Paper proposes shielding antivirus signatures from black-box extraction
Original title: Signature Knowledge Shielding: Protecting Antivirus Detection Knowledge through Robust Embedding Matching
On a ClamAV prototype, Robust Embedding Matching raised probing queries by up to 282.57 times with under 0.1% added false positives.
Researchers present Signature Knowledge Shielding, which pairs existing antivirus rules with auxiliary Shielding Signatures so black-box probes are harder to map back to protected signatures. The design ranks candidate byte blocks, calibrates them with negative samples, and ORs shield matches with original verdicts. A learned Robust Embedding Matching method, trained with random context and byte perturbations, outperformed five non-learning matchers. Their open-source ClamAV prototype added 0.67% GPU scanning overhead in the authors’ tests.
Unconfirmed: Query-count, false-positive and overhead figures are the authors’ evaluation results, not independent measurements.
- SKS was evaluated against five probing methods.
- Authors report an added test false-positive rate below 0.1%.
- REM is a lightweight matcher aimed at content edits and scan-alignment changes.
- Original positive antivirus verdicts are intended to be preserved.
From the original article
1 min read at arxiv.orgAntivirus (AV) signatures encode valuable detection knowledge accumulated through expert analysis, yet repeated black-box queries can expose this knowledge for unauthorized reuse and targeted evasion. We propose Signature Knowledge Shielding (SKS), a design paradigm that protects existing AV rules, termed Protected Signatures (PS), through auxiliary Shielding Signatures (SS).
By Jieshuai Yang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.