Rethinking Threat Prevention with an Evasion-first Mindset
Introduction
The effectiveness of any detection technology hinges on its ability to counteract evasion techniques—strategies employed by threat actors to obscure the indicators of malicious behavior. If these evasion tactics are not anticipated from the beginning, a significant amount of effort may be redirected toward developing anti-evasion measures, detracting from the primary focus of detecting emerging threats. This oversight could allow existing attacks to slip past the technology, creating a window of opportunity for exploitation.
To illustrate, consider sandbox technology, which was developed to detect malicious files and URLs by analyzing their dynamic behavior. As technology advanced, threat actors began to deploy sophisticated evasion techniques to circumvent sandbox analysis. These challenges were highlighted in my Black Hat presentation (1), where I discussed how the failure to account for evasion from the outset led to a reactive approach. Each new evasion method allowed threat actors to bypass sandbox detection, turning it into a game of catch-up.
At InceptionCyber.ai the Neural Analysis and Correlation Engine (NACE) was designed with evasion in mind, focusing on preventing malicious attachments, URLs, and social engineering exploits like Business Email Compromise (BEC).
In this blog, I’ll share key insights into how NACE integrates anti-evasion features at its core.
Evasion vs. Semantic and Thematic Analysis
NACE detects malicious attachments and URLs not by relying on a malicious payload, but by analyzing the semantic and thematic structures embedded within emails. These structures form a critical part of the feature set used for decision-making in an expert system. However, because semantics are central to this approach, threat actors could potentially evade detection by crafting emails that maintain the same semantics with different wording.
Figure 1.0: A financial-themed email from an actual attack which delivered a malicious attachment.
For example, consider an email with a financial theme designed to deliver a malicious attachment. Figure 1.0 shows an email that requests payment and carries malicious content. Figure 2.0 illustrates several variations (not every variant) of this semantic structure, generated by ChatGPT.
Figure 2.0: Variations of semantics generated by a Large Language Model (LLM).
NACE leverages pre-trained and fine-tuned multi-class classifiers with softmax activation, trained on a well-labeled dataset, to detect these semantics. However, a multi-class classifier may be vulnerable to evasion if it has not been exposed to a diverse range of semantic variants. To mitigate this, NACE employs zero-shot semantic classification through prompt engineering. By harnessing the power of an LLM, NACE identifies semantic variations via zero-shot classification, ensuring that these variants, which serve as features, are effectively detected.
Figure 3.0: Subsystem for Semantic and Thematic Analysis within the NACE Framework.
In addition to semantic analysis, NACE uses hierarchical topic modeling as part of its feature set for decision-making. Hierarchical topic modeling provides thematic insights by generating a structured representation of topics and subtopics. This approach ensures that even when semantic variations occur, the underlying themes are consistently identified, adding another layer of detection to ensure consistent thematic identification across variations in semantics.
Evasive Attachments and Call-to-Action URLs
Generative AI tools like FraudGPT and WormGPT can adapt and evolve, aiding in the creation of sophisticated payloads that incorporate advanced evasion techniques. These techniques include adding sleep calls, waiting for user interactions like mouse clicks before execution, detecting debuggers or analysis environments, and employing obfuscation methods, redirects, CAPTCHAs, and more. These methods are designed to conceal malicious payloads or behaviors during scans, often leading to misclassification as benign.
However, NACE leverages only the feature set found in attached files or call-to-action URLs, making it immune to the anti-evasion techniques employed by threat actors – even when enhanced by generative AI.
Conclusion
The ever-evolving landscape of cyber threats demands detection technologies that are proactive rather than reactive. Traditional technologies, like sandboxing, often fall short because they fail to account for evasion tactics in their design, making them susceptible to bypass and exploitation. NACE introduces a fundamental shift by embedding anti-evasion measures at its core.
NACE’s advanced semantic and thematic analysis utilizes zero-shot semantic classification and hierarchical topic modeling to detect subtle variations in semantics—an essential feature for a precise decision-making expert system. By focusing exclusively on the features embedded in attached files and call-to-action URLs, NACE remains resilient against even the most sophisticated anti-evasion techniques.
In our next blog, we’ll explore additional innovative designs tailored to prevent evasive social engineering Business Email Compromise (BEC) exploits. Stay tuned—this is just the beginning of our journey.
References:
- Abhishek Singh, Zheng Bu, "Hot Knives Through Butter: Evading File-based Sandboxes." Black Hat.
https://media.blackhat.com/us-13/US-13-Singh-Hot-Knives-Through-Butter-Evading-File-based-Sandboxes-WP.pdf