Black-Box Attacks against RNN based Malware Detection Algorithms

By Weiwei Hu, Ying Tan. 2017

163 citations recorded by the source corpus.

Recent researches have shown that machine learning based malware detection algorithms are very vulnerable under the attacks of adversarial examples. These works mainly focused on the detection algorithms which use features with fixed dimension, while some researchers have begun to use recurrent neural networks (RNN) to detect malware based on sequential API features. This paper proposes a novel algorithm to generate sequential adversarial examples, which are used to attack a RNN based malware detection system. It is usually hard for malicious attackers to know the exact structures and weights of the victim RNN. A substitute RNN is trained to approximate the victim RNN. Then we propose a generative RNN to output sequential adversarial examples from the original sequential malware inputs. Experimental results showed that RNN based malware detection algorithms fail to detect most of the generated malicious adversarial examples, which means the proposed model is able to effectively bypass the detection algorithms.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Huan Zhang
2. Cho-Jui Hsieh
3. Pin-Yu Chen
4. Jinfeng Yi
5. Yash Sharma
6. W. Zhang
7. Chenliang Li
8. Quan.Z Sheng

In Computer Networks and Communications

1. Quan.Z Sheng
2. Pin-Yu Chen
3. Cho-Jui Hsieh
4. Zhi Xue
5. Chenliang Li
6. Jinfeng Yi
7. W. Zhang
8. Huan Zhang

In Signal Processing

1. Cho-Jui Hsieh
2. Huan Zhang
3. Quan.Z Sheng
4. Pin-Yu Chen
5. Zhi Xue
6. Chenliang Li
7. Jinfeng Yi
8. W. Zhang

Citations in the corpus

• ZOO: Zeroth Order Optimization Based Black-box Attacks to Deep Neural Networks without Training Substitute Models (2017, methodology): “Under this black-box setting, the methodology of current attacks concentrates on training a substitute model and using it as a surrogate for adversarial attacks [8, 16, 17, 26, 34, 35].”
• Adversarial Reprogramming of Text Classification Neural Networks (2018, unknown): “, 2015) and discrete input spaces (Papernot et al., 2016c; Hu and Tan, 2018; Yang et al., 2018).”
• IDSGAN: Generative Adversarial Networks for Attack Generation against Intrusion Detection (2018, methodology): “Hu also leveraged a new model to generate some adversarial API sequences which would be inserted into the original API sequences of malware to form the attacks, aiming at bypassing Recurrent Neural Networks (RNN) detection systems (Hu and Tan 2017a).”
• Adversarial Attacks on Deep Learning Models in Natural Language Processing: A Survey (2019, methodology): “Substitution [53] API N LSTM, BiLSTM and variants – MD”