Method and product for providing a predictive security product and evaluating existing security products
A method, product and computer program product for evolving malware variants, the method including the steps of: receiving a malware specimen; generating a first generation of variants corresponding to the malware specimen, wherein the malware specimen is altered by one or more mutations to generate each variant of the first generation of variants; selecting variants from the first generation of variants; and mutating the selected variants to generate successive generations of variants, wherein the successive generations are generated until one or more criteria are met.
1. A malware evolution system, comprising:
a non-transitory memory storing a malware specimen; and
one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:
generating a first generation of variants corresponding to the malware specimen, wherein the malware specimen is altered by one or more mutations to generate each variant of the first generation of variants;
selecting variants from the first generation of variants; and
mutating the selected variants to generate successive generations of variants, the successive generations generated until one or more criteria are met, wherein the mutating comprises:
determining that a fitness score associated with a previous mutation of a variant of the selected variants is greater than a prior fitness score associated with the variant from before the previous mutation;
based on the determining, identifying an area of the variant that was mutated in the previous mutation; and
mutating the identified area of the variant.
2. The system of claim 1 , wherein the mutating the identified area of the variant comprises:
increasing a mutation probability corresponding to the identified area.
3. The system of claim 1 , wherein mutating the selected variants comprises:
altering a variant of the selected variants by a mutation that is at least one of a random mutation, a semi-random mutation, and a pseudo-random mutation.
4. The system of claim 1 , wherein mutating the selected variants comprises:
increasing a mutation probability in an area of a second variant of the selected variants that is signed by a security product.
5. The system of claim 1 , wherein mutating the selected variants comprises:
expanding a section of an executable area of a second variant of the selected variants by adding code to the section; and
rewriting a header of the executable area to compensate for an expanded size of the section.
6. The system of claim 1 , wherein mutating the selected variants comprises:
creating a new variant by combining executable areas from two or more variants of the selected variants; and
rewriting a header corresponding to an executable area of the new variant to allow the executable area to be executed.
7. The system of claim 1 , wherein mutating the selected variants comprises:
modifying a dynamic function call of an executable area of a second variant of the selected variants to a static invocation of an operating system call.
8. The system of claim 7 , wherein the modifying comprises implanting code executed by the dynamic function call into the executable area.
9. The system of claim 1 , wherein mutating the selected variants comprises:
encrypting at least one section of a second variant of the selected variants.
10. The system of claim 1 , wherein mutating the selected variants comprises at least one of:
(i) replacing a command sequence with a different and functionally equivalent sequence of commands,
(ii) replacing a library call with a different and functionally equivalent library call, and
(iii) replacing a library with a different and functionally equivalent library.
11. The system of claim 1 , wherein each of the selected variants from the first generation of variants is associated with a respective fitness score that exceeds a threshold.
12. The system of claim 1 , wherein the selecting the variants from the first generation of variants comprises:
providing a first fitness score corresponding to a first variant of the first generation of variants; and
determining that the first fitness score is higher than a second fitness score of a second variant of the first generation of variants; and
based on the determining, selecting the first variant.
13. The system of claim 1 , wherein the first generation of variants comprises one or more network packets, and wherein the one or more mutations alter at least one of: (1) a field of the malware specimen; and (2) a payload of the malware specimen.
14. The system of claim 13 , the operations further comprising:
wrapping the one or more network packets in a channel that is secured by encryption.
15. The system of claim 13 , wherein altering the malware specimen by the one or more mutations includes modifying at least one Cyclic Redundancy Check (CRC) or checksum field.
16. The system of claim 1 , wherein the malware specimen is altered by a router, and
wherein the first generation of variants is sent by the router to a machine that returns a result indicating that at least one variant of the first generation of variants is malicious.
17. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
receiving a malware specimen;
generating a first generation of variants corresponding to the malware specimen, wherein the malware specimen is altered by one or more mutations to generate each variant of the first generation of variants;
selecting variants from the first generation of variants; and
mutating the selected variants to generate successive generations of variants, the successive generations generated until one or more criteria are met, wherein the mutating comprises:
determining that a fitness score associated with a previous mutation of a variant of the selected variants is greater than a prior fitness score associated with the variant from before the previous mutation;
based on the determining, identifying an area of the variant that was mutated in the previous mutation; and
mutating the identified area of the variant.
18. The non-transitory machine-readable medium of claim 17 , wherein mutating the selected variants comprises:
increasing a mutation probability in an area of a second variant of the selected variants that is signed by a security product.
19. The non-transitory machine-readable medium of claim 17 , wherein mutating the selected variants comprises:
expanding a section of an executable area of a second variant of the selected variants by adding code to the section; and
rewriting a header of the executable area to compensate for an expanded size of the section.
20. The non-transitory machine-readable medium of claim 17 , wherein mutating the selected variants comprises:
creating a new variant by combining executable areas from two or more variants of the selected variants; and
rewriting a header corresponding to an executable area of the new variant to allow the executable area to be executed.
21. The non-transitory machine-readable medium of claim 17 , wherein the first generation of variants comprises one or more network packets, and wherein the one or more mutations alter at least one of: (1) a field of the malware specimen; and (2) a payload of the malware specimen.
22. The non-transitory machine-readable medium of claim 21 , wherein altering the malware specimen by the one or more mutations includes modifying at least one Cyclic Redundancy Check (CRC) or checksum field.
23. A method for evolving malware variants comprising:
receiving a malware specimen;
generating a first generation of variants corresponding to the malware specimen, wherein the malware specimen is altered by one or more mutations to generate each variant of the first generation of variants;
selecting variants from the first generation of variants; and
mutating the selected variants to generate successive generations of variants, the successive generations generated until one or more criteria are met, wherein the mutating comprises:
determining that a fitness score associated with a previous mutation of a variant of the selected variants is greater than a prior fitness score associated with the variant from before the previous mutation;
based on the determining, identifying an area of the variant that was mutated in the previous mutation; and
mutating the identified area of the variant.
24. The method of claim 23 , wherein mutating the selected variants comprises:
increasing a mutation probability in an area of a second variant of the selected variants that is signed by a security product.
25. The method of claim 23 , wherein mutating the selected variants comprises:
expanding a section of an executable area of a second variant of the selected variants by adding code to the section; and
rewriting a header of the executable area to compensate for an expanded size of the section.
26. The method of claim 23 , wherein mutating the selected variants comprises:
creating a new variant by combining executable areas from two or more variants of the selected variants; and
rewriting a header corresponding to an executable area of the new variant to allow the executable area to be executed.
27. The method of claim 23 , wherein the first generation of variants comprises one or more network packets, and wherein the one or more mutations alter at least one of: (1) a field of the malware specimen; and (2) a payload of the malware specimen.
28. The method of claim 27 , wherein altering the malware specimen by the one or more mutations includes modifying at least one Cyclic Redundancy Check (CRC) or checksum field.