PaperlayerView exact revision on arXiv

Source-linked AI summary

Evading Classifiers by Morphing in the Dark

Hung Dang, Yue Huang, Ee-Chien Chang

arXiv:1705.07535v3cs.CR

TL;DR

The paper studies whether classifiers can still be evaded when attackers have only binary detector decisions and blackbox morphing. It introduces a binary-outcome scoring mechanism and hill-climbing method, EvadeHC, and reports 100% evasion on its evaluation dataset.

  • Problem

    Prior evasion work considered attackers with model knowledge or access to real-valued classifier scores, leaving the binary-decision-only setting an open question.

    Source: §1 · p. 1

  • Method

    EvadeHC uses a real-valued progress score derived from binary detector and tester outcomes to guide hill-climbing under blackbox access.

    Source: §1 · pp. 1–2

  • Results

    100% evasion rate on the experimental dataset, and EvadeHC outperformed the random-morphing baseline by up to 80 times in execution cost.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Experiments on PDF malware classifiers show that evasion can remain effective with binary-only detector access and blackbox morphing.

    Source: §1 · p. 2, §8 · p. 13

    The binary-search variant assumes that samples are unlikely to revert after becoming benign or accepted; a reversion can yield a wrong flipping sample on that path.

    Source: §3.2 · p. 5

Abstract

from arXiv · show

Learning-based systems have been shown to be vulnerable to evasion through adversarial data manipulation. These attacks have been studied under assumptions that the adversary has certain knowledge of either the target model internals, its training dataset or at least classification scores it assigns to input samples. In this paper, we investigate a much more constrained and realistic attack scenario wherein the target classifier is minimally exposed to the adversary, revealing on its final classification decision (e.g., reject or accept an input sample). Moreover, the adversary can only manipulate malicious samples using a blackbox morpher. That is, the adversary has to evade the target classifier by morphing malicious samples "in the dark". We present a scoring mechanism that can assign a real-value score which reflects evasion progress to each sample based on the limited information available. Leveraging on such scoring mechanism, we propose an evasion method -- EvadeHC -- and evaluate it against two PDF malware detectors, namely PDFRate and Hidost. The experimental evaluation demonstrates that the proposed evasion attacks are effective, attaining $100\%$ evasion rate on the evaluation dataset. Interestingly, EvadeHC outperforms the known classifier evasion technique that operates based on classification scores output by the classifiers. Although our evaluations are conducted on PDF malware classifier, the proposed approaches are domain-agnostic and is of wider application to other learning-based systems.

1. INTRODUCTION

The paper studies evasion when a detector reveals only accept/reject decisions and the attacker can manipulate samples only through a blackbox morpher. It introduces a binary-outcome scoring mechanism and EvadeHC, then evaluates the approach on PDF malware classifiers.

1. INTRODUCTION

  • The attacker has no model or training-data knowledge, sees only final decisions, and manipulates malicious samples through a blackbox morpher.The formulation confines the attacker to a binary detector, a tester for malicious functionality, and a morpher.Source: §1 · p. 1
  • 100% evasion rate on the experimental dataset, with EvadeHC outperforming the random-morphing baseline by up to 80 times in execution cost.On hardened Hidost at threshold −0.75 with 2,500 detector queries, it attained 62% evasion versus 8% for the baseline.Source: §1 · p. 2
  • The scoring mechanism assigns each sample a real-valued evasion-progress score using only binary outcomes from the detector and tester.It estimates progress from the morphing steps required to change the two systems’ decisions.Source: §1 · p. 2
  • EvadeHC is a hill-climbing evasion method designed to work without domain-specific knowledge of the morphing or detection mechanisms.The paper frames its approach as generic under the restricted blackbox setting.Source: §1 · p. 2
  • The evaluation on PDFRate and Hidost suggests that EvadeHC’s scoring mechanism is more informative than a technique relying on classifier scores.The approach is also reported to outperform Xu et al., despite using only binary detector outputs.Source: §1 · p. 2

2. PROBLEM FORMULATION

The formulation models evasion as searching through blackbox detector, tester, and morpher interactions for a malicious sample that the detector accepts. It defines the path-based quantities used to identify evasion and describes the information and manipulation challenges under restricted access.

