Source-linked AI summary
Deceiving End-to-End Deep Learning Malware Detectors using Adversarial Examples
Felix Kreuk, Assi Barak, Shir Aviv-Reuven, Moran Baruch, Benny Pinkas, Joseph Keshet
TL;DR
Discrete binary inputs make adversarial-example generation difficult because byte changes can alter validity or runtime behavior. This paper perturbs embeddings and reconstructs payloads for injection into malicious files; the attacks achieve high evasion and transfer across locations and files.
Problem
Generating adversarial examples for raw-binary malware detectors is difficult because changing discrete bytes can invalidate code or change runtime functionality.
Source: §1 · p. 1Method
Results
The attack achieved evasion rates of 99.21% for p = 2 and 98.83% for p = ∞, while payloads also transferred across file locations and files.
Source: §4 · pp. 3–4Takeaways & Limitations
Abstract
from arXiv · showhide
In recent years, deep learning has shown performance breakthroughs in many applications, such as image detection, image segmentation, pose estimation, and speech recognition. However, this comes with a major concern: deep networks have been found to be vulnerable to adversarial examples. Adversarial examples are slightly modified inputs that are intentionally designed to cause a misclassification by the model. In the domains of images and speech, the modifications are so small that they are not seen or heard by humans, but nevertheless greatly affect the classification of the model. Deep learning models have been successfully applied to malware detection. In this domain, generating adversarial examples is not straightforward, as small modifications to the bytes of the file could lead to significant changes in its functionality and validity. We introduce a novel loss function for generating adversarial examples specifically tailored for discrete input sets, such as executable bytes. We modify malicious binaries so that they would be detected as benign, while preserving their original functionality, by injecting a small sequence of bytes (payload) in the binary file. We applied this approach to an end-to-end convolutional deep learning malware detection model and show a high rate of detection evasion. Moreover, we show that our generated payload is robust enough to be transferable within different locations of the same file and across different files, and that its entropy is low and similar to that of benign data sections.
1 Introduction
End-to-end malware detectors operate on raw binaries, but changing discrete bytes can disrupt validity or functionality, complicating adversarial-example generation. This work proposes embedding-space perturbations and reports evasion with payloads transferable across locations and files.
1 Introduction
- Byte-level changes can invalidate code or alter runtime behavior, unlike small image or speech perturbations that may remain imperceptible to people.The introduction identifies the discrete nature of binary inputs as a challenge for adversarial-example generation.Source: §1 · p. 1
- Earlier malware-evasion work [15] [17] studied detectors using handcrafted features, whereas this work targets raw-binary models.The introduction also distinguishes parallel work [18], which injects bytes at end-of-file, from this method's multiple injection locations.Source: §1 · pp. 1–2
- The proposed method's evasion rate is described as invariant to injected-sequence length, unlike [18], where evasion rate is linearly correlated with length.The authors also contrast their use of multiple injection locations with [18]'s end-of-file injections.Source: §1 · p. 2
- The paper evaluates convolutional neural-network malware detectors that classify entire raw binary sequences rather than relying on handcrafted features.The cited example detector is described in.Source: §1 · p. 2
- The method generates adversarial examples for raw-binary detectors by perturbing in embedding space, reconstructing discrete inputs, and reusing payloads across locations, files, and families.The authors report that the same payload can be injected at different locations and applied to different malware files and families.Source: §1 · p. 2
2 Problem Setting
The paper represents executable files as variable-length sequences of bytes and formalizes malware detection as a neural-network classification task. Its attack objective is to change a correctly detected malicious file into a benign prediction while retaining runtime functionality.
