PaperlayerView exact revision on arXiv

Source-linked AI summary

Automated Poisoning Attacks and Defenses in Malware Detection Systems: An Adversarial Machine Learning Approach

Sen Chen, Minhui Xue, Lingling Fan, Shuang Hao, Lihua Xu, Haojin Zhu, Bo Li

arXiv:1706.04146v3cs.CR

TL;DR

The paper examines how attackers can poison mobile-malware training data and mislead conventional classifiers. It proposes KuafuDet, a self-adaptive two-phase adversarial-detection system, and reports reduced false negatives with detection accuracy boosted by at least 15%.

  • Problem

    The paper investigates how determined attackers can poison training data and evade conventional machine-learning malware detectors.

  • Method

    KuafuDet combines offline feature selection and online classification through self-adaptive learning and camouflage detection for suspicious false negatives.

  • Results

    KuafuDet significantly reduces false negatives and boosts detection accuracy by at least 15%.

  • Takeaways & Limitations

    The study presents adversarial detection as a learning-enhancing approach for limiting mimicry and poisoning attacks in mobile-malware detection.

  • Takeaways & Limitations

    The ground-truth malware dataset does not cover all platforms uniformly.

Abstract

from arXiv · show

The evolution of mobile malware poses a serious threat to smartphone security. Today, sophisticated attackers can adapt by maximally sabotaging machine-learning classifiers via polluting training data, rendering most recent machine learning-based malware detection tools (such as Drebin, DroidAPIMiner, and MaMaDroid) ineffective. In this paper, we explore the feasibility of constructing crafted malware samples; examine how machine-learning classifiers can be misled under three different threat models; then conclude that injecting carefully crafted data into training data can significantly reduce detection accuracy. To tackle the problem, we propose KuafuDet, a two-phase learning enhancing approach that learns mobile malware by adversarial detection. KuafuDet includes an offline training phase that selects and extracts features from the training set, and an online detection phase that utilizes the classifier trained by the first phase. To further address the adversarial environment, these two phases are intertwined through a self-adaptive learning scheme, wherein an automated camouflage detector is introduced to filter the suspicious false negatives and feed them back into the training phase. We finally show that KuafuDet can significantly reduce false negatives and boost the detection accuracy by at least 15%. Experiments on more than 250,000 mobile applications demonstrate that KuafuDet is scalable and can be highly effective as a standalone system.

1. Introduction

Mobile malware creates growing security risks, while poisoning attacks can mislead machine-learning detectors by injecting or crafting deceptive training data. The paper proposes KuafuDet, an adversarial, self-adaptive defense that improves resilience through iterative camouflage detection and retraining.

  • Motivation: Mobile applications increasingly expose sensitive personal and financial data, making smartphones lucrative targets for attackers.
  • Problem: Existing machine-learning malware research largely assumed ideal feature extraction and did not examine poisoning-based evasion in feature space.The threat model allows attackers to control or inject samples to mislead learning algorithms.
  • Defense: KuafuDet combines offline feature selection with online classification, linking both phases through self-adaptive learning and similarity-based camouflage detection.Suspicious false negatives are identified and used to reinforce the detection process.
  • Evaluation: KuafuDet reaches up to 96% accuracy without adversarial conditions, improves adversarial detection accuracy by at least 15%, and is reported as scalable and efficient.The system was evaluated with 16,000 training applications and 4,000 evaluation applications, alongside real-time streaming experiments.
  • Threat Models: Three attacker types model weak, strong, and sophisticated poisoning threats, while customized crafting generates camouflage samples with varying aggressiveness.The crafting process adds or removes restricted numbers of features to preserve application functionality.
  • Attack Findings: Poisoned features preserve maliciousness but impair discriminative classifiers and lower detection scores; API-call features cause greater perturbation than permissions.
  • Caveat: Accuracy gradually degrades as more benign applications enter an imbalanced dataset, although it remains relatively high.

2. Problem Definition: Adversarial Machine Learning

The paper models poisoning attacks that manipulate malware features or training samples to make malicious applications misclassified as benign. It formalizes attacker aggressiveness and uses gradient-guided feature perturbations to craft adversarial samples, while noting limits to the optimization formulation.

  • Formalization: The attack representation uses binary malware feature vectors, binary labels, and a bounded perturbation in an m-dimensional feature space.Each feature indicates whether a selected characteristic is present in a malware sample.
  • Threat model: Poisoning attacks aim to make malicious applications misclassified as benign by misleading a binary malware classifier.The threat model assumes attackers can access the classifier and inject variant features into the training data.
  • Threat model: Cf controls attack aggressiveness from no attack at Cf = 0 to the most aggressive attack at Cf = 1.The paper evaluates weak and strong attacker settings, including Cf = 0.33 and Cf = 0.67.
  • Adversarial crafting: The crafting algorithm computes feature gradients, repeatedly adds the feature with the largest target-class gradient, and stops at a change bound or successful misclassification.The target class is benign for malicious samples, and the procedure is based on a Jacobian matrix.
  • Scope: The paper does not formulate malware detection as an optimization problem because resource, accuracy, and perturbation objectives may not match semantic interpretations of malicious behavior.Future work seeks an exact mapping between machine-crafted malware and ready-to-use malicious applications in the wild.

