Being Single Has Benefits. Instance Poisoning to Deceive Malware Classifiers

Abstract

The performance of a machine learning-based malware classifier depends on the large and updated training set used to induce its model. In order to maintain an up-to-date training set, there is a need to continuously collect benign and malicious files from a wide range of sources, providing an exploitable target to attackers. In this study, we show how an attacker can launch a sophisticated and efficient poisoning attack targeting the dataset used to train a malware classifier. The attacker's ultimate goal is to ensure that the model induced by the poisoned dataset will be unable to detect the attacker's malware yet capable of detecting other malware. As opposed to other poisoning attacks in the malware detection domain, our attack does not focus on malware families but rather on specific malware instances that contain an implanted trigger, reducing the detection rate from 99.23% to 0% depending on the amount of poisoning. We evaluate our attack on the EMBER dataset with a state-of-the-art classifier and malware samples from VirusTotal for end-to-end validation of our work. We propose a comprehensive detection approach that could serve as a future sophisticated defense against this newly discovered severe threat.

References in corpus (13)

• Intriguing properties of neural networks
• A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networks
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Survey of Machine Learning Techniques for Malware Analysis
• Deep Anomaly Detection with Outlier Exposure
• Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
• A Field Guide to Forward-Backward Splitting with a FASTA Implementation
• Generative Poisoning Attack Method Against Neural Networks
• EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models
• Deceiving End-to-End Deep Learning Malware Detectors using Adversarial Examples
• Explanation-Guided Backdoor Poisoning Attacks Against Malware Classifiers