PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Deep Ensemble: Evasion Attacks and Defenses for Malware Detection

Deqiang Li, Qianmu Li

arXiv:2006.16545v1cs.CRcs.LGstat.ML

TL;DR

Machine-learning malware detectors face functionality-preserving evasion attacks, and ensemble methods can aid either defense or attack. The paper proposes mixture of attacks and adversarially trained deep ensembles, finding broader robustness from the training approach but effective evasion by ensemble attacks, including notable degradation of VirusTotal.

  • Problem

    Malware detectors are vulnerable to evasion attacks, while the opposing effects of ensemble defenses and ensemble attacks remain insufficiently understood.

  • Method

    The paper combines multiple attack-generation methods and manipulation sets into mixture of attacks, then uses this mixture for adversarial training of deep neural network ensembles.

  • Results

    Across 26 attacks and two practical datasets, the new adversarial training improves robustness broadly, while ensemble attacks still evade enhanced detectors and notably downgrade VirusTotal.

  • Takeaways & Limitations

    Ensembles promote robustness when base classifiers are robust enough, but attackers’ ensemble methods can substantially improve evasion effectiveness.

  • Takeaways & Limitations

    Functionality preservation remains an unresolved practical issue: among sampled perturbed applications, only three executed successfully on the emulator.

Abstract

from arXiv · show

Malware remains a big threat to cyber security, calling for machine learning based malware detection. While promising, such detectors are known to be vulnerable to evasion attacks. Ensemble learning typically facilitates countermeasures, while attackers can leverage this technique to improve attack effectiveness as well. This motivates us to investigate which kind of robustness the ensemble defense or effectiveness the ensemble attack can achieve, particularly when they combat with each other. We thus propose a new attack approach, named mixture of attacks, by rendering attackers capable of multiple generative methods and multiple manipulation sets, to perturb a malware example without ruining its malicious functionality. This naturally leads to a new instantiation of adversarial training, which is further geared to enhancing the ensemble of deep neural networks. We evaluate defenses using Android malware detectors against 26 different attacks upon two practical datasets. Experimental results show that the new adversarial training significantly enhances the robustness of deep neural networks against a wide range of attacks, ensemble methods promote the robustness when base classifiers are robust enough, and yet ensemble attacks can evade the enhanced malware detectors effectively, even notably downgrading the VirusTotal service.

I. INTRODUCTION

The paper studies how ensemble defenses and attacks interact in adversarial malware detection. It proposes mixture-of-attacks and adversarial training for deep ensembles, then evaluates their robustness against diverse evasion attacks.

  • Motivation: Machine-learning malware detectors can be evaded by small functionality-preserving manipulations that make malicious examples appear benign.This motivates adversarial malware detection research.
  • Research question: The paper asks how robust ensemble defenses and how effective ensemble attacks are when they directly combat each other.Attackers may attack multiple classifiers or use multiple attack methods.
  • Contributions: Mixture of attacks combines multiple generative methods and manipulation sets, accommodating discrete malware inputs and malicious-functionality preservation.The approach adapts max attacks and gradient-free attacks for Android malware detection.
  • Contributions: Adversarial training with the mixture of attacks is used to harden an ensemble of deep neural networks, with theoretical analysis.The training uses manipulation sets with cardinality as large as possible.
  • Evaluation: The evaluation covers 26 evasion attacks across gradient-based, gradient-free, obfuscation, mixture, and transfer categories on practical Android-malware datasets.The experiments use Drebin and Androzoo.
  • Findings: Hardened models outperform baseline defenses against evasion attacks, but all models remain vulnerable to benign-mimicking attacks and mixture attacks.Adversarial deep ensembles can also reduce detection accuracy on malicious and benign examples.
  • Findings: Ensembles improve robustness when their base classifiers are already robust, whereas their usefulness is undetermined for vulnerable base models.The results support the paper’s theoretical analysis.
  • Findings: The iterative max-PGDs+GDKDE attack notably degrades VirusTotal, indicating practical cybersecurity relevance for adversarial evasion.The paper also reports robustness-related feature emphasis alongside lower non-adversarial accuracy.

B. Ensemble Defenses

The paper frames deep ensembles and adversarial training as defenses against evasion attacks, while formalizing attacks in file and feature spaces under functionality-preserving constraints.