3. Motivations and Challenges

Android malware has evolved toward more capable adversarial behavior, including camouflage techniques that exploit machine-learning features. The paper highlights practical detection challenges involving hidden code, benign-looking logic, dynamic loading, class imbalance, and incomplete ground-truth coverage.

  • Evolutionary Chain: Android malware has progressed from earlier SMS-related threats toward large-scale, skilled adversarial attacks requiring targeted detection strategies.The paper describes this progression as an evolutionary chain observed along the malware timeline.
  • Adversarial Samples: Malware can hide malicious code in alternative file formats, including jar, so, jpg, and dat, causing sensitive API features to support misclassification.This behavior is presented as an example of a strong attacker.
  • Adversarial Samples: Sophisticated attackers embed benign logic and combine code-obfuscation techniques to obscure feature extraction and make classifiers less robust.The embedded benign logic can execute without affecting the application's malicious behavior.
  • Adversarial Samples: Removing embedded benign logic step by step can expose malware that was previously misclassified as benign.Figure 2 illustrates the transformation from camouflaged gray samples to exposed black malicious samples.
  • Adversarial Samples: Dynamic code loading through reflection adds malicious behavior at runtime without changing the original application, challenging static feature-based classification.The paper notes that runtime-loaded code is not part of the application's source code.
  • Challenges: The ground-truth dataset combines malware from five platforms but does not cover all platforms uniformly.The authors identify this uneven platform coverage as a dataset-quality limitation.

4. System Overview

KuafuDet combines similarity-based filtering with two-phase iterative adversarial detection to identify camouflaged false negatives while supporting accuracy and scalability.

  • Key Ideas: KuafuDet uses similarity-based filtering to identify suspicious false negatives, namely camouflaged malicious applications.The approach exploits applications that reflect both malicious and benign characteristics and feeds newly discovered malware into learning.
  • Overall Architecture: The framework intertwines offline training and online detection through self-adaptive learning.Training extracts features from labeled applications and updates classifiers, while online detection classifies Android applications as benign or malicious.
  • Overall Architecture: KuafuDet classifies large sets of online Android applications collected from multiple online markets.The system is designed for massive-scale detection while maintaining accuracy and scalability.

5. System Design

The system addresses evolving malware and adversarial camouflage through adaptive classifiers, selected static features, and similarity-based malware-candidate filtering.

  • Design Motivation: A fixed classifier may miss new malware, while attackers can obfuscate contributing features and increase false negatives.These limitations motivate adaptive adversarial detection.
  • Feature Selection and Classification: KuafuDet extracts 195 of 564 features using manual pruning and information gain, then trains SVM, Random Forest, and KNN classifiers.The selected features form 195-dimensional application representations.
  • Feature Design: The feature set includes syntax features for permissions, intents, hardware, and API calls, plus semantic sequence features extracted through static analysis.Semantic features represent sequential malicious behaviors such as sensitive operations and are defined in 20 types.
  • Feature Selection and Classification: Manual pruning with information gain cross-checks feature selection because information gain alone ignores class information and feature distributions.The paper notes that relying on unsuitable features can sharply reduce malware-detection performance.
  • Similarity-Based Filtering: The similarity pipeline uses feature vectors for training applications and hand-picked highly benign or highly malicious applications.The hand-picked applications are selected according to distances from the classification hyperplane and updated with the training set.
  • Similarity-Based Filtering: Similarity filtering compares applications with Jaccard, Jaccard-weight, and cosine similarity to select malware candidates for retraining.Applications exceeding a similarity threshold are fed back into the training process, with threshold choice affecting false negatives.
  • Adversarial Model: Finding a maximum-cardinality action set remains an open problem in intersection set theory, limiting the attacker’s optimal scheduling strategy.This is stated as a limitation on the attacker rather than on KuafuDet’s detection system.

6. Experimental Evaluation

The evaluation tests Android malware detectors against poisoning attacks, compares accuracy and false negatives, and assesses KuafuDet’s robustness, scalability, and coverage. KuafuDet improves robustness under sophisticated attacks and reports higher accuracy and scanner coverage than selected baselines.

