Adversarial Deep Ensemble: Evasion Attacks and Defenses for Malware Detection

Abstract

Malware remains a big threat to cyber security, calling for machine learning based malware detection. While promising, such detectors are known to be vulnerable to evasion attacks. Ensemble learning typically facilitates countermeasures, while attackers can leverage this technique to improve attack effectiveness as well. This motivates us to investigate which kind of robustness the ensemble defense or effectiveness the ensemble attack can achieve, particularly when they combat with each other. We thus propose a new attack approach, named mixture of attacks, by rendering attackers capable of multiple generative methods and multiple manipulation sets, to perturb a malware example without ruining its malicious functionality. This naturally leads to a new instantiation of adversarial training, which is further geared to enhancing the ensemble of deep neural networks. We evaluate defenses using Android malware detectors against 26 different attacks upon two practical datasets. Experimental results show that the new adversarial training significantly enhances the robustness of deep neural networks against a wide range of attacks, ensemble methods promote the robustness when base classifiers are robust enough, and yet ensemble attacks can evade the enhanced malware detectors effectively, even notably downgrading the VirusTotal service.

D. Li and Q. Li, "Adversarial Deep Ensemble: Evasion Attacks and Defenses for Malware Detection," in IEEE Transactions on Information Forensics and Security (early access)

References in corpus (3)

• Ensemble Adversarial Training: Attacks and Defenses
• Security Evaluation of Pattern Classifiers under Attack
• Adversarial Training and Robustness for Multiple Perturbations

Cited by in corpus (11)

• Deep Learning for Android Malware Defenses: a Systematic Literature Review
• EvadeDroid: A Practical Evasion Attack on Machine Learning for Black-box Android Malware Detection
• A Framework for Enhancing Deep Neural Networks Against Adversarial Malware
• Arms Race in Adversarial Malware Detection: A Survey
• PAD: Towards Principled Adversarial Malware Detection Against Evasion Attacks
• A methodology to identify identical single-board computers based on hardware behavior fingerprinting
• Can We Leverage Predictive Uncertainty to Detect Dataset Shift and Adversarial Examples in Android Malware Detection?
• On the Detection of Adaptive Adversarial Attacks in Speaker Verification Systems
• MASKDROID: Robust Android Malware Detection with Masked Graph Representations
• Optimal Feature Manipulation Attacks Against Linear Regression
• Evaluating the robustness of adversarial defenses in malware detection systems