COPYCAT: Practical Adversarial Attacks on Visualization-Based Malware Detection

Abstract

Despite many attempts, the state-of-the-art of adversarial machine learning on malware detection systems generally yield unexecutable samples. In this work, we set out to examine the robustness of visualization-based malware detection system against adversarial examples (AEs) that not only are able to fool the model, but also maintain the executability of the original input. As such, we first investigate the application of existing off-the-shelf adversarial attack approaches on malware detection systems through which we found that those approaches do not necessarily maintain the functionality of the original inputs. Therefore, we proposed an approach to generate adversarial examples, COPYCAT, which is specifically designed for malware detection systems considering two main goals; achieving a high misclassification rate and maintaining the executability and functionality of the original input. We designed two main configurations for COPYCAT, namely AE padding and sample injection. While the first configuration results in untargeted misclassification attacks, the sample injection configuration is able to force the model to generate a targeted output, which is highly desirable in the malware attribution setting. We evaluate the performance of COPYCAT through an extensive set of experiments on two malware datasets, and report that we were able to generate adversarial samples that are misclassified at a rate of 98.9% and 96.5% with Windows and IoT binary datasets, respectively, outperforming the misclassification rates in the literature. Most importantly, we report that those AEs were executable unlike AEs generated by off-the-shelf approaches. Our transferability study demonstrates that the generated AEs through our proposed method can be generalized to other models.

References in corpus (9)

• Ensemble Adversarial Training: Attacks and Defenses
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• Robustness May Be at Odds with Accuracy
• Distributional Smoothing with Virtual Adversarial Training
• Microsoft Malware Classification Challenge
• Detecting and Classifying Android Malware using Static Analysis along with Creator Information
• Deceiving End-to-End Deep Learning Malware Detectors using Adversarial Examples
• Adversarial Deep Learning for Robust Detection of Binary Encoded Malware
• Lightweight Classification of IoT Malware based on Image Recognition

Cited by in corpus (5)

• Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art
• EvadeDroid: A Practical Evasion Attack on Machine Learning for Black-box Android Malware Detection
• MAB-Malware: A Reinforcement Learning Framework for Attacking Static Malware Classifiers
• A Survey on Common Threats in npm and PyPi Registries
• Do Deep Minds Think Alike? Selective Adversarial Attacks for Fine-Grained Manipulation of Multiple Deep Neural Networks