A Framework for Enhancing Deep Neural Networks Against Adversarial Malware

Abstract

Machine learning-based malware detection is known to be vulnerable to adversarial evasion attacks. The state-of-the-art is that there are no effective defenses against these attacks. As a response to the adversarial malware classification challenge organized by the MIT Lincoln Lab and associated with the AAAI-19 Workshop on Artificial Intelligence for Cyber Security (AICS'2019), we propose six guiding principles to enhance the robustness of deep neural networks. Some of these principles have been scattered in the literature, but the others are introduced in this paper for the first time. Under the guidance of these six principles, we propose a defense framework to enhance the robustness of deep neural networks against adversarial malware evasion attacks. By conducting experiments with the Drebin Android malware dataset, we show that the framework can achieve a 98.49\% accuracy (on average) against grey-box attacks, where the attacker knows some information about the defense and the defender knows some information about the attack, and an 89.14% accuracy (on average) against the more capable white-box attacks, where the attacker knows everything about the defense and the defender knows some information about the attack. The framework wins the AICS'2019 challenge by achieving a 76.02% accuracy, where neither the attacker (i.e., the challenge organizer) knows the framework or defense nor we (the defender) know the attacks. This gap highlights the importance of knowing about the attack.

arXiv commentA fully-fledge version for the preliminary paper arXiv:1812.08108 | D. Li, Q. Li, Y. Ye, and S. Xu, "A Framework for Enhancing Deep Neural Networks Against Adversarial Malware", in IEEE Transactions on Network Science and Engineering

References in corpus (6)

• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Evasion Attacks against Machine Learning at Test Time
• Adversarial Deep Ensemble: Evasion Attacks and Defenses for Malware Detection
• Adversarial Training and Robustness for Multiple Perturbations
• Evading Classifiers by Morphing in the Dark

Cited by in corpus (7)

• Deep Learning for Android Malware Defenses: a Systematic Literature Review
• EvadeDroid: A Practical Evasion Attack on Machine Learning for Black-box Android Malware Detection
• RoPGen: Towards Robust Code Authorship Attribution via Automatic Coding Style Transformation
• Arms Race in Adversarial Malware Detection: A Survey
• PAD: Towards Principled Adversarial Malware Detection Against Evasion Attacks
• How to Train your Antivirus: RL-based Hardening through the Problem-Space
• Evaluating the robustness of adversarial defenses in malware detection systems