Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN

By Weiwei Hu, Ying Tan. International Conference on Data Mining and Big Data, 2017

540 citations recorded by the source corpus.

Machine learning has been used to detect new malware in recent years, while malware authors have strong motivation to attack such algorithms. Malware authors usually have no access to the detailed structures and parameters of the machine learning models used by malware detection systems, and therefore they can only perform black-box attacks. This paper proposes a generative adversarial network (GAN) based algorithm named MalGAN to generate adversarial malware examples, which are able to bypass black-box machine learning based detection models. MalGAN uses a substitute detector to fit the black-box malware detection system. A generative network is trained to minimize the generated adversarial examples' malicious probabilities predicted by the substitute detector. The superiority of MalGAN over traditional gradient based adversarial example generation algorithms is that MalGAN is able to decrease the detection rate to nearly zero and make the retraining based defensive method against adversarial examples hard to work.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/86e5827087e11dc929d592ee7b3d7581fc48265e

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Dacheng Tao
2. Bo Li
3. Jiliang Tang
4. Liang Tong
5. Chen Hajaj
6. Chaowei Xiao
7. Yevgeniy Vorobeychik
8. Hui Liu

In Computer Networks and Communications

1. Liang Tong
2. Chen Hajaj
3. Bo Li
4. Yevgeniy Vorobeychik
5. Chaowei Xiao
6. Jun Zhang
7. Dacheng Tao
8. Erik Poll

In Signal Processing

1. Liang Tong
2. Chen Hajaj
3. Bo Li
4. Yevgeniy Vorobeychik
5. Dacheng Tao
6. Chaowei Xiao
7. Erik Poll
8. Jie Gui

Citations in the corpus

• The AI-Based Cyber Threat Landscape (2020, methodology): “Tan [43] demonstrated a black-box attack using GAN to transform original samples into adversarial examples, which are more complex and effective at fooling the ML-based malware detection algorithms.”
• A Survey on Generative Adversarial Networks: Variants, Applications, and Training (2020, methodology): “GANs have also been used in variety of other domains such as computer security [175], chess game playing [176], network pruning [177, 178], spatial representation learning [179], mobile user profiling [180], data augmentation [181, 182], heterogeneous information networks [183], privacypreserving [1”
• Hardening Classifiers against Evasion: the Good, the Bad, and the Ugly (2017, methodology): “3) MalGAN: MalGAN [14] is a Generative Adversarial Network (GAN) [9] framework to generate malware examples which can evade a black-box malware detector with binary features.”
• The relationship between trust in AI and trustworthy machine learning technologies (2019, background): “Careless preparation of the stored data would leak information to an attacker [61] but confidentiality can be enhanced in many ways, for instance through approaches for differential privacy [1, 34], homomorphic encryption [47] or cryptography integrated in machine learning algorithms [79].”
• Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection (2018, methodology): “In additions, the works [8], [16], [17] used binary features to indicate the presence of a certain permission or API.”
• IDSGAN: Generative Adversarial Networks for Attack Generation against Intrusion Detection (2018, background): “GAN has been implemented in attacks within information security, like malware generation, author attribute anonymity, and password guessing [5,12,4,9].”
• A Review on Generative Adversarial Networks: Algorithms, Theory, and Applications (2020, methodology): “GANs have been widely used in many other areas such as malware detection [434], chess game playing [435], steganography [436]–[439], privacy-preserving [440]–[442], social robot [443], and network pruning [444], [445].”
• Generative Adversarial Networks (GANs) (2020, background): “[237] proposed to produce GANs based malware which can sidestep the black-box machine learning based detection models.”
• Adversarial Attacks and Defenses in Images, Graphs and Text: A Review (2019, methodology): “The work [130] built a DNN model on the DREBIN dataset[131], which contains 120 000 Android application samples, where over 5 000 are malware samples.”
• Adversarial Examples on Object Recognition (2020, methodology): “The term adversarial examples was first used to describe such inputs by Szegedy et al. [161].”