Using artificial intelligence to generate test data to test malware scanner(s)
In some examples, a server injects malicious code into a legitimate software package to create an injected package. The server uses an artificial intelligence to extract a plurality of parts from the injected package and to mutate individual parts of the plurality of parts to create mutated parts. The server assembles the mutated parts to create a mutated malware. A malware scanner determines a risk score associated with the mutated malware. Based at least in part on determining that the score satisfies a predetermined threshold, the server stores the mutated malware in a set of mutated malware and creates at least one additional mutation based on the mutated malware. After determining that a size of the set of mutated malware satisfies a requested size, the malware scanner is modified to increase detection of the malicious code in individual mutated malware in the set of mutated malware.
1 . A method comprising:
injecting, by one or more processors, malicious code into a legitimate software package to create an injected package;
extracting, by an artificial intelligence executed by the one or more processors, a plurality of parts of the injected package;
mutating, by the artificial intelligence executed by the one or more processors, individual parts of the plurality of parts to create mutated parts;
assembling, by the one or more processors, the mutated parts to create a mutated malware;
determining, by a malware scanner, a risk score associated with the mutated malware;
based at least in part on determining, by the one or more processors, that the risk score satisfies a predetermined threshold indicating that the malicious code is sufficiently obfuscated in the mutated malware:
storing the mutated malware in a set of mutated malware; and
creating at least one additional mutation based on the mutated malware; and
after determining, by the one or more processors, that a number of mutated malware in the set of mutated malware satisfies a requested number, modifying the malware scanner to increase an accuracy of detecting the malicious code in individual mutated malware in the set of mutated malware.
2 . The method of claim 1 , wherein the plurality of parts comprise:
a natural language description of the legitimate software package;
one or more features of the legitimate software package;
one or more use-cases of the legitimate software package;
an internal architecture of the legitimate software package;
one or more source code files of the legitimate software package; or
any combination thereof.
3 . The method of claim 1 , wherein:
the malicious code is downloaded from a malware repository.
4 . The method of claim 1 , wherein:
the legitimate software package is downloaded from one or more package registries.
5 . The method of claim 1 , wherein based at least in part on determining, by the one or more processors, that the risk score fails to satisfy the predetermined threshold, the method further comprises:
creating a new injected package by injecting newly selected malicious code into a newly selected legitimate software package.
6 . The method of claim 1 , wherein:
the artificial intelligence accesses a large language model.
7 . The method of claim 1 , the method further comprising:
performing a functional test of the mutated malware;
determining, based on a result of the functional test, that the mutated malware is not semantically equivalent to the malicious code;
extracting, by the artificial intelligence, a second plurality of parts of the mutated malware;
mutating, by the artificial intelligence, the second plurality of parts to create second mutated parts; and
assembling the second mutated parts to create a second mutated malware.
8 . A server comprising:
one or more processors; and
one or more non-transitory computer readable media storing instructions executable by the one or more processors to perform operations comprising:
injecting malicious code into a legitimate software package to create an injected package;
extracting, by an artificial intelligence, a plurality of parts of the injected package;
mutating, by the artificial intelligence, individual parts of the plurality of parts to create mutated parts;
assembling the mutated parts to create a mutated malware;
determining, by a malware scanner, a risk score associated with the mutated malware;
based at least in part on determining that the risk score satisfies a predetermined threshold indicating that the malicious code is sufficiently obfuscated in the mutated malware:
storing the mutated malware in a set of mutated malware; and
creating at least one additional mutation based on the mutated malware; and
after determining that a number of mutated malware in the set of mutated malware satisfies a requested number, modifying the malware scanner to increase an accuracy of detecting the malicious code in individual mutated malware in the set of mutated malware.
9 . The server of claim 8 , wherein the plurality of parts comprise:
a natural language description of the legitimate software package;
one or more features of the legitimate software package;
one or more use-cases of the legitimate software package;
an internal architecture of the legitimate software package;
one or more source code files of the legitimate software package; or
any combination thereof.
10 . The server of claim 8 , wherein:
the malicious code is downloaded from a malware repository.
11 . The server of claim 8 , wherein:
the legitimate software package is downloaded from a package registry.
12 . The server of claim 8 , wherein based at least in part on determining that the risk score fails to satisfy the predetermined threshold, the operations further comprise:
creating a new injected package by injecting newly selected malicious code into a newly selected legitimate software package.
13 . The server of claim 8 , wherein:
the artificial intelligence accesses a large language model.
14 . The server of claim 8 , the operations further comprising:
performing a functional test of the mutated malware;
determining, based on a result of the functional test, that the mutated malware is not semantically equivalent to the malicious code;
extracting, by the artificial intelligence, a second plurality of parts of the mutated malware;
mutating, by the artificial intelligence, the second plurality of parts to create second mutated parts; and
assembling the second mutated parts to create a second mutated malware.
15 . One or more non-transitory computer readable media capable of storing instructions executable by one or more processors to perform operations comprising:
injecting malicious code into a legitimate software package to create an injected package;
extracting, by an artificial intelligence, a plurality of parts of the injected package;
mutating, by the artificial intelligence, individual parts of the plurality of parts to create mutated parts;
assembling the mutated parts to create a mutated malware;
determining, by a malware scanner, a risk score associated with the mutated malware;
based at least in part on determining that the risk score satisfies a predetermined threshold indicating that the malicious code is sufficiently obfuscated in the mutated malware:
storing the mutated malware in a set of mutated malware; and
creating additional mutations based on the mutated malware; and
after determining that a number of mutated malware in the set of mutated malware satisfies a requested number, modifying the malware scanner to increase an accuracy of detecting the malicious code in individual mutated malware in the set of mutated malware.
16 . The one or more non-transitory computer readable media of claim 15 , wherein the plurality of parts of the malware variant comprise:
a natural language description of the legitimate software package;
one or more features of the legitimate software package;
one or more use-cases of the legitimate software package;
an internal architecture of the legitimate software package;
one or more source code files of the legitimate software package; or
any combination thereof.
17 . The one or more non-transitory computer readable media of claim 15 , the operations further comprising:
downloading the malicious code from a malware repository; and
downloading the legitimate software package from a package registry.
18 . The one or more non-transitory computer readable media of claim 15 , wherein based at least in part on determining that the risk score fails to satisfy the predetermined threshold, the operations further comprise:
creating a new injected package by injecting newly selected malicious code into a newly selected legitimate software package.
19 . The one or more non-transitory computer readable media of claim 15 , wherein:
the artificial intelligence accesses a large language model.
20 . The one or more non-transitory computer readable media of claim 15 , the operations further comprising:
performing a functional test of the mutated malware;
determining, based on a result of the functional test, that the mutated malware is not semantically equivalent to the malicious code;
extracting, by the artificial intelligence, a second plurality of parts of the mutated malware;
mutating, by the artificial intelligence, the second plurality of parts to create second mutated parts; and
assembling the second mutated parts to create a second mutated malware.