Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Incident overview
The Palo Alto Networks Security AI research team tested a deep learning model for malware command and control (C&C) traffic detection in HTTP traffic. Based on the publicly available paper by Le et al. (https://arxiv.org/abs/1802.03162), we built a model that was trained on a similar dataset as our production model and had similar performance. Then we crafted adversarial samples, queried the model, and adjusted the adversarial sample accordingly until the model was evaded.
Why this record has no ERS
Only a researcher-built proxy model, trained on a dataset similar to the Palo Alto Networks production model and described as having similar performance, was attacked. The evidence reports no evasion result against the production detector, so no observed control outcome of a bounded deployed system exists to place on a rubric anchor. The record fails the observation test of the scorability admission test and is retained as an attack-flow reference.
Status: Not scorable by design · Classification: Exercise · source date 2026-08-02 · primary evidence date 2020-01-01
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The flow documents what happened and which controls apply; it does not establish an assessed deployment.
| MITRE ATLAS case study | AML.CS0000 (exercise) |
|---|---|
| Target | Palo Alto Networks malware detection system |
| Actor | Palo Alto Networks AI Research Team |
| Primary evidence date | 2020-01-01 |
| SecureFlow record updated | 2026-08-02 |
| AI layers | Predictive ML / computer vision |
| Risk impact | Model evasion / bypass |
| Affected components | deep learning malware C&C traffic detector, HTTP traffic dataset, proxy model, adversarial samples, malware detection system |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Identify URLNet as Target PatternWe identified a machine learning based approach to malicious URL detection as a representative approach and potential target from the paper URLNet: Learning a URL representation with deep learning for malicious URL detection (https://arxiv.org/abs/1802.03162), which was found on arXiv (a pre-print repository). | AML.TA0002 AML.T0000.001 |
| 2 | Acquire C&C HTTP Traffic DatasetWe acquired a command and control HTTP traffic dataset consisting of approximately 33 million benign and 27 million malicious HTTP packet headers. | AML.TA0003 AML.T0002.000 |
| 3 | Train Proxy Malware DetectorWe trained a model on the HTTP traffic dataset to use as a proxy for the target model. Evaluation showed a true positive rate of ~ 99% and false positive rate of ~ 0.01%, on average. Testing the model with a HTTP packet header from known malware command and control traffic samples was detected as malicious with high confidence (> 99%). | AML.TA0001 AML.T0005 |
| 4 | Craft Header-Removal Evasion SamplesWe crafted evasion samples by removing fields from packet header which are typically not used for C&C communication (e.g. cache-control, connection, etc.). | AML.TA0001 AML.T0043.003 |
| 5 | Query Model and Tune SamplesWe queried the model with our adversarial examples and adjusted them until the model was evaded. | AML.TA0001 AML.T0042 |
| 6 | Evade ML Malware DetectorWith the crafted samples, we performed online evasion of the ML-based spyware detection model. The crafted packets were identified as benign with > 80% confidence. This evaluation demonstrates that adversaries are able to bypass advanced ML detection techniques, by crafting samples that are misclassified by an ML model. | AML.TA0007 AML.T0015 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0000-evasion-deep-learning-detector; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0000 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-006.003 | Prediction Response Minimization & Extraction-Resistance ValidationExact SecureFlow defense-map identifier (flow atlas-aml-cs0000-evasion-deep-learning-detector), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Ro-3 Cn-3 |
| AID-D-002.001 | Input / Output Distribution Drift MonitoringExact SecureFlow defense-map identifier (flow atlas-aml-cs0000-evasion-deep-learning-detector), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-5, step-6. Presence supplies no score credit. | Candidate evidence route | Ro-2 Fa-1 Fa-2 Tr-2 Cn-7 |
| AID-D-005.003 | Proactive AI Threat HuntingExact SecureFlow defense-map identifier (flow atlas-aml-cs0000-evasion-deep-learning-detector), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-5, step-6. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-D-002.002 | Labeled Performance Tracking with Ground Truth Feedback LoopExact SecureFlow defense-map identifier (flow atlas-aml-cs0000-evasion-deep-learning-detector), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-2 Fa-1 Fa-2 Tr-2 Cn-7 |
| AID-H-007.004 | Evaluation Data Integrity, Sufficiency Assurance & Promotion GovernanceExact SecureFlow defense-map identifier (flow atlas-aml-cs0000-evasion-deep-learning-detector), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-4 |