A Game-Based Framework to Compare Program Classifiers and Evaders - Artifact

Getting Started

In this section are the steps to reproduce our experiments.

1. Prerequisites

You need to install the following packages to run this project:

• Docker and Docker Compose to run our experiments
• Python-3 to plot the results in the project's Jupyter Notebook
• Wget, Tar and Sed to run the initial scripts to configure the repository

2. Setup

First, download and unpack the zip file. You will get a folder called yali-main.

You should copy the .env.example file and rename it to .env. 

After that, you need to prepare the environment to run our experiments. Run the following command line:

$ ./setup.sh

This will download the datasets, build the docker image and create the necessary folders for the project.

3. Running

Now, you can run the following command line:

$ ./run.sh MODE

There are the following values for MODE:

• all: Run all games, the resources analysis and embedding analysis
• speedup: Run the speedup analysis with the benchmark game
• embeddings: Run the embedding analysis
• resources: Run only the resources analysis
• malware: Run the experiment to detect classes of malware
• game0 Run Game 0
• game1: Run Game 1
• game2: Run Game 2
• game3: Run Game 3
• discover: Run an experiment that tries to discover the obfuscator

Statistics

The Statistics folder contains Jupyter Notebooks that plot the data generated by the experiments. Each notebook describes each chart and the steps to develop them. There are the following notebooks:

• EmbeddingResults: Presents information about the accuracy of the dgcnn and cnn models with different representations
• GameResults: Presents information about the 4 games proposed in our work
• ResourceResults: Presents information about resource consumption (memory and time) of each model
• StrategiesResults: Presents the distance between the histograms of the original programs and the histograms generated by the obfuscators

Repository

We maintain this project in this git repository.