Selecting a malware scanner from multiple malware scanners
In some cases, malicious code is injected into a legitimate software package to create an injected package. An AI extracts a plurality of parts of the injected package, mutates individual parts to create multiple mutated parts, and assembles at least a portion of them to create a mutated malware. A malware scanner determines a risk score associated with the mutated malware. If the risk score satisfies a predetermined threshold, the mutated malware is stored in a set of mutated malware. When a number of mutated malware in the set of mutated malware satisfies a requested number, a plurality of malware scanners are ranked based on their ability to identify malware from the set of mutated malware. Based at least in part on the ranking, a particular malware scanner that identified a maximum number of malware from the set of mutated malware is selected and deployed to detect malware.
1 . A method comprising:
injecting, by one or more processors, malicious code into a legitimate software package to create an injected package;
extracting, by an artificial intelligence executed by the one or more processors, a plurality of parts of the injected package;
mutating, by the artificial intelligence executed by the one or more processors, individual parts of the plurality of parts to create multiple mutated parts;
assembling, by the one or more processors, at least a portion of the multiple mutated parts to create a mutated malware;
determining, by a malware scanner, a risk score associated with the mutated malware;
based at least in part on determining, by the one or more processors, that the risk score satisfies a predetermined threshold, storing the mutated malware in a set of mutated malware;
after determining, by the one or more processors, that a number of mutated malware in the set of mutated malware satisfies a requested number, determining a ranking of a plurality of malware scanners based on an ability of individual malware scanners of the plurality of malware scanners to identify malware from the set of mutated malware;
based at least in part on the ranking, selecting a particular malware scanner from the plurality of malware scanners that identified a maximum number of malware from the set of mutated malware; and
deploying the particular malware scanner to detect malware.
2 . The method of claim 1 , wherein mutating individual parts of the plurality of parts to create the multiple mutated parts comprises:
changing one or more variable identifiers;
changing one or more function identifiers based on a context vocabulary;
changing an application programming interface (API) from a first API to a second API;
insertion of one or more comments;
spreading one or more blocks of code across a plurality of functions;
inserting dead code that is never executed;
inserting of dummy functionality;
obfuscation of string literals using character encodings, encryption, string sampling, or minification;
modifying how a target component is accessed including replacing calls made to a component with calls made to a different component; or
any combination thereof.
3 . The method of claim 1 , further comprising:
retrieving the malicious code from a set of code-test pairs, each code-test pair of the set of code-test pairs including a particular malware code and one or more malware tests, wherein the one or more malware tests are used to detect a behavior of the particular malware code to determine whether the mutated malware performs a malicious action of the particular malware code.
4 . The method of claim 1 , wherein:
the artificial intelligence is trained using one or more programming languages to enable the artificial intelligence to extract and mutate both malicious code and source code.
5 . The method of claim 1 , wherein extracting, by the artificial intelligence, the plurality of parts of the injected package comprises:
extracting context information, a natural language description of the injected package, features of the injected package, one or more use-cases of the injected package, an internal architecture of the injected package, one or more source code files, or any combination thereof.
6 . The method of claim 1 , wherein based at least in part on determining, by the one or more processors, that the risk score fails to satisfy the predetermined threshold, the method further comprises:
creating a new injected package by injecting newly selected malicious code into a newly selected legitimate software package.
7 . The method of claim 1 , further comprising:
training an artificial intelligence of the particular malware scanner using the set of mutated malware as training data to improve a malware detection capability of the particular malware scanner.
8 . A server comprising:
one or more processors; and
one or more non-transitory computer readable media storing instructions executable by the one or more processors to perform operations comprising:
injecting malicious code into a legitimate software package to create an injected package;
extracting, by an artificial intelligence, a plurality of parts of the injected package;
mutating, by the artificial intelligence, individual parts of the plurality of parts to create multiple mutated parts;
assembling at least a portion of the multiple mutated parts to create a mutated malware;
determining, by a malware scanner, a risk score associated with the mutated malware;
based at least in part on determining that the risk score satisfies a predetermined threshold, storing the mutated malware in a set of mutated malware;
after determining, by the one or more processors, that a number of mutated malware in the set of mutated malware satisfies a requested number, determining a ranking of a plurality of malware scanners based on an ability of individual malware scanners of the plurality of malware scanners to identify malware from the set of mutated malware;
based at least in part on the ranking, selecting a particular malware scanner from the plurality of malware scanners that identified a maximum number of malware from the set of mutated malware; and
deploying the particular malware scanner to detect malware.
