Source-linked AI summary
Explaining Vulnerabilities of Deep Learning to Adversarial Malware Binaries
Luca Demetrio, Battista Biggio, Giovanni Lagorio, Fabio Roli, Alessandro Armando
TL;DR
Deep-learning malware detectors are vulnerable to adversarial examples, yet it remains unclear why malware-specific models are easily fooled. The paper uses feature attribution to interpret MalConv, finds that it relies mainly on file headers rather than data and text sections, and exploits this weakness with a few-byte header attack. The attack avoids end-of-file padding and manipulates far fewer bytes than prior methods.
Problem
Deep-learning malware detectors can be fooled by adversarial manipulations, but the reasons for this vulnerability in malware detection remain unclear.
Method
The paper applies feature attribution to interpret MalConv's decisions and identify influential features in PE malware classification.
Results
MalConv mostly relies on file-header characteristics while largely ignoring data and text sections, enabling an attack that evades it by changing few bytes.
Takeaways & Limitations
The findings show that MalConv can learn spurious header-label correlations and remain vulnerable to attacks that modify existing header bytes.
Takeaways & Limitations
The demonstrated DOS-header perturbations are easy for human experts to detect and may be patched without substantial effort.
Abstract
from arXiv · showhide
Recent work has shown that deep-learning algorithms for malware detection are also susceptible to adversarial examples, i.e., carefully-crafted perturbations to input malware that enable misleading classification. Although this has questioned their suitability for this task, it is not yet clear why such algorithms are easily fooled also in this particular application domain. In this work, we take a first step to tackle this issue by leveraging explainable machine-learning algorithms developed to interpret the black-box decisions of deep neural networks. In particular, we use an explainable technique known as feature attribution to identify the most influential input features contributing to each decision, and adapt it to provide meaningful explanations to the classification of malware binaries. In this case, we find that a recently-proposed convolutional neural network does not learn any meaningful characteristic for malware detection from the data and text sections of executable files, but rather tends to learn to discriminate between benign and malware samples based on the characteristics found in the file header. Based on this finding, we propose a novel attack algorithm that generates adversarial malware binaries by only changing few tens of bytes in the file header. With respect to the other state-of-the-art attack algorithms, our attack does not require injecting any padding bytes at the end of the file, and it is much more efficient, as it requires manipulating much fewer bytes.
1 Introduction
The paper investigates why deep-learning malware detectors are vulnerable to adversarial examples and uses feature attribution to expose what MalConv learns. It finds that MalConv relies mainly on file-header characteristics and introduces a smaller-header-modification attack.
- Malware deep-learning detectors are vulnerable to carefully crafted input manipulations, but the reasons for this vulnerability remain unclear.
- The study applies feature attribution to interpret MalConv's decisions and identify influential input features in PE malware classification.
- MalConv mostly distinguishes benign from malicious files using file-header characteristics while largely ignoring data and text sections.
- The authors propose an attack that evades MalConv by changing only a few tens of existing file-header bytes.
- Unlike prior attacks, the proposed method neither injects padding at the file end nor requires manipulating as many bytes.
2 Deep Learning for Malware Detection in Binary Files
MalConv classifies whole executable byte sequences with a deep neural network rather than extracted features. The paper questions its robustness because the network may focus on the wrong byte sequences.
- MalConv processes raw program bytes without manually extracting features, motivated by mixed code and data, cross-program correlations, and variable-length binaries.
- The network bounds inputs to 2 MB, embeds each byte, applies convolutional and temporal max-pooling layers, and classifies using a softmax output.
- The authors question MalConv's robustness because its learned rationale is unclear and it focuses on the wrong byte sequences.
3 Explaining Machine Learning
The paper explains black-box model decisions by attributing each prediction to influential features relative to a baseline. Integrated gradients satisfies sensitivity and implementation invariance, with its integral approximated numerically.
- Attribution methods assign contributions to features for a single prediction relative to a baseline representing a null signal.
- Integrated gradients satisfies sensitivity, requiring a changed feature to receive nonzero attribution when it changes the classification from the baseline.
- The method also satisfies implementation invariance, producing the same attributions for functionally equivalent networks.
- Integrated gradients integrates gradients along the line from the baseline to the input, and its attributions sum to the model-output difference.