2.1 Motivating Scenario

  • The motivating scenario is an attacker probing an email malware detector with limited queries while modifying a malicious PDF and checking that it retains functionality.The detector and morphing tool are blackboxes; a sandbox tests functionality, and probing may be limited before blacklisting.Source: §2.1 · p. 2
  • The attacker’s task is to search adaptively using three blackboxes: a binary accept/reject detector, a functionality tester, and a morpher.The detector’s decisions are deterministic, and a sample evades when the detector accepts it while the tester still identifies it as malicious.Source: §2.1 · p. 3, §2.2 · p. 3

2.3 Morpher M

  • The morpher takes a sample and random seed and deterministically produces another sample; repeated calls form a path from a starting sample to an endpoint.The formulation permits domain-specific manipulation, but its random-morphing model captures settings where useful domain properties cannot be exploited.Source: §2.3 · p. 3

2.4 Adversary’s Goal and Performance Cost

  • The goal is to find an evading sample at minimum cost, with search strategies prioritizing detector queries before tester and morpher queries.Detector access may be bounded or costly, while tester queries can also be computationally intensive.Source: §2.4 · p. 3

2.5 Flipping Samples and Gap

  • The malice-flipping distance m_x and reject-flipping distance r_x count steps to the first benign and first accepted samples; a negative gap r_x − m_x identifies an evading sample.The formulation assumes samples do not revert to malicious or rejected after flipping.Source: §2.5 · p. 3

2.6 Challenges in Evasion in the Dark

  • Figure 1 illustrates that the relative order of the two flipping distances determines whether the reject-flipping sample remains malicious.In panel (b), the gap is negative and x3 is evading.Source: Figure 1 · p. 4
  • Binary detector outputs do not indicate which malicious sample is closer to evasion, and blackbox morphing makes it difficult to construct useful samples between two given samples.Even if a connecting path can be found, whether its samples have higher evasion chances remains unclear.Source: §2.6 · p. 4

3. PROPOSED EVASION METHODS

The methods progress from random sequential search to binary-search optimization and then hill-climbing guided by scores from detector and tester outcomes. EvadeHC further reduces detector queries using branch-and-bound to retain high-scoring candidates.

3.1 Evasion by Exhaustive Search SeqRand

  • SeqRand repeatedly morphs a rejected malicious sample along random seeds and checks successive samples with the detector and tester until it finds an evading sample.The process repeats with new seed sequences if one sequence of L steps finds no evading sample.Source: §3.1 · p. 4

3.2 Evasion by Binary Search BiRand

  • BiRand binary-searches each path for the malice-flipping point, tests its malicious predecessor with the detector, and repeats until it finds an evading sample.It uses at most ⌈log2 L⌉ tester queries and one detector query per path; its binary search assumes benign or accepted samples are unlikely to revert.Source: §3.2 · pp. 4–5

3.3 Evasion by Hill-Climbing EvadeHC0

  • EvadeHC0 generates paths from retained candidates, scores samples using flipping distances, and keeps the q2 highest-scoring candidates for the next iteration.The jump factor Δ determines how far along each path a candidate is selected.Source: §3.3 · p. 5

3.4 Enhanced Evasion by Hill-Climbing EvadeHC

  • EvadeHC uses branch-and-bound to find the score threshold separating the top q2 candidates, reducing detector queries relative to EvadeHC0.The reduction applies when the scoring function decreases with reject-flipping distance, as do score1 and score2.Source: §3.3 · p. 5, §3.4 · pp. 5–6

4. PROBABILISTIC MODELS

The section models evasion progress using hidden states and binary outcomes from the detector and tester. It also analyzes a random-morpher setting in which hill-climbing can lose its advantage.

4.1 States Representation

  • A sample’s state is Pr(Gx < 0), the probability that a random path leads to an evading sample; higher-state candidates offer a higher chance of finding one.An alternative probability based on any evading sample on a path is unsuitable because arbitrarily long paths are likely to contain one.Source: §4.1 · p. 6
  • Because estimating the evading probability directly is costly, EvadeHC uses estimated expected flipping distances and their gap as a lower-cost comparison proxy.The paper motivates score1 and score2 as ways to compare this expected gap; smaller expected gaps suggest higher evasion probability.Source: §4.1 · p. 6

4.2 Hidden-State Random Morpher

  • HsrMorpher models a morpher that produces random outcomes for new queries while repeating prior outputs, and assigns hidden states that determine tester and detector decisions.The model formalizes a setting where the adversary cannot exploit domain knowledge about how to transform samples.Source: §4.2 · pp. 6–7

4.3 Analysis of EvadeHC on HsrMorpher

  • HsrMorpher is described as a worst-case random setting in which the adversary cannot use domain knowledge to guide transformations.The paper also reports that reductions of hidden values are similar across a few selected samples in its empirical studies.Source: §4.3 · p. 7
  • Under a discrete hidden-state source where α and β are 0 or 1, EvadeHC candidates have equal conditional probabilities, making candidate choice irrelevant in each iteration.This is a particular HsrMorpher source under which EvadeHC is ineffective.Source: §4.3 · p. 7

5. EVALUATION

Against both PDF malware detectors, all three approaches found evasions for every malware seed, while EvadeHC generally required far fewer queries and less time. The evaluation also examines parameter effects, hardened detectors, evasion traces, and the hidden-state model.

