EsPADA: Enhanced Payload Analyzer for malware Detection robust against Adversarial threats

摘要: Abstract The emergent communication technologies landscape has consolidated the anomaly-based intrusion detection paradigm as one of most prominent solutions able to discover unprecedented malicious traits. It relied on building models normal/legitimate activities registered at protected systems, from them analyzing incoming observations looking for significant discordances that may reveal misbehaviors. But in last years, adversarial machine learning introduced never-seen-before evasion procedures jeopardize traditional methods, thus entailing major emerging challenges cybersecurity landscape. With aim contributing their adaptation against threats, this paper presents EsPADA (Enhanced Payload Analyzer malware Detection robust Adversarial threats), a novel approach built grounds PAYL sensor family. At SPARTA Training stage, both normal and are constructed according features extracted by N-gram, which stored within Counting Bloom Filters (CBF). In way it is possible take advantage binary-based spectral-based traffic modeling detection. payloads be analyzed collected environment compared with usage previously Training. This leads calculate different scores allow discriminate nature (normal or suspicious) assess labeling coherency, latest studied estimating likelihood payload disguising mimicry attacks. effectiveness was demonstrated public datasets DARPA’99 UCM 2011 achieving promising preliminarily results.