ReinforSec: an automatic generator of synthetic malware samples and denial-of-service attacks through reinforcement learning

Hernandez Suarez, AldoSanchez Perez, GabrielToscano Medina, Linda K.Perez Meana, HectorOlivares Mercado, JesusPortillo Portillo, JoseBenitez Garcia, GibranSandoval Orozco, Ana LucilaGarcía Villalba, Luis Javier2024-04-292024-04-292023-01-20Hernandez-Suarez, A.; Sanchez-Perez, G.; Toscano-Medina, L.K.; Perez-Meana, H.; Olivares-Mercado, J.; Portillo-Portillo, J.; Benitez-Garcia, G.; Sandoval Orozco, A.L.; García Villalba, L.J. ReinforSec: An Automatic Generator of Synthetic Malware Samples and Denial-of-Service Attacks through Reinforcement Learning. Sensors 2023, 23, 1231. https://doi.org/10.3390/s2303123110.3390/s23031231https://hdl.handle.net/20.500.14352/1036592023 Descuentos MDPIIn recent years, cybersecurity has been strengthened through the adoption of processes, mechanisms and rapid sources of indicators of compromise in critical areas. Among the most latent challenges are the detection, classification and eradication of malware and Denial of Service Cyber-Attacks (DoS). The literature has presented different ways to obtain and evaluate malware- and DoS-cyber-attack-related instances, either from a technical point of view or by offering ready-to-use datasets. However, acquiring fresh, up-to-date samples requires an arduous process of exploration, sandbox configuration and mass storage, which may ultimately result in an unbalanced or under-represented set. Synthetic sample generation has shown that the cost associated with setting up controlled environments and time spent on sample evaluation can be reduced. Nevertheless, the process is performed when the observations already belong to a characterized set, totally detached from a real environment. In order to solve the aforementioned, this work proposes a methodology for the generation of synthetic samples of malicious Portable Executable binaries and DoS cyber-attacks. The task is performed via a Reinforcement Learning engine, which learns from a baseline of different malware families and DoS cyber-attack network properties, resulting in new, mutated and highly functional samples. Experimental results demonstrate the high adaptability of the outputs as new input datasets for different Machine Learning algorithms.engAttribution 4.0 Internationalhttp://creativecommons.org/licenses/by/4.0/ReinforSec: an automatic generator of synthetic malware samples and denial-of-service attacks through reinforcement learningjournal article1424-8220https://doi.org/ 10.3390/s23031231https://www.mdpi.com/1424-8220/23/3/1231open access004.8004.056MalwareDenial of serviceReinforcement learningSynthetic samplingCybersecurityMachine learningCybersecurity datasetsArtificial intelligenceQ learningSeguridad informáticaInteligencia artificial (Informática)1203.04 Inteligencia Artificial1203.17 Informática