Source-linked AI summary
Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
Weiwei Hu, Ying Tan
TL;DR
Machine-learning malware detectors are vulnerable to intentional attacks, yet attackers generally cannot access their internal models. MalGAN trains a generator against a substitute detector using black-box feedback, and its adversarial examples reduce detection to nearly zero, although GAN training is unstable.
Problem
Machine-learning malware detectors are often black boxes to malware authors, while prior work has focused more on detection performance than robustness to intentional attacks.
Method
MalGAN fits a substitute detector to the black-box detector and trains a generator to transform malware into adversarial examples with lower predicted malicious probability.
Results
TPR falls to zero for several classifiers and to 0.16%–0.20% for random forests and decision trees on generated adversarial examples.
Takeaways & Limitations
MalGAN can effectively bypass black-box malware detectors, including when the detector is trained on different data.
Takeaways & Limitations
The reported TPR convergence curve is unstable and shaking, reflecting the usual instability of GAN training.
Abstract
from arXiv · showhide
Machine learning has been used to detect new malware in recent years, while malware authors have strong motivation to attack such algorithms. Malware authors usually have no access to the detailed structures and parameters of the machine learning models used by malware detection systems, and therefore they can only perform black-box attacks. This paper proposes a generative adversarial network (GAN) based algorithm named MalGAN to generate adversarial malware examples, which are able to bypass black-box machine learning based detection models. MalGAN uses a substitute detector to fit the black-box malware detection system. A generative network is trained to minimize the generated adversarial examples' malicious probabilities predicted by the substitute detector. The superiority of MalGAN over traditional gradient based adversarial example generation algorithms is that MalGAN is able to decrease the detection rate to nearly zero and make the retraining based defensive method against adversarial examples hard to work.
1 Introduction
Malware detectors increasingly use machine learning, but their robustness to intentional attacks is a critical concern because deployed systems are typically black boxes to malware authors. MalGAN addresses this gap with a generative approach for producing adversarial malware examples.
- Machine-learning malware detectors classify programs using features such as DLLs, APIs, strings, or byte-level N-Grams.
- Attackers are motivated to bypass malware detectors, while detector research has emphasized true positive rate, accuracy, and AUC more than robustness.
- Prior adversarial-malware work used gradient-based methods under a white-box assumption, whereas black-box attacks can use substitute models or transferability.
- Deployed malware detectors are usually black-box systems whose classifier architecture and parameters are unavailable to malware authors.
- MalGAN uses a generative neural network to transform original malware samples into more complex adversarial examples for fooling target models.
- Almost all adversarial examples generated by MalGAN bypass detection algorithms, and the method remains flexible against further defensive methods.
2 Architecture of MalGAN
MalGAN combines a generator with a substitute detector to attack a black-box malware detector using feedback and dynamically generated adversarial examples. For binary features, it adds irrelevant features while preserving features needed for malware functionality.
- 2.1 Overview: MalGAN contains a generator and a feed-forward substitute detector that work together against an external black-box malware detector.
- 2.1 Overview: The attacker is assumed to know the detector’s feature type and receive detection results, but not its algorithm or trained parameters.
- 2.1 Overview: Unlike static gradient-based approaches, MalGAN dynamically generates adversarial examples from black-box detector feedback.
- 2.2 Generator: The generator takes malware vector m and noise vector z as input, allowing diverse adversarial examples from one malware sample.
- 2.2 Generator: For binary features, the generator binarizes sigmoid outputs and adds selected irrelevant features without removing original malware features.
- 2.2 Generator: A smooth max-based function preserves existing active features while allowing gradients through inactive dimensions to train the generator.
- 2.3 Substitute Detector: The substitute detector predicts the probability that an input feature vector is malware and supplies gradient information for generator training.
3 Training MalGAN
MalGAN alternates between fitting a substitute detector to black-box labels and training a generator to reduce the substitute detector’s malicious predictions. This iterative process uses generated malware, benign programs, and black-box feedback.
- MalGAN training begins with malware and benign datasets, then repeatedly samples minibatches from both.
- The substitute detector’s loss is minimized with respect to its weights so it fits black-box detector outputs.
- The generator’s loss is minimized with respect to generator weights using actual malware samples and uniform noise.
- Reducing the generator loss lowers predicted malicious probability and pushes the substitute detector toward benign classifications, further fooling the black-box detector.
- The algorithm alternates weight updates for the substitute detector and generator until convergence.
- The black-box detector labels generated malware and benign programs, providing targets for substitute-detector training.
4 Experiments
Experiments evaluate MalGAN on API-based binary malware features against multiple black-box classifiers, under shared and separate training data. MalGAN generally reduces adversarial-example detection to near zero, though random forests and decision trees remain harder to fool and GAN training is unstable.
- Experimental setup: 180 thousand programs were crawled, with about 30% malware, and represented using 160-dimensional binary vectors of system-level API features.The experiments used two training-data splits: shared data and separate data for MalGAN and the black-box detector.
- Experimental setup: Six black-box classifier settings were evaluated: random forest, logistic regression, decision trees, support vector machines, multi-layer perceptron, and a voting ensemble.The classifiers were used to validate transferability across different detector types.
- Same training set: TPRs on random-forest and decision-tree adversarial examples were 0.16%–0.20% on both training and test sets, while original-sample TPRs exceeded 93%.For the other classifiers, MalGAN reduced adversarial-example TPR to zero on both sets.
- Different training sets: Decision-tree TPRs rose to 2.18% on the training set and 2.11% on the test set when MalGAN and the detector used different training data.SVM, MLP, and VOTE reached zero TPR, while LR was nearly zero; the authors still report that most adversarial malware examples evaded detection.
- Gradient-based comparison: TPR converged to 93.52% on training data and 90.96% on test data when the substitute neural network was not retrained on adversarial examples.The substitute detector therefore failed to approximate the black-box random forest on the shifted adversarial-example distribution.
- Gradient-based comparison: Retraining the substitute detector reduced random-forest TPR to 46.18% on training data but left test-set TPR at 90.12%.The authors attribute poor generalization to the unusual probability distribution of the adversarial examples.
- Gradient-based comparison: MalGAN produced nearly zero TPR on both training and test sets, whereas the gradient-based approach had limited representation ability for complex adversarial examples.Its generative network transforms original samples into adversarial samples using neural-network representation capacity.
- Retraining defense: After black-box-detector retraining, it detected all adversarial examples, but retraining MalGAN reduced TPR from 100% to 0% within one epoch.Alternating detector and MalGAN retraining ten times produced the same results as Table 3.
5 Conclusions
MalGAN generates adversarial examples against black-box malware detectors by fitting a substitute detector and training a generator to fool it. Its retraining mechanism continually changes adversarial-example distributions, making stable detection difficult.
- MalGAN fits a substitute detector to a black-box malware detector and trains a generator to produce examples that fool the substitute.
- MalGAN’s generated adversarial examples effectively bypass the black-box detector.
- Retraining MalGAN frequently changes the adversarial examples’ probability distribution, preventing the black-box detector from learning stable patterns.