Creating Malicious Software with AI GOAA Practice Questions (Page 7)

Questions 31–32

1. 31application · medium

   A malware analyst is testing whether a deep learning-based PE file classifier can be evaded. The analyst has access to the model's confidence scores but not its internal weights. Which technique is most appropriate to craft an evasive PE file?

   • AUse a black-box attack that queries the model with modified PE files and observes confidence scores to guide iterative mutations.
   • BTrain a surrogate model on the same dataset and transfer adversarial examples from the surrogate to the target.
   • CCompute the gradient of the model's loss with respect to the PE file's byte sequence and apply a sign-based perturbation.
   • DAppend benign data to the end of the PE file to change its hash and confuse the classifier.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security researcher is developing a proof-of-concept to demonstrate how an AI model could generate a polymorphic version of a known benign utility. The goal is to produce variants that evade signature-based antivirus while preserving the utility's original functionality. Which approach best achieves this objective?

   • AUse a GAN to generate entirely new binary files that are statistically similar to the original but not guaranteed to be functional.
   • BTrain a generative model on the utility's source code and use it to produce functionally equivalent but syntactically different code variants.
   • CRecompile the utility with a different compiler optimization flag to change its signature without altering the source code.
   • DApply a gradient-based adversarial perturbation directly to the compiled executable bytes to alter its hash while keeping it runnable.
   Reveal Solution Discussion Select an answer first