  • Prior defenses: Prior ensemble defenses include bagging, random subspaces, specialist ensembles, feature squeezing, outlier detection, resilience, and stacking, but earlier defenses can remain vulnerable.The paper distinguishes its adversarial-training-based ensemble from these approaches.
  • Adversarial deep ensemble: The proposed defense enhances an ensemble model through adversarial training while incorporating a mixture of attacks and theoretical analysis.This targets a broad range of evasion attacks in Android malware detection.
  • Ensemble model: A deep ensemble combines multiple DNNs through a weighted linear combination, with nonnegative weights summing to one.The classifier maps extracted feature vectors to benign or malicious labels.
  • Ensemble model: For attacks, the paper uses logit ensembling and predicts the class with the largest resulting score.Each DNN contributes logits, with stabilization by subtracting the maximum logit value.
  • Attack formulation: Evasion attacks perturb test-phase malware while preserving malicious functionality, either directly in file space or through feature-space manipulations.File-space manipulations include operations such as functionality-preserving junk-code injection.
  • Attack formulation: Feature-space attacks rely on inverse feature extraction to turn perturbed representations into executable malware examples.The formulation constrains the perturbation, the manipulation set, and the classifier’s resulting label.
  • Assumptions and limitations: The bounded-representation assumption does not capture dependent feature changes, and enforcing functionality preservation may break the intended feature perturbation exactly.The authors report that this side effect usually has little impact because most used features are independent.

2) Threat Models:

The threat model defines attacker capabilities, knowledge levels, and attack families for malware evasion, spanning white-box, black-box, and grey-box settings.

  • Attacker capabilities: Attackers perturb malware during testing, preserve malicious functionality, and may seek misclassification by maximizing classifier loss.The model treats functionality preservation as a core capability constraint.
  • Attacker knowledge: White-box attackers know the target system and defenses, black-box attackers observe only predicted labels, and grey-box attackers have intermediate knowledge.The grey-box setting can include knowledge of data, feature extraction, and learning algorithm but not defenses or learned parameters.
  • Attack families: The paper considers gradient-based attacks that use classifier-loss gradients to generate adversarial examples.PGD is described as maximizing classifier loss under norm-based constraints.
  • Attack families: Gradient-free attacks include Mimicry, salt-and-pepper noise, and pointwise manipulation, with Mimicry targeting benign-like representations.These methods avoid reliance on classifier gradients.
  • Attack families: Obfuscation attacks modify malware files without querying or knowing the victim model, whereas transfer attacks use a surrogate model to target the classifier.Examples include variable renaming for obfuscation and reverse-engineered surrogate models for transfer attacks.

C. Minmax Adversarial Training

Minmax adversarial training augments classifier training with adversarial examples generated by maximizing loss over a predefined perturbation set, though the inner optimization is difficult for non-convex DNNs.

  • Training objective: Adversarial training augments training data with adversarial examples so classifiers proactively encounter specified attacks.The minmax formulation represents a worst-case attack during training.
  • Attack generation: The described implementation includes salt-and-pepper and pointwise attack procedures that take feature representations, labels, classifiers, and manipulation sets as inputs.Both procedures output perturbed points after iterative modifications.
  • Training objective: The minmax objective seeks model parameters that minimize loss against the highest-loss perturbation in the allowed manipulation set.The perturbed representations are restricted to a predetermined set.
  • Optimization challenge: The inner maximization is intractable for non-convex DNNs and therefore may return local maxima.This limits exact worst-case optimization in practice.

IV. METHODOLOGY

The mixture of attacks lets attackers combine multiple generative methods and manipulation sets while preserving malware functionality. It evaluates attack strength through classifier loss and constructs attacks that maximize this score.

  • Mixture of attacks perturbs malware using multiple attack methods and manipulation sets.The approach is presented as practical for Android packages, where different files or hidden objects can be manipulated.
  • A generative method maps a representation and permitted manipulation set to a perturbed representation.Formally, h takes x subject to Mx ∈ ∆x and returns x′ = h(Mx; x).
  • Attack strength is measured using classifier loss, with higher loss indicating a stronger attack.
  • Unlike single-method strategies, the mixture constructs n generative methods and combines them to wage an attack.The formulation allows n ≥ 1 generative methods and m ≥ 1 manipulation sets.
  • Two strategies are introduced to realize the mixture: a direct max strategy and an iterative version.

2) Two Attack Strategies: •

The attack strategies select effective method–manipulation combinations, either once or repeatedly. The iterative version adds perturbations to successive outputs and stops after a preset iteration count or convergence.

  • Max strategy: The max strategy selects a generative method and manipulation set jointly to produce the optimal attack.
  • Iterative max strategy: The iterative max strategy repeatedly applies the max strategy to the example produced in the preceding round.The first round operates on x, while later rounds use the previous perturbed result.
  • Algorithm: The max attack selects the optimal attack-method and manipulation-set combination before the iterative procedure continues.
  • Algorithm: Algorithm 3 takes a feature representation-label pair, score measurement, iteration count, and ε, then outputs a perturbed point.
  • Iterative max strategy: The iterative procedure halts at the predetermined iteration count or when the score change falls below ε, such as 10^-9.It is described as greedily improving effectiveness by exploring more directions.

