Adversarial Perturbations Against Deep Neural Networks for Malware Classification

Abstract

Deep neural networks, like many other machine learning models, have recently been shown to lack robustness against adversarially crafted inputs. These inputs are derived from regular inputs by minor yet carefully selected perturbations that deceive machine learning models into desired misclassifications. Existing work in this emerging field was largely specific to the domain of image classification, since the high-entropy of images can be conveniently manipulated without changing the images' overall visual appearance. Yet, it remains unclear how such attacks translate to more security-sensitive applications such as malware detection - which may pose significant challenges in sample generation and arguably grave consequences for failure. In this paper, we show how to construct highly-effective adversarial sample crafting attacks for neural networks used as malware classifiers. The application domain of malware classification introduces additional constraints in the adversarial sample crafting problem when compared to the computer vision domain: (i) continuous, differentiable input domains are replaced by discrete, often binary inputs; and (ii) the loose condition of leaving visual appearance unchanged is replaced by requiring equivalent functional behavior. We demonstrate the feasibility of these attacks on many different instances of malware classifiers that we trained using the DREBIN Android malware data set. We furthermore evaluate to which extent potential defensive mechanisms against adversarial crafting can be leveraged to the setting of malware classification. While feature reduction did not prove to have a positive impact, distillation and re-training on adversarially crafted samples show promising results.

version update: correcting typos, incorporating external feedback

References in corpus (4)

• End to End Learning for Self-Driving Cars
• Understanding Deep Convolutional Networks
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Practical Black-Box Attacks against Machine Learning

Cited by in corpus (108)

• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• DeepXplore: Automated Whitebox Testing of Deep Learning Systems
• Adversarially Robust Generalization Requires More Data
• The Space of Transferable Adversarial Examples
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
• On the (Statistical) Detection of Adversarial Examples
• Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
• IDSGAN: Generative Adversarial Networks for Attack Generation against Intrusion Detection
• Early Stage Malware Prediction Using Recurrent Neural Networks
• Adversarial Attacks on Deep Learning Models in Natural Language Processing: A Survey
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
• MagNet: a Two-Pronged Defense against Adversarial Examples
• DeepTest: Automated Testing of Deep-Neural-Network-driven Autonomous Cars
• A General Framework for Adversarial Examples with Objectives
• Learning to Evade Static PE Machine Learning Malware Models via Reinforcement Learning
• Adversarial Example Detection for DNN Models: A Review and Experimental Comparison
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Motivating the Rules of the Game for Adversarial Example Research
• Deceiving Google's Perspective API Built for Detecting Toxic Comments
• Early Methods for Detecting Adversarial Images
• Deep Learning for Android Malware Defenses: a Systematic Literature Review
• Black-Box Attacks against RNN based Malware Detection Algorithms
• Blocking Transferability of Adversarial Examples in Black-Box Learning Systems
• Optimization and Abstraction: A Synergistic Approach for Analyzing Neural Network Robustness
• Hardening Random Forest Cyber Detectors Against Adversarial Attacks
• Adversarial Perturbations Against Real-Time Video Classification Systems
• A Simple Explanation for the Existence of Adversarial Examples with Small Hamming Distance
• Security and Privacy Issues in Deep Learning
• Explanation-Guided Backdoor Poisoning Attacks Against Malware Classifiers
• Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compression
• Adversarial Attacks on Time-Series Intrusion Detection for Industrial Control Systems
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• Weighted-Sampling Audio Adversarial Example Attack
• Malytics: A Malware Detection Scheme
• Generation & Evaluation of Adversarial Examples for Malware Obfuscation
• Security Matters: A Survey on Adversarial Machine Learning
• Learning Adversary-Resistant Deep Neural Networks
• A Theoretical Framework for Robustness of (Deep) Classifiers against Adversarial Examples
• Learning Security Classifiers with Verified Global Robustness Properties
• The Threat of Adversarial Attacks on Machine Learning in Network Security -- A Survey
• Explaining Vulnerabilities of Deep Learning to Adversarial Malware Binaries
• Enhancing the Insertion of NOP Instructions to Obfuscate Malware via Deep Reinforcement Learning
• Towards Imperceptible and Robust Adversarial Example Attacks against Neural Networks
• Evading classifiers in discrete domains with provable optimality guarantees
• HashTran-DNN: A Framework for Enhancing Robustness of Deep Neural Networks against Adversarial Malware Samples
• Improving Robustness of ML Classifiers against Realizable Evasion Attacks Using Conserved Features
• Attack and Defense of Dynamic Analysis-Based, Adversarial Neural Malware Classification Models
• DRLDO: A novel DRL based De-ObfuscationSystem for Defense against Metamorphic Malware
• Non-Negative Networks Against Adversarial Attacks
• Adversarial Defense via Data Dependent Activation Function and Total Variation Minimization
• On Evaluation of Adversarial Perturbations for Sequence-to-Sequence Models
• ResNets Ensemble via the Feynman-Kac Formalism to Improve Natural and Robust Accuracies
• Art of singular vectors and universal adversarial perturbations
• Packet-Level Adversarial Network Traffic Crafting using Sequence Generative Adversarial Networks
• Practical Machine Learning for Cloud Intrusion Detection: Challenges and the Way Forward
• Security and Privacy for Artificial Intelligence: Opportunities and Challenges
• Generic Black-Box End-to-End Attack Against State of the Art API Call Based Malware Classifiers
• Learning Fast and Slow: PROPEDEUTICA for Real-time Malware Detection
• Neural Classification of Malicious Scripts: A study with JavaScript and VBScript
• Universal Adversarial Perturbation for Text Classification
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• Adversarial Learning of Deepfakes in Accounting
• Not All Datasets Are Born Equal: On Heterogeneous Data and Adversarial Examples
• Convergence and Margin of Adversarial Training on Separable Data
• Automated Poisoning Attacks and Defenses in Malware Detection Systems: An Adversarial Machine Learning Approach
• Adversary Resistant Deep Neural Networks with an Application to Malware Detection
• Mathematical Analysis of Adversarial Attacks
• On the Resilience of Machine Learning-Based IDS for Automotive Networks
• How Wrong Am I? - Studying Adversarial Examples and their Impact on Uncertainty in Gaussian Process Machine Learning Models
• Adversarial Artifact Detection in EEG-Based Brain-Computer Interfaces
• On Training Robust PDF Malware Classifiers
• Fraternal Twins: Unifying Attacks on Machine Learning and Digital Watermarking
• Feature-level Malware Obfuscation in Deep Learning
• On Visual Hallmarks of Robustness to Adversarial Malware
• HeNet: A Deep Learning Approach on Intel${}^{\circledR }$ Processor Trace for Effective Exploit Detection
• Stochastic Combinatorial Ensembles for Defending Against Adversarial Examples
• OFEI: A Semi-black-box Android Adversarial Sample Attack Framework Against DLaaS
• Defending Malware Classification Networks Against Adversarial Perturbations with Non-Negative Weight Restrictions
• Omni: Automated Ensemble with Unexpected Models against Adversarial Evasion Attack
• Characterizing Location-based Mobile Tracking in Mobile Ad Networks
• Reducing Adversarial Example Transferability Using Gradient Regularization
• Implicit Generative Modeling of Random Noise during Training for Adversarial Robustness
• Perception-in-the-Loop Adversarial Examples
• Artificial Neural Network for Cybersecurity: A Comprehensive Review
• Technical Report: When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attacks
• Deep Latent Defence
• Clipping free attacks against artificial neural networks
• When the Guard failed the Droid: A case study of Android malware
• Using Randomness to Improve Robustness of Machine-Learning Models Against Evasion Attacks
• Output Randomization: A Novel Defense for both White-box and Black-box Adversarial Models
• Learning Neural Models for Natural Language Processing in the Face of Distributional Shift
• Improving Robustness of Malware Classifiers using Adversarial Strings Generated from Perturbed Latent Representations
• Evaluating Ensemble Robustness Against Adversarial Attacks
• Reducing audio membership inference attack accuracy to chance: 4 defenses
• Search Space of Adversarial Perturbations against Image Filters
• Universal Adversarial Perturbations for CNN Classifiers in EEG-Based BCIs
• PredCoin: Defense against Query-based Hard-label Attack
• LSDAT: Low-Rank and Sparse Decomposition for Decision-based Adversarial Attack
• Adversarial Attacks on Cognitive Self-Organizing Networks: The Challenge and the Way Forward
• A Comparison of State-of-the-Art Techniques for Generating Adversarial Malware Binaries
• A Review of Computer Vision Methods in Network Security
• Analyzing Adversarial Robustness of Deep Neural Networks in Pixel Space: a Semantic Perspective
• Extending Adversarial Attacks to Produce Adversarial Class Probability Distributions
• advPattern: Physical-World Attacks on Deep Person Re-Identification via Adversarially Transformable Patterns
• Do Deep Minds Think Alike? Selective Adversarial Attacks for Fine-Grained Manipulation of Multiple Deep Neural Networks
• Active Learning for Black-Box Adversarial Attacks in EEG-Based Brain-Computer Interfaces