Deceiving End-to-End Deep Learning Malware Detectors using Adversarial Examples

Abstract

In recent years, deep learning has shown performance breakthroughs in many applications, such as image detection, image segmentation, pose estimation, and speech recognition. However, this comes with a major concern: deep networks have been found to be vulnerable to adversarial examples. Adversarial examples are slightly modified inputs that are intentionally designed to cause a misclassification by the model. In the domains of images and speech, the modifications are so small that they are not seen or heard by humans, but nevertheless greatly affect the classification of the model. Deep learning models have been successfully applied to malware detection. In this domain, generating adversarial examples is not straightforward, as small modifications to the bytes of the file could lead to significant changes in its functionality and validity. We introduce a novel loss function for generating adversarial examples specifically tailored for discrete input sets, such as executable bytes. We modify malicious binaries so that they would be detected as benign, while preserving their original functionality, by injecting a small sequence of bytes (payload) in the binary file. We applied this approach to an end-to-end convolutional deep learning malware detection model and show a high rate of detection evasion. Moreover, we show that our generated payload is robust enough to be transferable within different locations of the same file and across different files, and that its entropy is low and similar to that of benign data sections.

References in corpus (19)

• Adam: A Method for Stochastic Optimization
• Efficient Estimation of Word Representations in Vector Space
• WaveNet: A Generative Model for Raw Audio
• Deep Speech 2: End-to-End Speech Recognition in English and Mandarin
• Language Modeling with Gated Convolutional Networks
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
• Microsoft Malware Classification Challenge
• Spatially Transformed Adversarial Examples
• Adversarial Examples: Attacks and Defenses for Deep Learning
• Parseval Networks: Improving Robustness to Adversarial Examples
• Practical Black-Box Attacks against Machine Learning
• Black-Box Attacks against RNN based Malware Detection Algorithms
• Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong
• The Limitations of Deep Learning in Adversarial Settings
• Deep Neural Network Based Malware Detection Using Two Dimensional Binary Program Features
• Malytics: A Malware Detection Scheme
• ConvNets and ImageNet Beyond Accuracy: Understanding Mistakes and Uncovering Biases
• Automatic measurement of vowel duration via structured prediction

Cited by in corpus (26)

• Microsoft Malware Classification Challenge
• Motivating the Rules of the Game for Adversarial Example Research
• Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection
• Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art
• EvadeDroid: A Practical Evasion Attack on Machine Learning for Black-box Android Malware Detection
• Generation & Evaluation of Adversarial Examples for Malware Obfuscation
• Creating Valid Adversarial Examples of Malware
• The Threat of Adversarial Attacks on Machine Learning in Network Security -- A Survey
• Explaining Vulnerabilities of Deep Learning to Adversarial Malware Binaries
• MAB-Malware: A Reinforcement Learning Framework for Attacking Static Malware Classifiers
• COPYCAT: Practical Adversarial Attacks on Visualization-Based Malware Detection
• Query-Free Evasion Attacks Against Machine Learning-Based Malware Detectors with Generative Adversarial Networks
• Binary Black-box Evasion Attacks Against Deep Learning-based Static Malware Detectors with Adversarial Byte-Level Language Model
• Learning Fast and Slow: PROPEDEUTICA for Real-time Malware Detection
• Practical Attacks on Machine Learning: A Case Study on Adversarial Windows Malware
• A Comparison of Adversarial Learning Techniques for Malware Detection
• Towards Security Threats of Deep Learning Systems: A Survey
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• Machine Learning for Windows Malware Detection and Classification: Methods, Challenges and Ongoing Research
• Towards Robust Domain Generation Algorithm Classification
• Combining Generators of Adversarial Malware Examples to Increase Evasion Rate
• Semantic-preserving Reinforcement Learning Attack Against Graph Neural Networks for Malware Detection
• Updating Windows Malware Detectors: Balancing Robustness and Regression against Adversarial EXEmples
• Being Single Has Benefits. Instance Poisoning to Deceive Malware Classifiers
• A Comparison of State-of-the-Art Techniques for Generating Adversarial Malware Binaries
• ML-based IoT Malware Detection Under Adversarial Settings: A Systematic Evaluation