Extending Advanced Evasion Techniques Using Combinatorial Search

Abstract

In this paper, we extend the concept of Advanced Evasion Techniques (AETs) by exploring new alternatives to reduce the complexity of existing evasion tools. The major objective is to enhance the security testing potential brought by AETs by increasing the number of combinations that can be tested and checked on the Device Under Test (DUT). We analyze the performance of non-exhaustive search strategies by the use of clusters where multiple evasion techniques are combined. To this end, we propose the use of probabilistic trees to design scenario-based AETs where multiple architectures are considered. For an accurate analysis of the contribution resulting from the proposed idea, we illustrate our idea using a practical evasion tool, namely the EVADER tool designed by McAfee.