  • Robustness Evaluation: The study evaluates robustness under three attack strategies using Android applications from third-party markets and industrial environments.The evaluation also examines malicious-application detection, real-time efficiency, scalability, adaptability, and coverage.
  • Misclassification Under Poisoning: 80.05%, 75.20%, and 68.95% misclassification rates were obtained for DroidAPIMiner, Drebin, and MaMaDroid, respectively, under poisoning attacks.The experiment uses a 16,000-sample training set and a 4,000-sample test set, with SVM for a fair comparison.
  • Misclassification Under Poisoning: 62.60% misclassification remained for KuafuDet without adversarial detection under sophisticated attacks.This indicates that the classifier still suffers from adversarial samples when its camouflage detector is disabled.
  • Robustness Evaluation: Sophisticated attacks reduced accuracy to approximately 65%, while adversarial detection improved performance by at least 15% accuracy for each listed classifier.Weak attacks could not force accuracy below 90%, and similarity-based filtering kept adversarial-detection performance above the cited baseline levels.
  • Accuracy Comparison: 96.35% accuracy exceeded StormDroid’s 93.80% and Drebin’s 93.90% on the comparison dataset.The authors attribute the higher accuracy to feature selection and similarity-based methods.
  • Industrial Coverage Comparison: 96.20% coverage exceeded ESET-NOD32’s 79.50%, McAfee’s 75.50%, Ikarus’s 72.50%, Kaspersky’s 72.10%, and Avira’s 69.30%.The comparison notes that industrial tools process millions of applications, including many zero-day samples.
  • Scalability and Adaptation: KuafuDet supports periodic learning enhancement and adaptation to new malware by decoupling similarity-based filtering from machine-learning classifiers.The evaluation also reports real-time streaming on a server with 16 GB memory, a quad-core i7-4800MQ processor, and 1 TB storage.

7. Discussion

The discussion identifies limitations involving classifier granularity and decompilation, and acknowledges that the process can cause false positives. These constraints affect grayware classification, feature extraction, and interpretation of sensitive benign behavior.

  • Classifier Granularity: KuafuDet is generic and coarse-grained, so grayware with no clear benign–malicious distinction may require tuning for specific detection needs.The paper illustrates this boundary with game-hacking applications that may be treated differently by users and game developers.
  • Decompilation: Feature extraction depends on manifest and Smali files that can be successfully decompiled, but some APK files cannot be decompiled successfully.The authors identify decompilation technology as a study limitation.
  • False Positives: The process can cause false positives because benign SMS-related applications may exhibit sensitive behaviors typical of Android malware.The paper explicitly acknowledges this error mode rather than treating sensitive behavior as uniquely malicious.

8. Related Work

Prior Android malware detectors use static, dynamic, information-flow, and machine-learning techniques, but earlier work largely overlooked adversarial feature-space manipulation and poisoning attacks. This paper frames mobile malware detection as an adversarial machine-learning problem and positions KuafuDet as a defense against poisoned features.

  • Android malware detection has used signature-based, behavior-based, and information-flow analysis alongside machine-learning classifiers.
  • Drebin uses manifest and source-code features with an SVM, but its malware is outdated and its coverage of attacking and evasion techniques is incomplete.
  • DroidAPIMiner extracts frequent API calls and related package and parameter information, requiring continual retraining as malware and Android APIs evolve.
  • Other systems use semantic features, probabilistic predictors, sensitive-information flows, or API-dependency graphs to represent Android applications.
  • Earlier adversarial-machine-learning studies focused mainly on spam or generic adversarial samples and did not establish causative evasion in mobile malware or its feasibility in the wild.
  • This paper reports that malware can poison features while preserving maliciousness, impairing discriminative classifiers and lowering detection scores.

9. Conclusion

The conclusion reports that conventional classifiers can fail against determined attackers, motivating three simulated training-phase poisoning attacks and the KuafuDet defense. KuafuDet significantly reduces false negatives and improves detection accuracy by at least 15%.

  • Conventional machine-learning classifiers can fail against determined attackers targeting malware detection.
  • The study designs and evaluates three attacker types targeting training phases, using simulation to estimate practical accuracy-loss bounds.
  • KuafuDet significantly reduces false negatives and boosts detection accuracy by at least 15%.
  • The authors argue that effective early detection must increase the cost of infection for the arms race to end.

Appendix A. Syntax and Semantic Features

Appendix A presents the feature inventory used for classifier training: 175 syntax features and 20 semantic features.

  • The classifier-training feature inventory contains 175 syntax features and 20 semantic features.

Biography

The authors and collaborators work across smartphone security, Android malware, software analysis, testing, network security, machine learning, privacy, and related systems research. Their affiliations include East China Normal University, New York University, Nanyang Technological University, the University of Texas at Dallas, Shanghai Jiao Tong University, UC Berkeley, and the University of Illinois at Urbana–Champaign.

  • Sen Chen focuses on smartphone security, Android malware, vulnerability, and program analysis at East China Normal University and Nanyang Technological University.
  • Minhui Xue is affiliated with East China Normal University and New York University, where he works in research and academic roles.
  • Lingling Fan studies software testing, model checking, Android application analysis, and malware detection at East China Normal University.
  • Shuang Hao is an assistant professor at the University of Texas at Dallas whose work covers network and system security, anomaly detection, DNS analysis, and web and mobile security.
  • Lihua Xu researches software engineering, automated software analysis and testing, and mobile security at East China Normal University.
  • Haojin Zhu works on network security and data privacy as a professor at Shanghai Jiao Tong University.
  • Bo Li studies machine learning, security, privacy, game theory, social networks, and adversarial deep learning, with affiliations including UC Berkeley and the University of Illinois at Urbana–Champaign.
Loading 1706.04146v3…