Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection

Abstract

Recent work has shown that adversarial Windows malware samples -also referred to as adversarial EXEmples in this paper -can bypass machine learning-based detection relying on static code analysis by perturbing relatively few input bytes. To preserve malicious functionality, previous attacks either add bytes to existing non-functional areas of the file, potentially limiting their effectiveness, or require running computationally-demanding validation steps to discard malware variants that do not correctly execute in sandbox environments. In this work, we overcome these limitations by developing a unifying framework that not only encompasses and generalizes previous attacks against machine-learning models, but also includes two novel attacks based on practical, functionality-preserving manipulations to the Windows Portable Executable (PE) file format, based on injecting the adversarial payload by respectively extending the DOS header and shifting the content of the first section. Our experimental results show that these attacks outperform existing ones in both white-box and black-box attack scenarios by achieving a better trade-off in terms of evasion rate and size of the injected payload, as well as enabling evasion of models that were shown to be robust to previous attacks. To facilitate reproducibility and future work, we open source our framework and all the corresponding attack implementations. We conclude by discussing the limitations of current machine learning-based malware detectors, along with potential mitigation strategies based on embedding domain knowledge coming from subject-matter experts naturally into the learning process.CCS Concepts: • Computing methodologies → Machine Learning; • Security and privacy → Malware and its mitigation.

Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art

“…In [37], Demetrio et al propose a general adversarial attack framework (RAMEn) against PE malware detectors based on two novel functionality-preserving manipulations, namely Extend and Shift, which inject adversarial payloads by extending the DOS header and shifting the content of the first section in PE files, respectively. In fact, the adversarial payload generation can be optimized in both white-box and black-box settings.…”

“…To make it more stealthy than previous adversarial attacks [35,37,64], Sharif et al propose a new kind of adversarial attacks based on binary diversification techniques which manipulate the instructions of binaries in a fine-grained function level via two kinds of functionality-preserving transformations, i.e., in-place randomization and code displacement [84,123]. In order to guide the transformations that are applied to the PE malware under the white-box setting, they use a gradient ascent optimization to select the transformation only if it shifts its embeddings in a direction similar to the gradient of the attack loss function [14] with respect to its embeddings.…”

A Survey on Common Threats in npm and PyPi Registries

“…Adversarial examples are carefully crafted samples to fool the ML model. Previous work has already illustrated how a clever attacker can augment the correctly classified malware with malicious components to cause the ML model to misclassify it [15,16,8,28]. These attacks mostly inject malicious components to the non-reachable parts of the malware, such as padding bytes to the end of the malware or injecting malicious payload to the malware's DOS header.…”

Against All Odds: Winning the Defense Challenge in an Evasion Competition with Diversification

“…A prevalent modification strategy in the literature and previous competitions against learning methods is to add unused content in areas that are not relevant for the functionality of a program [e.g. 15,45]. In particular, adversaries exploit the semantic gap, that is, the discrepancy between extracted features and the actual processed part of a PE file [20].…”

“…In the context of PE files, an adversary can exploit or create unused areas at multiple locations [15]. As Figure 3 highlights, it is possible to enlarge the DOS header, to fill the slack space at the end of each section, or to append bytes to the overlay, i.e., to the end of the PE file.…”