adobe / adobe/obfuscation-detection

Considerations for base64 arguments

Open
#1 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
44
Forks
9
PR merge metrics
No merged PRs in 30d

Description

Hi, I just saw this awesome project!

My first thought "how will this handle expected base64 argument for program like Chrome or Nvidia?"

Suggestion: Include base64 decode process for arguments before vectorization. This might be finally represented as a string of the valid ascii bytes in cases where binary values are passed. This will most likely also help model accuracy in the case of base64 encoded commands.

### Expected Behaviour
`Google Chrome Helper (GPU)` output label 0
### Actual Behaviour
`Google Chrome Helper (GPU)` output label 1
### Reproduce Scenario (including but not limited to)

#### Steps to Reproduce

Find chrome helper GPU process with args
`ps -e |grep Chrome |grep GPU`
Add process string to example code from project, run demo script and output 1.

If I remove the base64 string from the submitted command, the model returns 0 as expected.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the Chrome Helper GPU case with the example code and demo script, then trace how command arguments are vectorized. Compare results with and without the base64 string; done means the encoded argument is handled and the reported case produces the expected label 0.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
machine-learning, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.