasion attacks on models designed for detecting malicious PowerShell using neural networks. We utilized words with high attention weights extracted using the Attention mechanism for benign features. We conducted evasion attempts on models employing Deep Neural Networks (DNN), Convolutional Neural Networks (CNN), Recurrent Neural Networks (RNN), Long Short-Term Memory (LSTM), and a combined model of Attention and LSTM. The results showed a decrease in recall rates for all detectors, confirming the possibility of evasion attacks. Furthermore, we observed that the method of inserting words with high attention weights as benign features is more effective than other insertion methods.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Evasion Attempt for the Malicious PowerShell Detector Considering Feature Weights

  • 会议论文

  • 发表日期：

    2025年

查看全文
  • Kou Sugiura,
  • Mamoru Mimura

摘要

In recent years, dependence on digital technology has increased, raising the risk of cyber attacks. Particularly, PowerShell, known for its high convenience, has been exploited by many attackers. Prior research has proposed methods using natural language processing and machine learning to detect malicious PowerShell. On the other hand, there have been reports of the potential for evasion attacks against detectors using machine learning or neural networks. Nevertheless, the assessment of evasion attacks against malicious PowerShell detectors remains inadequate. Particularly, there have been no reported evaluations of evasion attacks targeted at detectors utilizing neural networks. In this study, we examined the feasibility of evasion attacks on models designed for detecting malicious PowerShell using neural networks. We utilized words with high attention weights extracted using the Attention mechanism for benign features. We conducted evasion attempts on models employing Deep Neural Networks (DNN), Convolutional Neural Networks (CNN), Recurrent Neural Networks (RNN), Long Short-Term Memory (LSTM), and a combined model of Attention and LSTM. The results showed a decrease in recall rates for all detectors, confirming the possibility of evasion attacks. Furthermore, we observed that the method of inserting words with high attention weights as benign features is more effective than other insertion methods.