AutoGenMalware: Automate Large-scale Zero-knowledge Behavior-centric Bytes-level Malware Sample Repository

Cybersecurity of avionic embedded systems in various U.S. Air Force (USAF) vehicles have become an urgent concern, due to the supply chain globalization. Supply chain vulnerabilities to an embedded system can be introduced anywhere from original equipment manufacturers, maintenance, repair, and overhaul providers. InfoBeyond advocates AutoGenMalware: Automate Zero-knowledge Behavior-centric Malware Sample Repository. AutoGenMalware is a comprehensive repository of the unforeseen effective malware test samples, which strengthens the anti-malware capability for avionics malware detection tools and quantitatively measures the effectiveness of cyber-resilient defense. Specifically, AutoGenMalware provides a unique and efficient Genetic Algorithm (GA) based malware generation framework by performing fitness analysis for each perturbation based on behavior and tracing rate. Based on the fitness result, ranked perturbations are chosen as elitism tournament method, and then the at least two variants are crossed over by the probability-weighted voting approach. Meanwhile, another malware mutation method dynamically introduces code caves in malware binaries, preserving their original functionality. By using GA based optimization and Deep-learning (DL) validation techniques, the most adequate content is then determined to place in such code caves for achieving misclassification. Finally, the effectiveness of the malware variants is evaluated and guaranteed through a quantitative scoring system along with the decision-making threshold.