Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables

By Bojan Kolosnjaji, Ambra Demontis, Battista Biggio, Davide Maiorca, Giorgio Giacinto, Claudia Eckert, Fabio Roli. 2018

354 citations recorded by the source corpus.

Machine learning has already been exploited as a useful tool for detecting malicious executable files. Data retrieved from malware samples, such as header fields, instruction sequences, or even raw bytes, is leveraged to learn models that discriminate between benign and malicious software. However, it has also been shown that machine learning and deep neural networks can be fooled by evasion attacks (also known as adversarial examples), i.e., small changes to the input data that cause misclassification at test time. In this work, we investigate the vulnerability of malware detection methods that use deep networks to learn from raw bytes. We propose a gradient-based attack that is capable of evading a recently-proposed deep network suited to this purpose by only changing few specific bytes at the end of each mal ware sample, while preserving its intrusive functionality. Promising results show that our adversarial malware binaries evade the targeted network with high probability, even though less than 1 % of their bytes are modified.

Subfields: Artificial Intelligence, Software, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Software

In Signal Processing

Citations in the corpus

Adversarial Detection of Flash Malware: Limitations and Open Issues (2017, background): “er adversarial environments. These assessments have been recently expanded to systems for Android malware detection [21, 22, 23, 47, 18] and to binary executables (with the adoption of deep learning) [48, 49]. 4. FlashBuster Architecture FlashBuster is a static, machine learning-based system whose a”
Intriguing Properties of Adversarial ML Attacks in the Problem Space (2019, background): “malware [38, 60], NIDS [6, 7, 20, 28], ICS [76], source”
A Survey on Machine Learning Techniques for Cyber Security in the Last Decade (2020, neutral): “Machine learning techniques were not primarily designed to work with cyber security so an evasion can easily fool the ML [597]–[599].”
Adversarial examples for models of code (2019, background): “[2019] and Kolosnjaji et al. [2018] addressed binary classifiers (whether or not the program is malicious) of binary code, by adding noisy bytes to the original file’s raw bytes.”
Towards Adversarial Malware Detection (2018, background): “The aforementioned optimization problem is usually solved by projected gradient descent [8, 9], and it has been used in follow-up work to generate adversarial PDF malware [83, 96], adversarial binaries [51] and adversarial images against deep networks [66].”
Are aligned neural networks adversarially aligned? (2023, background): “For example, an adversary might try to construct inputs that evade machine learning models used for content filtering [Tram`er et al., 2019, Welbl et al., 2021] or malware detection [Kolosnjaji et al., 2018], and so designing robust classifiers is important to prevent a real attack.”
Exploring Backdoor Poisoning Attacks Against Malware Classifiers (2020, background): “The former class has been extensively explored in the context of computer vision [16], and previous research efforts in this direction have also investigated the applicability of such techniques to malware classification [11, 25, 30, 46, 55].”
A Comprehensive Review on Malware Detection Approaches (2020, background): “Kolosnjaji et al. investigated the vulnerabilities of malware detection methods that use deep networks to learn from raw bytes [96].”