Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables

Abstract

Machine-learning methods have already been exploited as useful tools for detecting malicious executable files. They leverage data retrieved from malware samples, such as header fields, instruction sequences, or even raw bytes, to learn models that discriminate between benign and malicious software. However, it has also been shown that machine learning and deep neural networks can be fooled by evasion attacks (also referred to as adversarial examples), i.e., small changes to the input data that cause misclassification at test time. In this work, we investigate the vulnerability of malware detection methods that use deep networks to learn from raw bytes. We propose a gradient-based attack that is capable of evading a recentlyproposed deep network suited to this purpose by only changing few specific bytes at the end of each malware sample, while preserving its intrusive functionality. Promising results show that our adversarial malware binaries evade the targeted network with high probability, even though less than 1% of their bytes are modified.

Exploring Adversarial Examples in Malware Detection

“…On this dataset, we use the pretrained MalConv model released with the dataset. In addition, we also created a smaller dataset whose size and distribution is more in line with Kolosnjaji et al's evaluation [8], which we refer to as the Mini dataset. The Mini dataset was created by sampling 4,000 goodware and 4,598 malware samples from the Full dataset.…”

“…Second, limited availability of representative datasets or robust public models limits the generality of existing studies. Existing attacks [8], [9] use victim models trained on very small datasets, and make various assumptions regarding their strategies. Therefore, the generalization effectiveness across production-scale models and the trade-offs between various proposed strategies is yet to be evaluated.…”

“…• We measure the generalization property of adversarial attacks across datasets, highlighting common properties and trade-offs between various strategies. • We unearth an architectural weakness of a published CNN architecture that facilitates existing attack strategies [8], [9]. • We investigate the transferability of single-step adversarial examples across models trained on different datasets.…”

Machine learning in cybersecurity: A review

“…Kolosnjaji et al () have investigated the vulnerability of malware detection methods. They have used deep neural networks to learn from raw bytes of binaries.…”

“…One of the challenges in developing such models are intelligent adversaries who are actively trying to evade them by perturbing the trained model (Grosse, Papernot, Manoharan, Backes, & McDaniel, 2017). Kolosnjaji et al (2018) have investigated the vulnerability of malware detection methods. They have used deep neural networks to learn from raw bytes of binaries.…”