Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN

Abstract

Machine learning has been used to detect new malware in recent years, while malware authors have strong motivation to attack such algorithms.Malware authors usually have no access to the detailed structures and parameters of the machine learning models used by malware detection systems, and therefore they can only perform black-box attacks. This paper proposes a generative adversarial network (GAN) based algorithm named MalGAN to generate adversarial malware examples, which are able to bypass black-box machine learning based detection models. MalGAN uses a substitute detector to fit the black-box malware detection system. A generative network is trained to minimize the generated adversarial examples' malicious probabilities predicted by the substitute detector. The superiority of MalGAN over traditional gradient based adversarial example generation algorithms is that MalGAN is able to decrease the detection rate to nearly zero and make the retraining based defensive method against adversarial examples hard to work.

Dissecting Malware in the Wild

“…One of the primary factors that determines a good adversarial example generation algorithm is the types of modifications it makes to input executables [9]. Each of the two frameworks we are testing have a distinct set of these actions they can take on a given sample in an attempt to transform it into an evasive one.…”

“…This machine learning oriented approach offers several key benefits over traditional methods like a purely signature-based comparison over a database of known samples. For one, bad faith actors do not typically have knowledge of the training techniques or parameters of the machine learning model used in commercial antivirus software, forcing them to perform black-box attacks and so making it more difficult for them to exploit the algorithm with the aim of causing a misclassification [9]. Furthermore, machine learning models function by extracting features such as instruction sequences and section names from input data and comparing them to the same features found in known malware samples [10].…”

A Comparison of State-of-the-Art Techniques for Generating Adversarial Malware Binaries

“…Consequently, strategically modifying features of a malware binary can modify their signature without altering their malicious functionality. Feature modification techniques first transform or embed the bytes of the malware binary into a latent feature space and then modify those features [24]. However, it must be noted that it is non-trivial to reverse transform the modified features into their byte-level equivalents to get the modified binary.…”

“…Fang et al [18] proposed another reinforcement learning technique called AC3Mal to determine a rule or policy that converts malware to adversarial by performing different actions on a binary [2] such as appending bytes, sections, or libraries, removing sections, and modifying the binary's signature certificate, to modify the features of the binary and make it evasive while preserving its functionality. Authors have also pro-posed generative adversarial networks (GANs) [24], enhanced with Monte Carlo Tree Search [44] to generate adversarial malware by modifying features of the binary.…”

MALIGN: Adversarially Robust Malware Family Detection using Sequence Alignment

“…Indeed, currently all commercial malware detectors use machine learning. However, one shortcoming of current static malware detectors is that they can be easily evaded by changing a malware trivially without changing the core of the malware [1]- [10]. Fundamentally, the adversarial attacks use one simple technique: add or modify selected content to the malware.…”