Adversarial EXEmples

Abstract

Recent work has shown that adversarial Windows malware samples—referred to as adversarial EXE mples in this article—can bypass machine learning-based detection relying on static code analysis by perturbing relatively few input bytes. To preserve malicious functionality, previous attacks either add bytes to existing non-functional areas of the file, potentially limiting their effectiveness, or require running computationally demanding validation steps to discard malware variants that do not correctly execute in sandbox environments. In this work, we overcome these limitations by developing a unifying framework that does not only encompass and generalize previous attacks against machine-learning models, but also includes three novel attacks based on practical, functionality-preserving manipulations to the Windows Portable Executable file format. These attacks, named Full DOS , Extend , and Shift , inject the adversarial payload by respectively manipulating the DOS header, extending it, and shifting the content of the first section. Our experimental results show that these attacks outperform existing ones in both white-box and black-box scenarios, achieving a better tradeoff in terms of evasion rate and size of the injected payload, while also enabling evasion of models that have been shown to be robust to previous attacks. To facilitate reproducibility of our findings, we open source our framework and all the corresponding attack implementations as part of the secml-malware Python library. We conclude this work by discussing the limitations of current machine learning-based malware detectors, along with potential mitigation strategies based on embedding domain knowledge coming from subject-matter experts directly into the learning process.

Certified Robustness of Learning-based Static Malware Detectors

“…By varying the aggressiveness of smoothing we examine tradeoffs between robustness certification and accuracy. We find that it is possible to maintain a high accuracy of 91% while guaranteeing robustness to adversarial edits of up to 128 bytes on average, which exceeds edit distances of two published evasion attacks [20,22]. This suggests potential for operationalizing certifications of static malware detection, in some cases.…”

“…The certified radii we observe are close to the best radii theoretically achievable using our mechanism. For the Levenshtein byte-level edit distance threat model, we obtain radii of a few hundred bytes in size, which can certifiably defend against attacks that edit headers of PE files [20,22,57]. However, certifying robustness against more powerful attacks that modify thousands or millions of bytes remains an open challenge.…”

“…To ensure the attacked file x is useful after evading detection, we require that it is functionallyequivalent to the original file x. We focus on evasion attacks that misclassify malware as benign in our experiments, as these attacks dominate prior work [22]. However, for generality we also consider attacks in the opposite direction-where a benign file is misclassified as malicious-when outlining our threat model and deriving robustness certificates.…”

MalDBA: Detection for Query-Based Malware Black-Box Adversarial Attacks

“…Our work is dedicated to detecting query-based black-box attacks and the function of this module is to reproduce typical query-based black-box attacks. Since malware adversarial attacks were investigated later than image adversarial attacks and most of the AEs are generated on feature vectors or substitute models [28,[36][37][38][39][40], there are not many query-based black-box attack methods that can generate real AE files and publish open source codes [14,15,41,42]. We choose two advanced score-based black-box attack frameworks [14,15].…”

Fast and Robust Detection of Adversarial Attacks in the Problem Space using Machine Learning

“…[46] proposed an adaptable white-box threat that is conscious of the defense mechanism and tries to overcome it. [47] Moreover, they spoke about the restrictions of their methodology and how it may be improved in the future to attack malware classifications based on the dynamic assessment. [48] generated a series of problem-space modifications that produce UAPs in the appropriate feature-space embedding and analyzed their performance across attack models of various rates of actual attacker information.…”