Adversary Resistant Deep Neural Networks with an Application to Malware Detection

By Qinglong Wang, Wenbo Guo, Kaixuan Zhang, Alexander Ororbia, Xinyu Xing, Xue Liu, C. Lee Giles. 2016

181 citations recorded by the source corpus.

Outside the highly publicized victories in the game of Go, there have been numerous successful applications of deep learning in the fields of information retrieval, computer vision, and speech recognition. In cybersecurity, an increasing number of companies have begun exploring the use of deep learning (DL) in a variety of security tasks with malware detection among the more popular. These companies claim that deep neural networks (DNNs) could help turn the tide in the war against malware infection. However, DNNs are vulnerable to adversarial samples, a shortcoming that plagues most, if not all, statistical and machine learning models. Recent research has demonstrated that those with malicious intent can easily circumvent deep learning-powered malware detection by exploiting this weakness. To address this problem, previous work developed defense mechanisms that are based on augmenting training data or enhancing model complexity. However, after analyzing DNN susceptibility to adversarial samples, we discover that the current defense mechanisms are limited and, more importantly, cannot provide theoretical guarantees of robustness against adversarial sampled-based attacks. As such, we propose a new adversary resistant technique that obstructs attackers from constructing impactful adversarial samples by randomly nullifying features within data vectors. Our proposed technique is evaluated on a real world dataset with 14,679 malware variants and 17,399 benign programs. We theoretically validate the robustness of our technique, and empirically show that our technique significantly boosts DNN robustness to adversarial samples while maintaining high accuracy in classification. To demonstrate the general applicability of our proposed method, we also conduct experiments using the MNIST and CIFAR-10 datasets, widely used in image recognition research.

Subfields: Artificial Intelligence, Computer Networks and Communications, Safety, Robustness & Interpretability, Privacy & Security, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Safety, Robustness & Interpretability

In Privacy & Security

In Signal Processing

Citations in the corpus

Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks (2019, methodology): “In the security space, DNNs are used for everything from malware classification [1], [2], to binary reverseengineering [3], [4] and network intrusion detection [5].”
STRIP: a defence against trojan attacks on deep neural networks (2019, background): “Machine learning (ML) models are increasingly deployed to make decisions on our behalf on various (mission-critical) tasks such as computer vision, disease diagnosis, financial fraud detection, defending against malware and cyber-attacks, access control, surveillance and so on [20, 32, 35].”
Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification (2017, methodology): “each noisy example; and we take a majority vote among the noisy examples to predict the label of the testing example. We note that randomization-based defense was used as a feature preprocessing step [38, 39] to enhance robustness of DNNs. However, our work is di‡erent these defenses in two aspects.”
Motivating the Rules of the Game for Adversarial Example Research (2018, background): “…[99] as permitted by the Creative Commons Licence (CC BY-ND 2.0, https://creativecommons.org/licenses/by-nd/2.0/). which speciﬁcally consider defense strategies for increasing neural network robustness to restricted l 0 changes to a feature vector constructed from a malware binary [91, 101].”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, background): “[121], [128] developed adversary resistant neural networks by leveraging non-invertible data transformation in the network.”
Towards Fast Computation of Certified Robustness for ReLU Networks (2018, background): “, 2017), malware detection (Wang et al., 2017) and reading comprehension (Jia & Liang, 2017).”
Adversarial examples for models of code (2019, methodology): “For example, a malicious developer can spread malicious code to users by having the code classified as łbenignž by a malware detection model [Arp et al. 2014; David et al. 2019; Grosse et al. 2016; Saxe and Berlin 2015; Wang et al. 2017].”
Februus: Input Purification Defence Against Trojan Attacks on Deep Neural Network Systems (2019, background): “Consequently, deep neural network (DNN) systems are increasingly entrusted to make critical decisions on our behalf in self-driving cars [6], disease diagnosis [15], facial recognition [22, 23], malware detection [25] and so on.”
LEMNA: Explaining Deep Learning based Security Applications (2018, background): “[68] propose an adversarial resistant neural network for detecting malware based on audit logs [7].”
Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detection (2019, background): “Less clear, however, is whether today’s DNNs can meet the high assurance bar set by security-critical applications such as self-driving [29], malware classification [37], intrusion detection [35], digital forensics [18], etc.”
Evaluation and Design of Robust Neural Network Defenses (2018, unknown): “, 2017 [128] Malware 26,000 Dynamic Yes -”
With Great Training Comes Great Vulnerability: Practical Attacks against Transfer Learning (2018, background): “, sensitivity to model uncertainty, neuron value distribution [64, 31, 27, 37, 25].”