Evasion of Deep Learning Detector for Malware C&C Traffic
Date: 2020-01-01
Affected: Palo Alto Networks malware detection system
Attack vector: adversarial-input
Category: research
Severity: High

The Palo Alto Networks Security AI research team tested a deep learning model for malware command and control (C&C) traffic detection in HTTP traffic. Based on the publicly available [paper by Le et al.](https://arxiv.org/abs/1802.03162), we built a model that was trained on a similar dataset as our production model and had similar performance. Then we crafted adversarial samples, queried the model, and adjusted the adversarial sample accordingly until the model was evaded.


Mitigations:

Architectural layers (MAESTRO):