EvadeDroid: A Practical Evasion Attack on Machine Learning for Black-box Android Malware Detection

Abstract

Over the last decade, researchers have extensively explored the vulnerabilities of Android malware detectors to adversarial examples through the development of evasion attacks; however, the practicality of these attacks in real-world scenarios remains arguable. The majority of studies have assumed attackers know the details of the target classifiers used for malware detection, while in reality, malicious actors have limited access to the target classifiers. This paper introduces EvadeDroid, a problem-space adversarial attack designed to effectively evade black-box Android malware detectors in real-world scenarios. EvadeDroid constructs a collection of problem-space transformations derived from benign donors that share opcode-level similarity with malware apps by leveraging an n-gram-based approach. These transformations are then used to morph malware instances into benign ones via an iterative and incremental manipulation strategy. The proposed manipulation technique is a query-efficient optimization algorithm that can find and inject optimal sequences of transformations into malware apps. Our empirical evaluations, carried out on 1K malware apps, demonstrate the effectiveness of our approach in generating real-world adversarial examples in both soft- and hard-label settings. Our findings reveal that EvadeDroid can effectively deceive diverse malware detectors that utilize different features with various feature types. Specifically, EvadeDroid achieves evasion rates of 80%-95% against DREBIN, Sec-SVM, ADE-MA, MaMaDroid, and Opcode-SVM with only 1-9 queries. Furthermore, we show that the proposed problem-space adversarial attack is able to preserve its stealthiness against five popular commercial antiviruses with an average of 79% evasion rate, thus demonstrating its feasibility in the real world.

The paper was accepted by Elsevier Computers & Security on 20 December 2023

References in corpus (14)

• On Evaluating Adversarial Robustness
• Security Evaluation of Pattern Classifiers under Attack
• Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
• Learning to Evade Static PE Machine Learning Malware Models via Reinforcement Learning
• Functionality-preserving Black-box Optimization of Adversarial Windows Malware
• Adversarial Deep Ensemble: Evasion Attacks and Defenses for Malware Detection
• Deceiving End-to-End Deep Learning Malware Detectors using Adversarial Examples
• Robust Android Malware Detection System against Adversarial Attacks using Q-Learning
• Adversarial Samples on Android Malware Detection Systems for IoT Systems
• A Framework for Enhancing Deep Neural Networks Against Adversarial Malware
• Adversarial Detection of Flash Malware: Limitations and Open Issues
• COPYCAT: Practical Adversarial Attacks on Visualization-Based Malware Detection
• OFEI: A Semi-black-box Android Adversarial Sample Attack Framework Against DLaaS
• When the Guard failed the Droid: A case study of Android malware

Cited by in corpus (3)

• WebAssembly Diversification for Malware Evasion
• Evaluating the robustness of adversarial defenses in malware detection systems
• Decoding Android Malware with a Fraction of Features: An Attention-Enhanced MLP-SVM Approach