# Machine Learning Detection of Cloud Services Abuse as C&C Infrastructure
## 6 Comparison to Related Works
### Adversarial Attack  
To compare the robustness of our ML models with related works, we propose the Replace Misclassified Parameter (RMCP) as a novel white-box adversarial attack to evaluate the robustness of our proposed abuse detection system by manipulating feature values to make malicious samples appear benign. In a white-box attack, the attacker has full knowledge of the ML model being used, including its features. To elucidate the impact of adversarial attacks on model accuracy, we have detailed the components of the confusion matrix as follows, which are also presented in Table 7.  
* True positive (TP): The number of instances where the model correctly predicted benign software (0). This means the model identified a sample as benign and it was indeed benign. * False positive (FP): The number of instances in which the model incorrectly predicted malware (1) when the sample was actually benign (0), which means the model misclassified benign software as malware. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Reference**} & \multicolumn{4}{c}{**J48**} & \multicolumn{4}{c}{**Random Forest**} \\ \cline{2-9}  & **Accuracy** & **Precision** & **Recall** & **F1-Score** & **Accuracy** & **Precision** & **Recall** & **F1-Score** \\ \hline [PERSON] et al. [40] & 94.46 & 94.90 & 93.63 & 94.26 & 94.68 & 94.93 & 94.08 & 94.50 \\ \hline [PERSON] et al. [41] & 94.75 & 93.83 & 95.08 & 94.45 & 95.65 & 96.36 & 94.64 & 95.49 \\ \hline Proposed work & 96.80 & 96.04 & 97.43 & 96.73 & 98.15 & 98.75 & 97.43 & 98.09 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Comparison of abuse detection accuracy between proposed and existing works. \begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Actual**} & \multicolumn{2}{c}{**Predicted**} \\ \cline{2-5}  & \multicolumn{2}{c}{**Benign**} & \multicolumn{2}{c}{**Malware**} \\ \hline \multirow{2}{*}{**Actual**} & **Benign** & True positive (TP) & False positive (FP) \\ \cline{2-5}  & **Malware** & False negative (FN) & True negative (TN) \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Confusion matrix: delineating Predicted vs. Actual outcomes for Benign and Malware classifications* False negative (FN): The number of instances where the model incorrectly predicted benign software (0) when the software was actually malware (1), which means the model was misclassifying the malware as benign software. * True negative (TN): The number of instances where the model correctly predicted malware (1). This means that the model identified the software as malware and it was indeed malware. The adversarial attack experimental procedure consists of two stages, each with unique objectives and methodologies: 1. Identifying Modifiable Features:The first step aims to identify which features within an executable file can be altered without affecting the functionality of the executable file, specifically evaluating whether it retained its ability to execute or became corrupted. This was a crucial step, reflecting the real-world tactics of threat actors who strive to maintain an executable's malicious capabilities while modifying its attributes. As Table 8 shows, for 9 out of 38 features, modifying their value in a malicious file results in file corruption, rendering the malware non-executable. For instance, replacing the 'NumberOfSections' value of a malicious sample with other corresponding values from a benign one resulted in a corrupted executable file. Identifying Feature Values Leading to Maximum Misclassification: In the second step of our approach, we perturb the significant features of malicious samples with values from benign samples, aiming to make our proposed model misclassify the malicious samples as benign. We exploit the modifiable features identified earlier to deceive the model. For each of these features, we identify the value that maximizes the number of false negatives when applied to malicious samples.