adobe / adobe/obfuscation-detection
Considerations for base64 arguments
- Dominant language
- Python
- Stars
- 44
- Forks
- 9
- PR merge metrics
- No merged PRs in 30d
Description
Hi, I just saw this awesome project!
My first thought "how will this handle expected base64 argument for program like Chrome or Nvidia?"
Suggestion: Include base64 decode process for arguments before vectorization. This might be finally represented as a string of the valid ascii bytes in cases where binary values are passed. This will most likely also help model accuracy in the case of base64 encoded commands.
### Expected Behaviour
`Google Chrome Helper (GPU)` output label 0
### Actual Behaviour
`Google Chrome Helper (GPU)` output label 1
### Reproduce Scenario (including but not limited to)
#### Steps to Reproduce
Find chrome helper GPU process with args
`ps -e |grep Chrome |grep GPU`
Add process string to example code from project, run demo script and output 1.
If I remove the base64 string from the submitted command, the model returns 0 as expected.
Contributor guide
Research direction
Start by reproducing the Chrome Helper GPU case with the example code and demo script, then trace how command arguments are vectorized. Compare results with and without the base64 string; done means the encoded argument is handled and the reported case produces the expected label 0.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- machine-learning, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100