Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detection

By Ambra Demontis, Marco Melis, Battista Biggio, Davide Maiorca, Daniel Arp, Konrad Rieck, Igino Corona, Giorgio Giacinto, Fabio Roli. 2017

307 citations recorded by the source corpus.

To cope with the increasing variability and sophistication of modern attacks, machine learning has been widely adopted as a statistically-sound tool for malware detection. However, its security against well-crafted attacks has not only been recently questioned, but it has been shown that machine learning exhibits inherent vulnerabilities that can be exploited to evade detection at test time. In other words, machine learning itself can be the weakest link in a security system. In this paper, we rely upon a previously-proposed attack framework to categorize potential attack scenarios against learning-based malware detection tools, by modeling attackers with different skills and capabilities. We then define and implement a set of corresponding evasion attacks to thoroughly assess the security of Drebin, an Android malware detector. The main contribution of this work is the proposal of a simple and scalable secure-learning paradigm that mitigates the impact of evasion attacks, while only slightly worsening the detection rate in the absence of attack. We finally argue that our secure-learning approach can also be readily applied to other malware detection tasks.

Subfields: Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Privacy & Security

Citations in the corpus

Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning (2017, methodology): “…(poisoning attacks) [22–31] and at test time (evasion attacks) [18– 20, 28, 32–37]; ( ii ) propose systematic methodologies for security evaluation of learning algorithms against such attacks [37– 41]; and ( iii ) design suitable defense mechanisms to mitigate these threats [11, 18, 33, 42–46].”
Adversarial Detection of Flash Malware: Limitations and Open Issues (2017, methodology): “ction, and f^is the surrogate classier estimated by the attacker. Concerning Eq. (1), note that here samples can be optimized one at a time, as they can be independently modied. As in previous work [9, 8, 21], we rst simulate the attack at the feature level, i.e., we directly manipulate the feature ”
Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning Attacks (2018, methodology): “icious code has to be modiﬁed without compromising its intrusive functionality. This may be done against systems leveraging static code analysis, by injecting instructions that will never be executed [11,15,45]. These constraints can be generally accounted forin the deﬁnition of the optimalattack st”
A Multimodal Deep Learning Method for Android Malware Detection Using Various Features (2019, methodology): “The malware detection approaches can be classified into two categories; static analysis based detection [2]–[19] and dynamic analysis based detection [20]–[24].”
The relationship between trust in AI and trustworthy machine learning technologies (2019, unknown): “, in the training stage [26, 13, 11, 61, 85].”
Intriguing Properties of Adversarial ML Attacks in the Problem Space (2019, methodology): “First, similarly to [11, 23], we define the space of available transformations.”
Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection (2018, background): “As explained in Section I, existing works [7]–[9], [16], [37] will not work properly when recent detectors relied more on semantic features.”
Explaining Black-box Android Malware Detection (2018, methodology): “onlinear (including non-differentiable) classiﬁers trained on the features used by Drebin. As we will see, this will also reveal some insights on their security against adversarial manipulations [6], [8]. Datasets. We use here the Drebin data [1], consisting of 121;329 benign applications and 5;615 ”
Malware Detection in Adversarial Settings: Exploiting Feature Evolutions and Confusions in Android Apps (2017, methodology): “Figure 5 presents the detection results of AppContext’s malware detection 16 .”
Towards Adversarial Malware Detection (2018, methodology): “Even though, to our knowledge, such attacks have never been considered in the context of PDF malware detection, we discuss here how they can be used to pose new threats to PDF malware detectors.”
A Survey on Security Threats and Defensive Techniques of Machine Learning: A Data Driven View (2018, methodology): “[82] proposed a defending method that improved the security of linear classifiers by learning more evenly-distributed feature weights.”