9 . The server of claim 8 , wherein individual parts of the plurality of parts comprise:
a natural language description of the legitimate software package;
one or more features of the legitimate software package;
one or more use-cases of the legitimate software package;
an internal architecture of the legitimate software package;
one or more source code files of the legitimate software package; or
any combination thereof.
10 . The server of claim 8 , wherein mutating individual parts of the plurality of parts comprises:
changing one or more variable identifiers;
changing one or more function identifiers based on a context vocabulary;
changing an application programming interface (API) from a first API to a second API;
insertion of one or more comments;
spreading one or more blocks of code across a plurality of functions;
inserting dead code that is never executed;
inserting of dummy functionality;
obfuscation of string literals using character encodings, encryption, string sampling, or minification;
modifying how a target component is accessed including replacing calls made to a component with calls made to a different component; or
any combination thereof.
11 . The server of claim 8 , further comprising:
retrieving the malicious code from a set of code-test pairs, each code-test pair of the set of code-test pairs including a particular malware code and one or more malware tests, wherein the one or more malware tests are used to detect a behavior of the particular malware code to determine whether the mutated malware performs a malicious action of the particular malware code.
12 . The server of claim 8 , wherein:
the artificial intelligence comprises a transformer that tracks connections between code across sub-functions, functions, blocks of code, and larger software components; and
the operations further comprise:
training the artificial intelligence without labeling at least a portion of the training data.
13 . The server of claim 8 , wherein mutating, by the artificial intelligence, the individual parts of the plurality of parts to create multiple mutated parts comprises:
modifying source code by modifying variable identifiers;
modifying function identifiers based on a context vocabulary;
inserting comments based on the context vocabulary;
spreading one or more statements across new or existing functions;
inserting dead code;
inserting dummy functionality;
obfuscating string literals using character encodings, encryption, string sampling, or minification;
adjusting a code style used to access a target component;
replacing an application programming interface (API) call to a call made in a target component; or
any combination thereof.
14 . The server of claim 8 , wherein:
the artificial intelligence comprises a transformer-based deep neural network that accepts natural language prompts as input.
15 . One or more non-transitory computer readable media capable of storing instructions executable by one or more processors to perform operations comprising:
injecting malicious code into a legitimate software package to create an injected package;
extracting, by an artificial intelligence, a plurality of parts of the injected package;
mutating, by the artificial intelligence, individual parts of the plurality of parts to create multiple mutated parts;
assembling at least a portion of the multiple mutated parts to create a mutated malware;
determining, by a malware scanner, a risk score associated with the mutated malware;
based at least in part on determining that the risk score satisfies a predetermined threshold, storing the mutated malware in a set of mutated malware;
after determining, by the one or more processors, that a number of mutated malware in the set of mutated malware satisfies a requested number, determining a ranking of a plurality of malware scanners based on an ability of individual malware scanners of the plurality of malware scanners to identify malware from the set of mutated malware;
based at least in part on the ranking, selecting a particular malware scanner from the plurality of malware scanners that identified a maximum number of malware from the set of mutated malware; and
deploying the particular malware scanner to detect malware.
16 . The one or more non-transitory computer readable media of claim 15 , wherein mutating individual parts of the plurality of parts to create the multiple mutated parts comprises:
changing one or more variable identifiers;
changing one or more function identifiers based on a context vocabulary;
changing an application programming interface (API) from a first API to a second API;
insertion of one or more comments;
spreading one or more blocks of code across a plurality of functions;
inserting dead code that is never executed;
inserting of dummy functionality;
obfuscation of string literals using character encodings, encryption, string sampling, or minification;
modifying how a target component is accessed including replacing calls made to a component with calls made to a different component; or
any combination thereof.
17 . The one or more non-transitory computer readable media of claim 15 , the operations further comprising:
downloading the malicious code from a malware repository; and
downloading the legitimate software package from a package registry.
18 . The one or more non-transitory computer readable media of claim 15 , wherein based at least in part on determining that the risk score fails to satisfy the predetermined threshold, the operations further comprise:
creating a new injected package by injecting newly selected malicious code into a newly selected legitimate software package.
19 . The one or more non-transitory computer readable media of claim 15 , wherein:
the injected package performs at least one legitimate function of the legitimate software package while, under certain circumstances, the malicious code surreptitiously performs one or more unwanted actions.
20 . The one or more non-transitory computer readable media of claim 15 , the operations further comprising:
performing a functional test of the mutated malware;
determining, based on a result of the functional test, that the mutated malware is not semantically equivalent to the malicious code;
extracting, by the artificial intelligence, a second plurality of parts of the mutated malware;
mutating, by the artificial intelligence, the second plurality of parts to create second mutated parts; and
assembling the second mutated parts to create a second mutated malware.