# Machine Learning Detection of Cloud Services Abuse as C&C Infrastructure
## 7 Conclusions  
In this paper, we presented a novel approach that utilized ML-based techniques to detect the abuse of the CLS as a C&C infrastructure. Our approach focused on analyzing static and derivative features extracted from PE files, which are widely used in the Windows operating system. By leveraging these features, we were able to train and evaluate various ML classifiers to effectively identify the malicious samples that abuse the CLS for C&C activities.  
Through our experiments, as illustrated in Table 5, the RF classifier combined with wrapper-based selected features, emerged as the most effective algorithm, achieving a  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Features** & **Benign Parameter** & **Original Detection Accuracy** & **Post-RMCP Detection Accuracy** & **Original CM** & **Post-RMCP CM** \\ \hline MajorOperatingSystemVersion & 1 & & 0.923411 & & TP: 901 & FP:45 \\ \cline{2-6}  & & & & **FN:** 96 & TN:799 \\ \cline{2-6}  & & & 0.813688 & & TP: 901 & FP:45 \\ \cline{2-6}  & & & & **FN:** 298 & TN:597 \\ \cline{2-6}  & & & 0.811515 & & TP: 901 & FP:45 \\ \cline{2-6}  & & & & **FN:** 302 & TN:593 \\ \cline{2-6}  & & & 0.937534 & TP: 901 & FP:45 \\ \cline{2-6}  & & & & **FN:** 53 & TN:842 & TN:825 \\ \hline MinorSubsystemVersion & 0 & & 0.941879 & & TP: 901 & FP:45 \\ \cline{2-6}  & & & & & **FN:** 62 & TN:833 \\ \hline Characteristics & 263 & & 0.690386 & & TP: 901 & FP:45 \\ \cline{2-6}  & & & & & **FN:** 525 & TN:370 \\ \hline e\_flanew & 304 & & 0.697990 & & TP: 901 & FP:45 \\ \hline \hline \end{tabular}
\end{table}
Table 10: Comparison of detection accuracy before and after the RMCP adversarial attack, highlighting changes in FN values in the confusion matrix (CM): [PERSON] et al. [40].  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Features** & **Benign Parameter** & **Original Detection Accuracy** & **Post-RMCP Detection Accuracy** & **Original CM** & **Post-RMCP CM** \\ \hline MajorImageVersion & 10 & & 0.697447 & & TP: 914 & FP:32 \\ \cline{2-6}  & & & 0.543726 & & FN: 525 & TN:370 \\ \cline{2-6}  & & & & & TP: 914 & FP:32 \\ \cline{2-6}  & 84 & & 0.956545 & & TP: 914 & FP:32 \\ \hline ExportSize & 393,079 & & 0.951113 & FN: 48 & TN:847 & TP:914 & FP:32 \\ \cline{2-6}  & & & & & **FN:** 58 & TN:837 \\ \cline{2-6}  & & & & & **TP:** 914 & FP:32 \\ \cline{2-6}  & & & & & **FN:** 405 & TN:490 \\ \hline \hline \end{tabular}
\end{table}
Table 11: Comparison of detection accuracy before and after the RMCP adversarial attack, highlighting changes in FN values in the confusion matrix (CM): [PERSON] et al. [41].  
high detection rate of 98.15%. This demonstrated the potential of our proposed approach to detect the abuse of CLS as a C&C channel. Furthermore, we conducted a robustness evaluation to examine our approach's resilience against white-box adversarial attacks. Our findings indicated that the proposed method maintained high levels of accuracy of 83% even in the presence of such an attack.  
To facilitate further research and development in this area, we introduced a new labeled dataset containing malicious associated with CLS usage and benign PE files. We believe that this dataset, being the first of its kind, will serve as a valuable resource for researchers and practitioners working on the development and evaluation of detection techniques aimed at identifying and countering malware that abuse CLS as a C&C channel.  
In essence, our proposed approach highlights the potential of ML-based techniques in effectively detecting the abuse of CLS as a C&C infrastructure. By delivering a solution that is both robust and highly accurate, we contribute to the ongoing efforts in combating such sophisticated cyber threats.