PAD: Towards Principled Adversarial Malware Detection Against Evasion Attacks

Abstract

Machine Learning (ML) techniques can facilitate the automation of malicious software (malware for short) detection, but suffer from evasion attacks. Many studies counter such attacks in heuristic manners, lacking theoretical guarantees and defense effectiveness. In this paper, we propose a new adversarial training framework, termed Principled Adversarial Malware Detection (PAD), which offers convergence guarantees for robust optimization methods. PAD lays on a learnable convex measurement that quantifies distribution-wise discrete perturbations to protect malware detectors from adversaries, whereby for smooth detectors, adversarial training can be performed with theoretical treatments. To promote defense effectiveness, we propose a new mixture of attacks to instantiate PAD to enhance deep neural network-based measurements and malware detectors. Experimental results on two Android malware datasets demonstrate: (i) the proposed method significantly outperforms the state-of-the-art defenses; (ii) it can harden ML-based malware detection against 27 evasion attacks with detection accuracies greater than 83.45%, at the price of suffering an accuracy decrease smaller than 2.16% in the absence of attacks; (iii) it matches or outperforms many anti-malware scanners in VirusTotal against realistic adversarial malware.

arXiv commentAccepted by IEEE Transactions on Dependable and Secure Computing; To appear

References in corpus (19)

• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Ensemble Adversarial Training: Attacks and Defenses
• On Calibration of Modern Neural Networks
• Evasion Attacks against Machine Learning at Test Time
• A Convergence Theory for Deep Learning via Over-Parameterization
• Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
• On the Convergence and Robustness of Adversarial Training
• One-Class Convolutional Neural Network
• Functionality-preserving Black-box Optimization of Adversarial Windows Malware
• Adversarial Deep Ensemble: Evasion Attacks and Defenses for Malware Detection
• Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection
• Deep Learning for Android Malware Defenses: a Systematic Literature Review
• A Framework for Enhancing Deep Neural Networks Against Adversarial Malware
• Arms Race in Adversarial Malware Detection: A Survey
• DLA: Dense-Layer-Analysis for Adversarial Example Detection
• HashTran-DNN: A Framework for Enhancing Robustness of Deep Neural Networks against Adversarial Malware Samples
• An Evasion and Counter-Evasion Study in Malicious Websites Detection
• On the Generalization Properties of Adversarial Training

Cited by in corpus (1)

• Evaluating the robustness of adversarial defenses in malware detection systems