PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Deep Learning for Robust Detection of Binary Encoded Malware

Abdullah Al-Dujaili, Alex Huang, Erik Hemberg, Una-May O'Reilly

arXiv:1801.02950v3cs.CRcs.LGstat.ML

TL;DR

Malware detectors are vulnerable to evasive perturbations, but malware adversarial examples must preserve malicious functionality and operate in binary feature spaces. The paper develops functionality-preserving binary attacks and saddle-point adversarial training, evaluates them on PE files, and reports that randomized training explores roughly four times as many malicious samples as natural training while achieving relatively low evasion rates across attack methods.

  • Problem

    Malware detectors face adversarial examples, while robust continuous-domain methods do not directly address binary features and preserved malicious functionality.

  • Method

    The paper develops four functionality-preserving binary malware-AE methods and uses SLEIPNIR's saddle-point optimization to train robust detectors.

  • Results

    Roughly 4 times as many malicious samples were explored as in natural training, while rFGSMk achieved relatively low evasion rates across all attack methods.

  • Takeaways & Limitations

    Randomization in projected-gradient rounding was associated with broader exploration of the binary malware feature space and robustness to adversaries beyond those used during training.

Abstract

from arXiv · show

Malware is constantly adapting in order to avoid detection. Model based malware detectors, such as SVM and neural networks, are vulnerable to so-called adversarial examples which are modest changes to detectable malware that allows the resulting malware to evade detection. Continuous-valued methods that are robust to adversarial examples of images have been developed using saddle-point optimization formulations. We are inspired by them to develop similar methods for the discrete, e.g. binary, domain which characterizes the features of malware. A specific extra challenge of malware is that the adversarial examples must be generated in a way that preserves their malicious functionality. We introduce methods capable of generating functionally preserved adversarial malware examples in the binary domain. Using the saddle-point formulation, we incorporate the adversarial examples into the training of models that are robust to them. We evaluate the effectiveness of the methods and others in the literature on a set of Portable Execution~(PE) files. Comparison prompts our introduction of an online measure computed during training to assess general expectation of robustness.

I. INTRODUCTION

Malware detectors face adversaries that perturb detectable malware into evasive variants, while preserving malicious functionality complicates adversarial-example generation in binary feature spaces. The paper adapts robust adversarial training to this setting and introduces SLEIPNIR for binary-encoded malware detection.

  • Adversarial examples are malware variants created by perturbing detectable malware so that detectors evade them.
  • Image-domain defenses typically assume continuous inputs, unlike malware detectors that often use binary features.
  • Malware adversarial examples must fool the detector without altering the malicious payload.
  • The paper investigates transforming continuous-domain robust adversarial training methods for discrete or categorical malware features.
  • SLEIPNIR trains robust malware detectors with saddle-point optimization and four functionality-preserving binary adversarial-example generation methods.
  • The evaluation uses Portable Executable files and introduces an online measure intended to express general expectations of model robustness.

B. Adversarial Machine Learning

Adversarial machine learning develops methods to create and defend against small input changes that cause misclassification. This paper extends that line of work to functional, white-box adversarial examples in binary malware features and incorporates them into robust classifier training.

  • A successful adversarial example changes a correctly classified sample into one the detector misclassifies.
  • FGSM generates perturbations by following input-gradient directions that most increase neural-network output change under an ϵ-max constraint.
  • Saddle-point robust optimization couples outer detector-loss minimization with inner adversarial-loss maximization during training.
  • Prior malware-AE studies use reinforcement learning, genetic algorithms, and supervised methods, often treating detectors as black boxes and binary features as presence indicators.
  • This work uniquely generates functional white-box adversarial examples in the discrete binary domain and trains malware classifiers to resist them.

III. METHOD

The method models malware classification over binary executable representations and labels, then formulates adversarial learning as a saddle-point problem. Its objective combines classifier risk minimization with functionality-preserving adversarial perturbation.

  • The framework formulates adversarial learning as a saddle-point problem for hardening machine-learning antimalware detectors.
  • A. Notation: Each executable is represented by a binary indicator vector x ∈ {0, 1}^m, while labels y ∈ {0, 1} denote benign and malignant files.
  • A. Notation: The classifier learns parameters θ to minimize expected loss E_(x,y)∼D[L(θ, x, y)] over the malware data distribution.

B. Malware Adversarial Learning as a Saddle Point Problem

The malware adversarial-learning formulation searches for loss-maximizing binary variants within the functionality-preserving region, then incorporates those variants into model training. The resulting optimization combines inner adversarial maximization with outer model minimization.

  • Blind spots are unrepresented decision-space regions where the learned boundary can be inaccurate and exploitable by adversarial malware.
  • Adversarial malware versions are generated by perturbing correctly classified malware to maximize the detector loss.
  • S(x) contains binary vectors that preserve malware functionality, while S*(x) contains those maximizing adversarial loss.
  • The training process incorporates generated adversarial versions through the saddle-point formulation.
  • The formulation has an inner non-concave maximization and an outer non-convex minimization.

C. Adapting Gradient-Based Inner Maximization Methods for Binary Feature Spaces

The paper adapts gradient-based inner maximization to binary malware features by adding only functionality-preserving features and searching feasible binary-space vertices.