2 Problem Setting
- A binary file is a variable-length sequence over 256 possible byte values, and the detector predicts malicious when its output exceeds 0.5, otherwise benign.The detector is formalized as fθ: X* → [0, 1].Source: §2 · p. 2
- The attack seeks a modified version of a correctly classified malicious file that is predicted benign while retaining the original file's runtime functionality.For the original malicious file, fθ(x) > 0.5; the desired modified file has fθ(x̃) < 0.5.Source: §2 · p. 2
- The evaluated end-to-end detector is MalConv, which maps bytes through an embedding layer, a Gated-Linear-Unit, and temporal max-pooling.The paper identifies MalConv as a CNN-based malware detector.Source: §2 · p. 2
3 Generating Adversarial Examples
Because bytes are discrete, the method generates perturbations in a continuous embedding space and reconstructs them as bytes. It limits changes to a payload inserted into non-executable space, preserving the original file while seeking detector misclassification.
3 Generating Adversarial Examples
- The method generates adversarial examples in continuous embedding space and reconstructs them as discrete bytes because gradient perturbations do not directly suit arbitrarily represented byte values.The attack seeks a perturbed embedding close to the original under a norm constraint while inducing an incorrect prediction.Source: §3 · p. 2
- For max-norm perturbations, the method uses FGSM; after crafting the embedding, it reconstructs bytes by mapping each embedding to its nearest embedding-matrix neighbor.The text also describes an L2-gradient update and cites FGSM.Source: §3 · p. 2
- To protect functionality, the method confines modifications to a small payload placed in unused non-executable bytes, either mid-file or at end-of-file.Mid-file placement uses contingent unused bytes where physical section size exceeds virtual size; end-of-file placement appends a new section.Source: §3 · pp. 2–3
- For end-of-file injection, the algorithm appends a random payload, perturbs only its embedded segment until misclassification, and leaves the original embedded file intact.The payload length is initialized using the convolution size and file length remainder.Source: §3 · p. 3
4 Experimental Results
The experiments report high evasion rates against an end-to-end CNN malware detector while preserving file functionality. They also test whether payloads remain effective across positions and files, and examine payload size, entropy, and the detector’s response.
Experimental setup
- The evaluation used 7,150 benign files and 10,866 malicious files from nine families; payload-property experiments used 223 previously unseen files from five families.The main dataset was split into training, validation, and test sets in an 80/10/10 ratio.Source: §4 · pp. 3–4
Detection Evasion
- 99.21% for p = 2 and 98.83% for p = ∞ were the evasion rates, with original functionality retained and payloads 500–999 bytes long.The detector achieved 98% validation accuracy and 97% test accuracy; the evaluation used a Kaggle 2015 training dataset.Source: §4 · p. 3
- The authors explain evasion as a shift in attention: the temporal-max-pooling maximum was at the payload, which acted as a distraction from malicious code.The comparison is described for the average convolution activation along the file position.Source: §4 · p. 4
Spatial invariance
- 100% of files remained misclassified as benign after their payloads were repositioned from end-of-file to mid-file.Positions were selected to fit the payload inside the convolution window.Source: §4 · p. 4
File transferability
- 75% of files were still misclassified as benign when a payload generated for one file was injected into another.The payload’s cross-file effectiveness was evaluated using the malware detector.Source: §4 · p. 4
Payload size
- Evasion rates were 99.02%–99.21% for p = ∞ and 98.04%–98.83% for p = 2 with payload maximum sizes of 1000–2500 bytes, and were reported unaffected by payload length given c.The stated MalConv maximum payload size is 999 bytes and depends on len(x) mod c.Source: §4 · p. 4
Entropy
- Average entropy changed from 3.75 to 4.1 and remained within the study’s unsuspicious range.The paper describes entropy-based detectors as comparing section entropy with standard thresholds.Source: §4 · p. 4
Functionality Preserving
- Behavior graphs before and after injection were identical; the method modifies non-executable sections.The passage identifies modifying non-executable sections as the means of preserving functionality.Source: §4 · p. 4
5 Future Work
Future work proposes separating payload generation from the model’s embedding layer to produce black-box attacks. The authors also propose assessing the reliability of real-world hybrid systems using a wider array of detection techniques.