Source-linked AI summary
Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables
Bojan Kolosnjaji, Ambra Demontis, Battista Biggio, Davide Maiorca, Giorgio Giacinto, Claudia Eckert, Fabio Roli
TL;DR
Raw-byte deep-learning malware detectors can be evaded by adversarial changes, but executable modifications must preserve functionality. The paper develops a gradient-based attack that appends optimized padding bytes against MalConv and finds substantial evasion with fewer than 1% of input bytes changed. These results motivate designing malware detectors with adversarial robustness in mind, while the evaluation is limited by dataset and input-size choices and by the reduced effectiveness of end-of-file appending.
Problem
Deep neural malware detectors trained on raw bytes are vulnerable to adversarial manipulation, yet practical executable attacks must preserve malware functionality.
Method
The paper uses a gradient-based attack that selects optimized padding bytes appended to malware binaries to increase their probability of benign classification against MalConv.
Results
MalConv accuracy decreased by over 50% on 13,195 Windows PE samples after injecting 10,000 padding bytes, less than 1% of input bytes.
Takeaways & Limitations
Robust malware detection should account for adversarially manipulable bytes rather than blindly relying on raw executable-byte analysis.
Takeaways & Limitations
The analysis used a smaller dataset and d = 10^6 rather than 2·10^6, while appending bytes reduced gradient-attack effectiveness compared with modifying earlier bytes.
Abstract
from arXiv · showhide
Machine-learning methods have already been exploited as useful tools for detecting malicious executable files. They leverage data retrieved from malware samples, such as header fields, instruction sequences, or even raw bytes, to learn models that discriminate between benign and malicious software. However, it has also been shown that machine learning and deep neural networks can be fooled by evasion attacks (also referred to as adversarial examples), i.e., small changes to the input data that cause misclassification at test time. In this work, we investigate the vulnerability of malware detection methods that use deep networks to learn from raw bytes. We propose a gradient-based attack that is capable of evading a recently-proposed deep network suited to this purpose by only changing few specific bytes at the end of each malware sample, while preserving its intrusive functionality. Promising results show that our adversarial malware binaries evade the targeted network with high probability, even though less than 1% of their bytes are modified.
I. INTRODUCTION
Malware detection increasingly uses machine learning, including deep models trained on raw executable bytes, but these systems remain vulnerable to adversarial manipulation. The paper introduces a functionality-preserving gradient attack against MalConv and reports substantial evasion with minimal byte changes.
- Motivation: Machine-learning malware detectors increasingly supplement traditional ngram-, system-call-, and behavior-based features with deep learning on raw bytes.Raw-byte models aim to learn relationships among executable sections automatically.
- Threat: Adversarial examples manipulate inputs so malware detectors misclassify programs, while executable-file attacks must avoid disrupting headers, code, or functionality.Changing code or headers can completely compromise the file.
- Approach: The proposed gradient-based attack maximizes benign-class probability by changing selected padding bytes appended after each malware file.Restricting changes to appended padding is intended to preserve intrusive functionality, while MalConv is the targeted raw-byte network.
- Results: 13,195 Windows PE samples showed MalConv accuracy decreased by over 50% after injecting 10,000 padding bytes, less than 1% of input bytes.The attack also outperformed random byte injections.
- Implication: Robust detection cannot safely rely on blindly analyzing executable bytes without accounting for which bytes adversaries can manipulate.The authors present this as preliminary evidence and emphasize proactive training or prior knowledge of manipulable bytes.
II. PORTABLE EXECUTABLE (PE) FORMAT
Portable Executable files have an organized structure that supports executable content and metadata.
- II. PORTABLE EXECUTABLE (PE) FORMAT: Portable Executable files are executables with an organized internal structure.The paper introduces this structure before describing practical byte modifications.
A. PE File Basics
PE files organize executable metadata and content into headers, a section table, and section data, with different sections serving distinct roles.
- PE File Basics: The header stores executable metadata, including section sizes, operating-system type, file role, entry point, and code-section size.It contains DOS, true PE, and optional-header subsections.
- PE File Basics: The section table describes each section’s memory mapping range and identifies where compiler- or assembler-generated data is stored.Its references connect section characteristics to loaded memory layout.
- PE File Basics: Section data contains content such as instructions in .text, initialized variables in .data, constants and debug directories in .rdata, and imports in .idata.These sections differ in both content and operational role.
B. Manipulating PE Files
PE binaries can be modified without changing execution, but safe manipulation depends on file structure and may expose detectable changes or threaten integrity.
- Manipulating PE Files: Unused regions, new unreachable sections, and end-of-file appending provide simple ways to inject bytes while preserving execution.Appending bytes can be detected by inspecting the file header or section table.
- Manipulating PE Files: Debug-information bytes can sometimes be changed safely, whereas packing is unsuitable for fine-grained file modifications.Debug information serves developers as a reference, while packing compresses executable content for runtime decompression.