5.1 Experimental Setups

  • The 500 malware seeds were selected from Contagio and had to exhibit tester-observed malicious behavior, be compatible with the morpher, and be rejected by both detectors.The targeted detector implementations returned binary decisions; Cuckoo sandbox served as the tester.Source: §5.1 · p. 7

5.2 Effect of Parameter Settings on EvadeHC

  • Larger q1 reduced iterations, but could increase total detector queries; increasing ∆ from 0.4 to 0.7 reduced iterations, while ∆=0.9 tended to increase them.The experiments used q1=20, q2=5, and ∆=0.75 in subsequent evaluations.Source: §5.2 · p. 8, Figure 4 · p. 8

5.3 Evading PDFrate Detector; 5.4 Evading Hidost Detector

  • 100% evasion rates on all 500 malware seeds were achieved against both PDFrate and Hidost; EvadeHC found Hidost evasions within 11 iterations for 95% of seeds.The remaining Hidost seeds required up to 13 iterations; the comparisons include SeqRand and BiRand.Source: §5.3 · p. 8, §5.4 · p. 9, Figure 5 · p. 9

5.3 Evading PDFrate Detector

  • On PDFrate, EvadeHC required up to 450 times fewer detector queries and 148 times fewer tester queries than SeqRand.BiRand reduced detector queries by up to 94 times versus SeqRand; EvadeHC typically used 2–4 times fewer detector queries and 6–10 times fewer tester queries than BiRand.Source: §5.3 · p. 9, Figure 5 · p. 9

5.4 Evading Hidost Detector; 5.5 Execution Cost

  • On Hidost, EvadeHC required two to three times fewer detector queries and seven to ten times fewer tester queries than BiRand.SeqRand averaged 6.7 hours per Hidost evasion, versus 40 minutes for BiRand and 5 minutes for EvadeHC.Source: §5.4 · p. 9, §5.5 · p. 9, Figure 6 · p. 9

5.6 Evading Trace Analysis

  • Evading samples in typical traces move toward equal malice- and reject-flipping distances, reaching detector acceptance before losing malicious functionality.The reported traces suggest PDFrate is more evadable than Hidost.Source: §5.6 · p. 10, Figure 8 · p. 10

5.7 Robustness against Hardened Detectors

  • With hardened detectors, EvadeHC retained 35% evasion against PDFrate at threshold 0.35 and 62% against Hidost at −0.75, exceeding the reported alternatives.Figure 9 reports evasion rates for BiRand, EvadeHC, and EvadeGP under these detector settings.Source: Figure 9 · p. 10, §5.7 · p. 11

5.8 Validating the Hidden-state Morpher Model

  • Malice- and reject-flipping distances were positively correlated across 200 morphed samples, with Pearson correlation 0.34; the authors also report similar PDFrate score-change histograms for two samples.Experiments under HsrMorpher showed behavior consistent with the empirical studies.Source: §5.8 · p. 11, Figure 10 · p. 11, Figure 11 · p. 11

6. DISCUSSION

The discussion considers defenses against EvadeHC and ways to mitigate or repurpose evasion. It reports that attacks remain feasible without classification scores, while proposed countermeasures need further study.

6.1 Existing Defensive Mechanism

  • Removing classification scores does not prevent evasion, so defenses based on hiding or randomizing those scores are ineffective against the reported attacks.Figure 12 plots average iterations and path for EvadeHC and BiRand under the abstract model.Source: §6.1 · p. 12, Figure 12 · p. 12

6.2 Potential Mitigation Strategies

  • A more restrictive malware threshold may increase evasion difficulty, although the authors identify this mitigation as needing future investigation.Even a slight threshold change could significantly affect evasion difficulty.Source: §6.2 · p. 12
  • Randomly flipping decisions for samples near the classification threshold is proposed as a mitigation, but its effect requires further study.The authors suggest this could have little accuracy impact if most samples lie far from the threshold.Source: §6.2 · p. 12
  • Because evasion often takes hundreds of detector queries and queried samples resemble one another, a stateful detector could use similarity or clustering to identify attempts.The proposed approach requires the detector to remember queried samples.Source: §6.2 · p. 12

6.3 Evasion for Defense

  • Morphed samples that retain malicious activity, especially those misclassified by the classifier, can be added to training to improve robustness against evasion.The authors say random but repeatable morphing can generate diverse adversarial examples for this training.Source: §6.3 · p. 12

7. RELATED WORK

Related work spans evasion settings with different assumptions about detector knowledge and sample manipulation. This paper distinguishes its approach by searching directly against the target under tighter information constraints.

