Source-linked AI summary
Functionality-preserving Black-box Optimization of Adversarial Windows Malware
Luca Demetrio, Battista Biggio, Giovanni Lagorio, Fabio Roli, Alessandro Armando
TL;DR
Existing black-box attacks on Windows malware detectors are inefficient and may require repeated sandbox execution to preserve functionality. This paper introduces attacks that inject benign, non-executed content while optimizing evasion against payload size, and reports successful evasion of static detectors and commercial antivirus engines. The approach is limited against classifiers using features from dynamic execution.
Problem
Existing black-box malware-evasion attacks can require many queries and repeated sandbox execution to preserve intrusive functionality.
Method
The paper injects benign content at the file end or in newly created sections and formalizes attack design as constrained minimization over evasion probability and payload size.
Results
The attacks bypass two static Windows malware detectors with few queries and small payloads, including label-only access, and section injection evades more than 12 commercial antivirus engines on average.
Takeaways & Limitations
Benign-content injection can provide query-efficient, functionality-preserving evasion against static malware detectors and can transfer to commercial antivirus solutions.
Takeaways & Limitations
The approach is not effective against systems whose features are computed by dynamically executing the input program.
Abstract
from arXiv · showhide
Windows malware detectors based on machine learning are vulnerable to adversarial examples, even if the attacker is only given black-box query access to the model. The main drawback of these attacks is that: (i) they are query-inefficient, as they rely on iteratively applying random transformations to the input malware; and (ii) they may also require executing the adversarial malware in a sandbox at each iteration of the optimization process, to ensure that its intrusive functionality is preserved. In this paper, we overcome these issues by presenting a novel family of black-box attacks that are both query-efficient and functionality-preserving, as they rely on the injection of benign content - which will never be executed - either at the end of the malicious file, or within some newly-created sections. Our attacks are formalized as a constrained minimization problem which also enables optimizing the trade-off between the probability of evading detection and the size of the injected payload. We empirically investigate this trade-off on two popular static Windows malware detectors, and show that our black-box attacks can bypass them with only few queries and small payloads, even when they only return the predicted labels. We also evaluate whether our attacks transfer to other commercial antivirus solutions, and surprisingly find that they can evade, on average, more than 12 commercial antivirus engines. We conclude by discussing the limitations of our approach, and its possible future extensions to target malware classifiers based on dynamic analysis.
I. INTRODUCTION
Machine-learning Windows malware detectors face adversarial black-box attacks, but existing methods are inefficient and manipulate inputs extensively. The paper proposes targeted, functionality-preserving content injection to improve evasion efficiency.
- Black-box malware attacks can bypass learning-based Windows detectors using only query access to the target model.
- Existing attacks are inefficient because they iteratively apply untargeted transformations such as random-byte injection.Their limitations include query count, optimization complexity, and the amount of input manipulation.
- The paper introduces black-box attacks that inject benign content specifically targeted to facilitate evasion.The content is extracted from benign samples rather than randomly generated.
- The proposed manipulations preserve malware functionality by exploiting ambiguities in the executable file format.
- Experiments on two learning-based Windows malware detectors evaluate the trade-off between detection and injected size.The attacks bypass the considered detectors after only a few iterations and changes, including when models return only predicted labels.
II. PROGRAMS AND MALWARE DETECTION
This section introduces the Windows Portable Executable format and the two learning-based Windows malware detectors used in the study.
- The Windows PE format specifies how programs are stored on disk and loaded into memory for execution.
- The section then introduces two popular learning-based Windows malware detectors used throughout the paper.
A. The Windows Portable Executable (PE) File Format
Windows PE files contain structured components that guide operating-system loading and execution. Their structure also provides information that can support static malware detection without executing suspicious programs.
- The Windows PE format consists of several structured components, including the DOS Header, PE Header, and Optional Header.The DOS Header contains loading metadata and a DOS stub, while the PE Header and Optional Header provide executable characteristics and loading information.
- The DOS Header includes a pointer at offset 0x3c to the real header; corrupting key header values prevents operating-system execution.
- Executable structure can be used to statically infer information about program behavior.
- Static analysis avoids executing suspicious software on the host operating system, saving time and resources.The paper describes static analysis as the first line of defense against malware.
B. Learning-based Windows Malware Detection
The paper studies two publicly released EndGame detectors trained on the EMBER dataset: MalConv, a neural model operating on executable bytes, and GBDT, a fixed-feature tree model.
- Both detectors were coded, trained, and publicly released by EndGame using the EMBER dataset.
- MalConv: MalConv is an end-to-end convolutional neural network that processes the first 2 MB of an executable and returns its malware probability.
- MalConv: MalConv’s convolutional layers correlate spatially distant bytes such as jumps and function calls.
- GBDT: GBDT uses a fixed representation of 2,381 features extracted from general file and header information.
III. BLACK-BOX OPTIMIZATION OF ADVERSARIAL WINDOWS MALWARE
GAMMA formulates functionality-preserving malware evasion as a black-box constrained optimization problem, minimizing detector output while penalizing injected payload size. A genetic optimizer searches benign-content manipulations under a query budget and supports hard-label feedback.
- Framework: GAMMA uses PE-format manipulations to inject benign content without altering the malware’s execution traces.This avoids computationally demanding functionality-validation steps during optimization.
- Optimization objective: The attack minimizes detector output plus λ-weighted payload cost, explicitly trading evasion effectiveness against injected size.The penalty C(s) measures injected bytes, while λ controls the trade-off.
