Mimicking Anti-Viruses with Machine Learning and Entropy Profiles

Area of Science:

• Computer Science
• Cybersecurity
• Software Engineering

Background:

• Anti-virus software quality depends on binary file patterns.
• These patterns are vulnerable to polymorphism and metamorphism, creating security risks.
• Anti-virus predictability allows unauthorized replication by malicious actors.

Purpose of the Study:

• To investigate the possibility of mimicking anti-virus software behavior.
• To demonstrate the effectiveness of combining entropy patterns with classification algorithms.
• To assess the security implications of predictable anti-virus engines.

Main Methods:

• Extraction of entropy patterns from binary files.
• Application of classification algorithms to these patterns.
• Testing the combined approach on 57 anti-virus engines against Windows disk resident malware.

Main Results:

• The proposed method successfully mimicked anti-virus behavior.
• Accuracy ranged from 75% (worst case) to 98% (best case).
• The findings were validated across a significant number of anti-virus engines.

Conclusions:

• Entropy patterns combined with classification algorithms pose a threat to anti-virus software.
• Current anti-virus detection methods have exploitable predictability.
• This research underscores the need for more robust and adaptive anti-malware strategies.