7. RELATED WORK

  • Prior evasion work varies in its assumptions about adversary knowledge, with some approaches relying on access to classifier internals or direct feature-space manipulation.The cited taxonomy distinguishes access to training data, algorithms and parameters, and learned features.Source: §7 · p. 12
  • Xu et al. assumes access to classification scores and knowledge of the morphing mechanism's manipulation level, unlike this paper's approach.The paper reports that EvadeHC achieves a higher evasion rate against hardened detectors without classification scores.Source: §7 · p. 12
  • Papernot et al. [21] searches using a locally trained substitute model and relies on transferability, whereas this paper searches directly against the target without either assumption.The substitute model's internal parameters and training data are available to the adversary.Source: §7 · p. 12
  • Other blackbox work targets model-parameter extraction or training-data membership inference, rather than misclassification of malicious samples.The passage identifies Tramèr et al. and Shokri et al. [26] as examples.Source: §7 · pp. 12–13

8. CONCLUSION

The conclusion presents EvadeHC as a hill-climbing approach to evasion using blackbox morphing with minimal knowledge of the detector and manipulation mechanism. The authors demonstrate it on two PDF malware classifiers and suggest wider applicability to learning-based systems.

8. CONCLUSION

  • EvadeHC uses hill-climbing and blackbox morphing to evade binary-outcome detectors under minimal assumptions about the detector and manipulation mechanism.The approach is demonstrated against two PDF malware classifiers, and the authors suggest it may apply more widely to learning-based systems.Source: §8 · p. 13

A. PDF MALWARE CLASSIFIERS

This appendix introduces PDF and the two malware classifiers, PDFrate and Hidost. It outlines the components of a PDF file and describes its objects.

A. PDF MALWARE CLASSIFIERS

  • The section introduces PDFrate and Hidost as the two PDF malware classifiers discussed.It also provides an overview of PDF and PDF malware.Source: A. PDF MALWARE CLASSIFIERS · p. 14

A.1 PDF

  • A PDF file has a header, body, cross-reference table, and trailer, with the cross-reference table indexing byte offsets of body objects.PDF body objects include eight basic types, including dictionaries and streams; JavaScript dictionaries can contain executable code.Source: §A.1 · p. 14

A.2 PDF Malwares

PDFs are widely used to deliver malware, and vulnerabilities in Acrobat readers make PDF malware a relevant threat. Malicious payloads may be embedded in JavaScript or other PDF objects.

A.2 PDF Malwares

  • PDF files have been extensively exploited to deliver malware because of their popularity.The passage identifies malicious payloads in JavaScript or other PDF objects that can exploit vulnerabilities in a particular reader.Source: §A.2 · p. 14
  • The passage identifies vulnerabilities reported in Acrobat readers as part of the threat posed by PDF malware.It cites recent reports of an increasing number of vulnerabilities.Source: §A.2 · p. 14
  • Figure 13 provides an example of a PDF file structure.Source: Figure 13 · p. 14

A.3 Detectors

The section describes two structural-feature PDF malware detectors, PDFrate and Hidost, and how their original score outputs are converted to binary decisions for the experiments.

A.3 Detectors

  • JavaScript-focused detectors can miss PDF malware when payloads are not embedded in JavaScript or the code is hidden.These approaches extract JavaScript and analyze it dynamically or statically; structural-feature detectors instead rely on differences in benign and malicious PDF object structures.Source: §A.3 · p. 14
  • The experiments evaluate PDFrate and Hidost, reported to have high detection rates, after modifying them to return binary decisions.Their original outputs are real-valued scores compared against thresholds.Source: §A.3 · p. 14
  • PDFrate is an ensemble of classification trees whose maliciousness score is the fraction voting malicious, with a default cutoff of 0.5.Its trees use object keywords, PDF metadata, and object properties; the classifier has 1,000 trees and 202 total features across them.Source: §A.3 · p. 14
  • The section includes a figure caption describing average blackbox queries required to evade PDFrate.Source: Figure 14 · p. 15
  • Hidost maps PDFs with a radial basis function and uses distance from a hyperplane to measure maliciousness; positive distance means malicious.It is an SVM using 6,087 structural-path features selected from paths appearing in at least 1,000 files.Source: §A.3 · p. 15

B. NUMBER OF BLACKBOX QUERIES IN EVADING PDFrate

EvadeHC generally requires fewer blackbox queries and less morphing effort than BiRand to evade PDFrate, though some malware seeds take substantially more effort. Seeds with higher PDFrate scores are harder to evade.

B. NUMBER OF BLACKBOX QUERIES IN EVADING PDFrate

C. NUMBER OF BLACKBOX QUERIES IN EVADING HIDOST

Against Hidost, EvadeHC outperforms BiRand on detector queries, tester queries, and morphing effort. The reported comparisons include query and morphing-step counts.

C. NUMBER OF BLACKBOX QUERIES IN EVADING HIDOST

Related papers

Loading 1705.07535v3…