- Manipulating PE Files: Changing .text may break the program, and adding bytes to an existing section requires corresponding header and section-table updates.The paper therefore uses byte appending as its modification strategy for simplicity.
III. DEEP LEARNING FOR MALWARE BINARY DETECTION
MalConv processes fixed-length byte sequences by embedding each byte and applying gated convolutional layers before classification.
- MalConv pads or truncates executable bytes to a fixed-dimensional input vector of d elements.Inputs shorter than d are zero-padded; longer inputs contribute only their first d bytes.
- Each byte is mapped through a learned function φ to an 8-dimensional embedding, forming matrix Z ∈ R^d×8.
- Gated convolutional layers combine ReLU and sigmoidal outputs to reduce vanishing-gradient effects.
- Temporal max pooling feeds the convolutional representation into a fully connected ReLU layer for classification.
IV. ADVERSARIAL MALWARE BINARIES
The attack appends carefully selected bytes and uses gradients in the embedding space to choose discrete byte values that reduce malicious-class confidence while preserving functionality.
- The attack appends up to qmax carefully selected bytes while minimizing malicious-class confidence under the available input-length constraint.The feasible injection count is q = min(k+qmax, d)−k.
- The method approximates gradient descent by optimizing padding bytes one at a time despite MalConv’s non-differentiable lookup embedding.It computes the negative gradient with respect to each embedded byte rather than the discrete byte directly.
- For each byte, the algorithm selects the embedded value nearest the gradient-aligned line among candidates projected in the descent direction.The distance is d_i = ∥m_i − (z_j + s_i · n_j)∥_2 with s_i > 0.
- The procedure repeats across modifiable padding bytes from a random initialization for at most T iterations, stopping when the benign-class objective crosses its threshold.
- The attack can target any functionality-preserving byte, although this paper uses byte appending for simplicity.If k ≥ d, then q ≤ 0 and no byte can be manipulated by this attack.
V. EXPERIMENTS
Experiments reproduced MalConv and evaluated it on malware and benign Windows samples using repeated train-test splits before testing evasion attacks.
- The dataset contains 9,195 malware samples from VirusShare, Citadel, and APT1, plus 4,000 benign samples.
- The network was evaluated with three repeated 50%-50% training-test splits to reduce dependence on a specific division.
- MalConv achieved average precision of 92.83 ± 5.56% and average recall of 84.68 ± 11.71%.Values are means and standard deviations across the repeated splits.
A. Results on Evasion Attacks
Gradient-based byte selection substantially outperformed random appending: 10,000 padding bytes yielded 60% evasion while changing less than 1% of input bytes.
- Random byte injection was not effective, whereas the gradient-based attack’s evasion rate increased as more bytes were added.Figure 3 plots evasion rate against the number of injected bytes.
- 60% of cases evaded MalConv when 10,000 padding bytes were modified, despite manipulating less than 1% of input bytes.
- The gradient-based attack creates a sample-specific padding pattern by repeatedly injecting a small group of byte values.Figure 4 compares value distributions for random and gradient-based injections in one malware sample.
B. Limitations of Our Analysis
The analysis is constrained by dataset and input-size choices that may facilitate MalConv evasion, while appending bytes weakens the gradient-based attack because gradients are larger near file beginnings.
- B. Limitations of Our Analysis: The study used a smaller dataset and input size d = 10^6 than prior work, factors that may facilitate MalConv evasion.The comparison baseline used a larger dataset and d = 2·10^6.
- B. Limitations of Our Analysis: Appending bytes at the end of files reduces the effectiveness of the gradient-based approach.The average gradient norm is much higher for the first bytes than for later positions.
- B. Limitations of Our Analysis: Modifying early bytes could improve evasion, but changing bytes within executable files is complex and may compromise functionality.The probability of finding informative bytes decreases away from the first bytes, whereas internal modification depends on file structure and section content.
VI. CONCLUSIONS AND FUTURE WORK
The paper concludes that raw-byte neural malware detectors have a serious adversarial vulnerability: optimized byte changes can evade MalConv, challenging byte-based analysis and motivating more robust methods and broader evaluation.
- VI. CONCLUSIONS AND FUTURE WORK: The proposed gradient-based attack modifies optimized bytes at malware-file ends and achieves a maximum MalConv evasion rate of 60%.The attack targets neural-network malware detectors that use raw bytes as input.
- VI. CONCLUSIONS AND FUTURE WORK: These results question the adequateness of byte-based analysis because raw-byte deep learning may introduce novel security vulnerabilities.The paper notes that executable sections can have strong semantic differences, challenging the assumption that all bytes are equally important.
- VI. CONCLUSIONS AND FUTURE WORK: Future work will study finer-grained automatic executable changes, larger datasets representative of recent malware, and more robust principled detection methods.The proposed changes may be harder to counter than padding-byte injection at file ends.