Adversarial Deep Learning for Robust Detection of Binary Encoded Malware

Abstract

Malware is constantly adapting in order to avoid detection. Model based malware detectors, such as SVM and neural networks, are vulnerable to so-called adversarial examples which are modest changes to detectable malware that allows the resulting malware to evade detection. Continuous-valued methods that are robust to adversarial examples of images have been developed using saddle-point optimization formulations. We are inspired by them to develop similar methods for the discrete, e.g. binary, domain which characterizes the features of malware. A specific extra challenge of malware is that the adversarial examples must be generated in a way that preserves their malicious functionality. We introduce methods capable of generating functionally preserved adversarial malware examples in the binary domain. Using the saddle-point formulation, we incorporate the adversarial examples into the training of models that are robust to them. We evaluate the effectiveness of the methods and others in the literature on a set of Portable Execution (PE) files. Comparison prompts our introduction of an online measure computed during training to assess general expectation of robustness.

The Robust Malware Detection Challenge and Greedy Random Accelerated Multi-Bit Search

“…In [1], methods are introduced that are capable of generating functionally preserved adversarial malware examples in the binary domain. Using the saddle-point formulation, they incorporate the adversarial examples into the training of models that are robust to them.…”

“…We follow the notation in [1]. The data distribution D contains tuples of binary representations of executable files and their corresponding labels.…”

“…As outlined in [1], following [16], the samples obtained via (2) need to be incorporated into the training process, given by (1), to harden the model. The resulting problem becomes:…”

“…Any small perturbation of a given sample in the continuous space yields a valid data point, and numerous methods of finding minimal changes that fool classifiers have been proposed [9]. It is shown in [1] that these methods can be used to train a robust malware classifier, i.e., a malware detector that is hard to evade. In most cyber security applications, however, and in particular in malware classification, the feature space frequently contains discrete features.…”

Large-Scale Malicious Software Classification With Fuzzified Features and Boosted Fuzzy Random Forest

“…Many of the studies on malware classification stem from the Microsoft 2015 Kaggle competition [9], in which deep learning methods based on the visual feature of malware obtained an accuracy of 99.8%. Yet deep learning-based methods suffer from several problems including (i) the complexity of the model structure prevents interpretability and explainability, (ii) the features extracted (especially visual feature) consume too much memory and their validity remains vague, (iii) the model can be attacked by gradient based adversarial methods as in image classification tasks [10]- [12]. Recently, fuzzy theory has been incorporated into deep learning system to provide interpretability and robustness [13]- [16].…”