- The integral is approximated by a discrete summation, with 20 to 300 steps described as sufficient for approximately 5% accuracy.
4 What Does MalConv Learn?
Integrated gradients reveal that MalConv relies heavily on executable headers rather than semantically meaningful malware content. This attribution pattern indicates that repeated header bytes can receive disproportionate importance.
- The experiments analyze a simplified MalConv trained on 1 MB inputs rather than the original 2 MB configuration.The input dimension is shrunk from 2^21 to 2^20 bytes.
- The attribution analysis uses an empty file as baseline because it produces a null network response, unlike a zero-filled file.The zero-byte baseline is classified as malware with 20% confidence, whereas the empty file is treated as the more suitable ground truth.
- Integrated gradients aggregate byte-level contributions across binary components to identify which regions influence MalConv’s classification.The method averages embedding-level attributions for each byte and visualizes their signed contribution across the file.
- MalConv assigns greater attribution to the COFF and optional headers than to other executable sections.Aggregated integrated-gradient contributions show that header locations outmatch the .text section and other regions.
- Although the .text section plausibly contains malicious content, MalConv’s learned important locations are described as misleading.The findings suggest that the network learned correlations that are not properly relevant for distinguishing benign and malicious programs.
5 Evading Malconv by Manipulating the File Header
The authors exploit MalConv’s header-focused behavior with an evasion algorithm that modifies existing, manipulable header bytes. Across tested malware samples, the attack frequently achieves evasion without changing embedded malicious code.
- The attack modifies only a few tens of bytes in the file header and does not inject padding at the end of the file.It changes values of existing header bytes, unlike prior attacks that append padding bytes.
- The attack’s header-only strategy is motivated by MalConv’s reliance on unreliable and spurious features.Existing attacks also preserve malware semantics by avoiding changes to embedded malicious code.
- For each manipulable header byte, the algorithm selects the closest embedded byte expected to maximize evasion probability.It computes gradients with respect to the embedding layer and stops after evasion or a maximum iteration count.
- 52 of 60 tested malware programs evade MalConv using the proposed header-perturbation attack.The samples were taken from The Zoo and Das Malverik; Figure 4 illustrates one successful example.
- Figure 4 tracks malware-classification probability across iterations while marking each iteration’s header-byte manipulation.Each iteration manipulates 58 changeable header bytes, and the blue curve shows the perturbed sample’s malware probability.
6 Related Work
Related work covers deep malware classifiers, evasion attacks against MalConv, and explainable machine-learning methods. These studies motivate interpreting classifier decisions and locating vulnerabilities in malware-detection pipelines.
- The paper positions adversarial vulnerability as a broader concern for deep-learning malware detectors, including PDF, Android, and binary classifiers.This concern motivates examining why such systems are easily fooled in cybersecurity applications.
- Deep Malware Classifiers: Prior malware classifiers use executable features such as entropy histograms, imported functions, metadata, or API calls.The surveyed approaches differ from MalConv’s direct byte-representation strategy.
- Evasion attacks against MalConv: Kolosnjaji et al. evade MalConv by appending gradient-calculated padding bytes while preserving the malware’s code semantics.Their method is described as similar to the Fast Sign Gradient Method.
- Explainable Machine Learning: LIME explains local feature importance by generating artificial samples and selecting top features with LASSO.The number of selected features is controlled by the free parameter K.
- Explainable Machine Learning: Other explainable approaches use fused LASSO or mixture regression to approximate local decision boundaries and compute feature attributions.These methods are presented as potentially useful for analyzing malware-detector predictions and misclassifications.
7 Conclusions and Future Work
The study uses integrated gradients to expose weaknesses in MalConv and shows that small byte perturbations can often evade its detection. It concludes that raw-byte malware classifiers remain vulnerable to aware adversaries and motivates less detectable attacks.
- Integrated gradients reveal that MalConv assigns nonzero importance to well-known useless locations inside Windows binaries.
- Perturbing only a few bytes evades MalConv with high probability on most samples from a concrete Internet-collected set.
- The authors plan to hide adversarial modifications in spaces between functions because DOS-header perturbations are easy for humans to detect and patch.
- The conclusion emphasizes that intelligent malware-detection technologies are not yet secure against aware adversaries.