  • Binary Feature Constraints: Malware-preserving perturbations set unset bits in the binary feature vector, so feasible adversarial versions lie among vertices reachable by adding absent features.The feasible set has size |S(x)| = 2^(m−xᵀ1), which can grow exponentially and makes brute-force enumeration impractical.
  • Rounded Gradient Methods: Deterministic and randomized rounding extend projected gradient methods to binary features, producing the dFGSMk and rFGSMk variants.These methods adapt continuous-space constraint handling to discrete inputs through rounding.
  • Bit-Based Search: BGAk visits multiple feasible binary vertices using gradient contributions, then selects the visited vertex with maximum loss as the adversarial malware version.A feature bit is set when its partial derivative contributes sufficiently to the gradient norm.
  • Bit-Based Search: BCAk updates one bit per step by selecting the feature with the largest corresponding loss partial derivative.Both BGAk and BCAk search among functionality-preserving binary variants rather than taking continuous-space steps.

D. Blind Spots Coverage

The paper introduces blind spots covering number, an online measure of how extensively an inner-maximization method finds adversarial malware variants during training.

  • Blind Spots Coverage: Blind spots covering number NBS measures the effectiveness of algorithm A by comparing the adversarial variants it crafts during training with the maximum possible number.The measure is defined as an expected ratio over malware examples.
  • Blind Spots Coverage: The feasible adversarial variants for a malware form a set S(x), illustrated as allowed perturbations among vertices of a binary indicator space.For [1, 0, 0], the example set contains four variants, while [0, 1, 1] has two.
  • Inner Maximization: The proposed inner maximizers operate on binary malware inputs and use gradient information to construct adversarial versions from feasible starting points.The methods permit any initial x0 in S(x), with the described setup using x0 = x.
  • Interpretation: Higher NBS indicates that training has exposed the model to more adversarial examples and is expected to correspond to greater robustness against attacks.Exact computation may be expensive, motivating a probabilistic approximation.

E. Adversarial Learning Framework

SLEIPNIR trains robust malware detectors through a saddle-point procedure that combines adversarial loss on malware with natural loss on benign executables.

  • Training Framework: SLEIPNIR groups the training data into minibatches and optimizes model parameters using adversarial malware loss together with natural benign-example loss.This procedure is presented through Algorithm 1 and the framework’s empirical saddle-point formulation.
  • Training Framework: The framework applies adversarial learning to malware executables while leaving benign applications under the natural loss because benign authors do not seek detector evasion.Adversarial benign applications that could poison the training data are identified as future work.

IV. EXPERIMENTS

The experiments evaluate the proposed methods and compare them with others using classification accuracy, adversarial-example evasion rates, and blind-spot coverage.

  • Evaluation Objectives: The evaluation validates and compares method efficacy across classification accuracy, evasion rates, and blind spots coverage.The experiments use a stated setup followed by results reporting.

A. Setup

The study builds and evaluates SLEIPNIR for adversarial training on binary-feature malware represented by Portable Executable files.

  • Dataset: The dataset comprises malicious and benign Portable Executable files collected from VirusShare and internet download sites.VirusTotal labels required 0% positive detections for benign files and more than 50% for malicious files; the corpus contains 34,995 malicious and 19,696 benign PEs.
  • SLEIPNIR Framework: SLEIPNIR groups labeled minibatches with malicious examples first, generates adversarial versions of them, and trains on the resulting batch with benign examples.The minibatch contains s examples, with the first r malicious and the remaining s − r benign; adversarial examples are generated from feasible sets using an inner maximizer.
  • SLEIPNIR Framework: The framework performs inner maximization to create adversarial malware and outer minimization of adversarial and natural losses.The outer optimization can be solved in minibatches using variants of gradient descent.
  • Feature Representation: Each PE is represented as a binary vector indicating the presence of 22,761 unique Windows API calls.The representation is x ∈ {0, 1}^m with m = 22,761, extracted using LIEF.
  • Learning Setup: Experiments use 19,000 benign and 19,000 malicious PEs split into training, validation, and test sets, with ADAM training for 150 epochs.Inner maximizers use 50 steps and ε = 0.02; four adversarially trained models are produced alongside a naturally trained model.

B. Results

Adversarial training preserves comparable classification accuracy while changing error profiles, and rFGSMk provides the strongest overall resistance to the evaluated evasion attacks. The approximate blind-spot coverage measure tracks evasion rates and can be updated online during training.

  • Classification Performance: All adversarially trained models achieve classification accuracy comparable to the naturally trained model.They generally show higher false positive rates and lower false negative rates than natural training.
  • Robustness to Evasion Attacks: rFGSMk is the most successful adversarial training method, achieving relatively low evasion rates across all evaluated attack methods.Other training methods each perform poorly against at least one adversarial method, although all are resistant to attacks generated by their own method.
  • Blind Spots Coverage: The approximate blind-spot coverage measure correlates with evasion rates and indicates how extensively adversarial training explores valid malware regions.For rFGSMk, a coverage value of 4.0 means the method explored, with high probability, four times as many malicious samples as natural training.
  • Blind Spots Coverage: The blind-spot coverage measure is computed after each training step, enabling online assessment of training robustness to adversarial attacks.Natural training has a ratio of 1.0 because its malicious samples are not modified.

V. CONCLUSIONS AND FUTURE WORK

The paper frames robust malware detection as saddle-point optimization in the binary domain and evaluates adversarial training on PE files. Randomized projected gradient descent uncovered roughly four times as many malicious samples as natural training, while the introduced online measure tracked robustness expectations.

  • Conclusions: The study formulates binary-domain adversarial malware detection as saddle-point optimization and trains DNNs with multiple inner maximization methods.
  • Conclusions: Experiments on PE files assessed trained models’ robustness against evasion attacks.
  • Results: Roughly 4 times as many malicious samples were uncovered with randomized rounding in projected gradient descent than in natural training.
  • Results: The online measure was introduced to assess the general expectation of model robustness during training.
  • Future Work: The normalized blind-spot measure counts distinct adversarial examples but does not capture their location relative to benign examples or their effects on FPR and FNR.
Loading 1801.02950v3…