- Optimization objective: The manipulation vector selects fractions of bytes from a predefined set of benign sections, with payload size represented by a weighted ℓ1 penalty.This formulation promotes sparse solutions using content from only a few benign sections.
- Genetic optimization: A query constraint q ≤ T bounds black-box evaluations, with larger T improving optimization at increased computational cost.The genetic optimizer initializes candidate populations and applies selection, crossover, and mutation.
- Genetic optimization: Each iteration evaluates N new candidates, retains the best population, and stops at the query budget or earlier convergence.The returned manipulation vector s⋆ produces the best candidate found.
- Hard-label feedback: For hard-label detectors, GAMMA assigns zero to benign predictions and infinity to malicious ones, discarding candidates that remain detected.The method can still find evasive variants by injecting sufficiently large benign content before further optimization.
A. Functionality-preserving manipulations
The framework uses PE-file regions and structural ambiguities to inject adversarial content while preserving executable behavior. Padding and section injection illustrate complementary ways to add content, with section injection additionally modifying the executable structure.
- Functionality-preserving manipulations: Functionality-preserving manipulations exploit PE regions that are unused or nonessential during execution.Examples include slack space, padding, DOS-header changes, content shifting, and import-function injection.
- Functionality-preserving manipulations: Padding appends bytes in unused executable space without altering the file’s structure.It is described as the easiest manipulation among the listed techniques.
- Functionality-preserving manipulations: Section injection adds custom content while also adding a section entry to the executable’s section table.This structural change distinguishes it from padding and related unused-space techniques.
IV. EXPERIMENTS
The experiments evaluate GAMMA against GBDT and MalConv, examining detection, payload size, query budgets, hard-label access, packing, and transfer to commercial antivirus engines. Section injection bypasses an average of more than 12 VirusTotal detectors while random payloads are less effective.
- Attack evaluation: GAMMA optimizes the trade-off between detection and payload size across multiple λ values and query budgets.The experiments use λ values of {10^-i}^9 and report mean detection rate and mean adversarial payload size for each setting.
- Attack evaluation: 500 malware samples were used for adversarial attacks, with payload size and detection rate evaluated across query counts and regularization values.The attack set included ransomware, downloaders, viruses, backdoors, grayware, worms, and other families.
- Hard-label attacks: Hard-label attacks remain effective after an evasive payload is found, then optimize its size across genetic-algorithm iterations.The injected benign content supports evasion, while the query budget regularizes the payload-size and confidence trade-off.
- Packing: UPX packing increases both detectors' scores toward the malware class, with little change in mean and variance for packed malware.The figure compares GBDT and MalConv confidence distributions against a decision threshold.
- Transfer to antivirus programs: 12.01 VirusTotal detectors were evaded on average by section injection, compared with 5.76 for random attacks.The comparison averages detections over 200 malware samples and covers 70 VirusTotal antivirus programs.
- Transfer to antivirus programs: Section injection drastically decreases detection rates for several commercial antivirus products and outperforms random attacks in cases including AV1 and AV9.The evaluation covers nine antivirus products from the 2019 Gartner Magic Quadrant for Endpoint Protection Platforms.
V. RELATED WORK
The related-work discussion contrasts GAMMA with reinforcement-learning and other black-box attacks that use different optimization settings, query budgets, and manipulation assumptions. It emphasizes GAMMA's functionality-preserving design and avoidance of sandbox validation as distinguishing features.
- Reinforcement learning: Prior reinforcement-learning work used roughly 1600 queries to train policies, while not reporting the resulting adversarial malware file size.Its actions can enlarge the on-disk representation, but the amount of enlargement was not clear.
- Comparison framework: Table V compares black-box Windows malware attacks by functionality preservation, sandboxing requirements, optimization approach, and attack stealthiness.The table uses FP, NS, AO, and ST to summarize these dimensions.
- Comparison with prior attacks: GAMMA differs from prior approaches by using functionality-preserving manipulations and not requiring sandbox validation of adversarial malware.The paper attributes this to incorporating domain knowledge into the mutation process.
VI. LIMITATIONS AND OPEN ISSUES
The paper identifies unexamined mitigation strategies and a scope boundary: its structure-only manipulations do not address dynamically analyzed malware detectors.
- Countermeasures: The work does not investigate mitigation strategies, though it suggests robust features, adversarial retraining, and attack-specific detection as possible defenses.Graph-based static representations may be more computationally demanding, and practical transformations affecting them could potentially be incorporated into the optimization framework.
- Countermeasures: Analyzing consecutive queries from one source is proposed as a way to detect correlated black-box attacks.
- Dynamic classifiers: The approach is not effective against dynamic classifiers because its manipulations alter executable structure without changing execution.Behavioral manipulations such as binary rewriting are identified as a possible extension.
VII. CONCLUSIONS AND FUTURE WORK
The paper concludes that benign-content injection yields query-efficient, functionality-preserving black-box attacks against learning-based Windows malware detectors. It reports bypasses with few queries and small payloads, including transfer to commercial antivirus engines, while identifying dynamic analysis as an open extension.
- Conclusions: The attacks inject benign content that is never executed, preserving execution traces while optimizing evasion probability against payload size.
- Empirical findings: The attacks bypass two learning-based Windows malware detectors with few queries and very small payloads, even when models return only predicted labels.
- Empirical findings: The attacks evade, on average, up to 12 commercial antivirus engines available on VirusTotal.
- Future work: Such extensions could improve evaluation and adversarial robustness for malware detectors using dynamic program-analysis features.