#HITBCW2021
Deep Puzzling is an AI-based framework for concealing attack intentions and protecting codes, which prevents crackers from obtaining critical codes. As early as 2018, the DeepLocker framework proposed by IBM's Dhilung Kirat and other researchers used neural networks to generate unlocking keys, which showed us the great potential of AI in hiding attack intentions. Following the footsteps of DeepLocker, we further explore the potential of AI algorithms in complex feature modeling, code generation and error correction, and propose the Deep Puzzling framework, an intent hiding tool that can adapt to the current operating environment to generate a variety of dynamic payloads, and try to explore the cross boundary between AI and cryptography.
The core idea of deep puzzling is to avoid explicit condition judgment in program execution by introducing AI, and the AI algorithm can automatically locate the target, unlock the corresponding payload and perform the corresponding functions to hide the real purpose and protect the core code. We will introduce the key points in the process of data collection and feature extraction, especially the modeling method in the case of a large number of features, then give the design and optimization idea of binary code generation model, and ensure the executable of binary code through AI model. Finally, we will introduce some reverse analysis work of the framework. In the whole process, we actually encode a variety of payloads into the parameters of the AI model. Due to the high complexity and inexplicability of the AI model, it is difficult for us to detect the content of the payloads. After reverse analysis and debugging, the effectiveness of our method is also confirmed.
We hope that such research can bring inspiration to network security enthusiasts. The combination of AI and network security will greatly enhance the flexibility and variability of security situation. It is very important to improve defense capability through AI and detect such risks as soon as possible.
===
Jifeng Zhu, Head of AI security research at Tencent Zhuque Lab, with more than 10+ years of experience in information security, research on vulnerability, advanced threat analysis, reverse engineering, and AI security. He has spoken at CanSecWest, Blackhat, AVAR, XCon, and other international security conferences.
----
Keyun Luo, graduated with a master's degree from the Department of Computer Science of Nanjing University in 2019, and joined the Tencent Security Platform Department in the same year. He is mainly engaged in intrusion detection and new AI-enabled offensive and defensive research, and is currently an AI security researcher at Tencent Zhuque Lab.