Bypassing NGAV for Fun and Profit

Explore a methodological approach to reverse engineer Next Generation Anti-Virus (NGAV) models and features without reversing the product in this 35-minute Black Hat conference talk. Learn how to generate PE malware that bypasses NGAV products like Cylance through adversary learning techniques. Delve into the challenges, threat models, and data set analysis involved in this process. Examine important features, sliding window probing, and attack results. Gain insights into the similarities and differences between various NGAV products and understand the implications of these findings for cybersecurity professionals and researchers.

Syllabus

Introduction
Outline
Similarities and Differences
Adversary Learning
Challenges of Adversary Learning
Threat Model
Challenges
Example Transferability
Data Set Analysis
Finding Important Features
Highlights
Sliding window probing illustration
Sliding window attack output
Attacking NGAV features
Attack results
Attack conclusion
Results
Summary