B. Adversarial Deep Ensemble

Adversarial deep ensemble training incorporates the max attack and diversifies base classifiers with distinct attacks. Its design covers multiple approximate maximizers, many manipulation sets, and a deep ensemble while retaining a classifier trained on pristine data.

  • Adversarial training incorporates the max attack to enhance the robustness of a deep ensemble.
  • The defender represents the attacker’s method space H and manipulation-set space ∆x without direct access to the attacker’s empirical sets.
  • Compared with the prior setup, H contains multiple approximate maximizers and ∆x contains a huge number of manipulation sets.
  • The defended model is a deep ensemble, and gradient-based maximizers are selected for efficiency while aiming to cover a wide range of attacks.
  • The method uses the union of all manipulation sets, Mx = S ∆x, to produce adversarial examples.Theorem 1 relates larger manipulation sets to classifier-loss maximization under the stated inclusion condition.
  • Limitation: The theoretical result requires the generative method to exactly maximize loss, although preliminary experiments indicate projected-gradient maximizers follow it well.
  • Base classifiers are regularized with distinct adversarial attacks, while the lth classifier is trained on pristine examples.The objective includes regularization for each base classifier, with approximate maximizers supplying adversarial examples.

2) Combination:

The analysis measures ensemble robustness through logit error relative to an ideal DNN and derives conditions under which an ensemble can outperform its best base classifier. It also identifies failure when constituent classifiers cannot resist evasion attacks.

  • Robustness is quantified by relaxing average mean square error over logits between an ideal DNN and a learned DNN.
  • The analysis uses an adversarial example set and defines the logit offset between ideal and learned networks.
  • The logit-ensemble analysis can be extended to other ensemble outputs, such as softmax.
  • Theoretical condition: The theoretical condition assumes non-negative error correlation among base classifiers trained on the same dataset for similar tasks.
  • Theoretical result: Under the deep-ensemble condition, the ensemble error can be smaller than the best base DNN’s error.
  • Theoretical result: The ensemble error can be arbitrarily large when its base classifiers cannot resist evasion attacks.

V. EXPERIMENTS AND EVALUATION

The experiments evaluate Android malware defenses on Drebin and Androzoo using several DNN, adversarial-training, and ensemble configurations. Models are trained and selected under specified optimization settings and validation criteria.

  • Datasets and evaluation: Evaluation uses Android malware detectors trained and tested on the Drebin and Androzoo datasets.Drebin includes 5,615 malicious packages and 42,333 downloaded benign APKs; Androzoo contributes 15,467 malware and 91,295 benign examples after VirusTotal labeling.
  • Feature processing: Feature extraction uses eight Drebin feature subsets, and applications are represented as binary vectors after retaining the 10,000 most frequent features.Androguard 3.3.5 performs static APK analysis; 141 Drebin APKs could not be analyzed.
  • Compared defenses: The study compares Basic DNN, adversarially trained DNNs, mixture-of-attacks training, and ensemble variants including ADE-MA and dADE-MA.The configurations differ by their inner maximizer and, for dADE-MA, diversity promotion.
  • Training setup: The DNNs use two fully connected hidden layers with 160 neurons each and ReLU activations, while training uses Adam for 150 epochs with mini-batches of 128.The inner PGD maximizer uses step size 0.01 for 100 iterations, and the Adam maximizer uses step size 0.02 for 100 iterations.
  • Model selection: Models are selected by validation accuracy, with adversarial-training selection also considering accuracy on adversarial examples produced by the corresponding inner maximizer.The selected model is then used for evaluation.

3) Specifying Manipulations:

The manipulation design spans both feature-space and file-space changes, including additive and subtractive operations while requiring malware functionality to remain intact. The feature-space set supports both binary transition directions where applicable.

  • File-space manipulations: File-space manipulations include incremental changes such as inserting manifest features, junk code, and other APK content.Examples include requesting extra permissions, adding activities or services, and injecting junk code into dex files.
  • File-space manipulations: Decremental file-space manipulations modify or rename APK information, but some objects cannot be removed entirely because they correspond to code components.Related references in the dex code must be modified consistently when an activity is renamed.
  • Functionality preservation: Automated file manipulation must preserve malware functionality because small compilation errors can make an APK un-executable.The paper notes that dynamic analysis tools such as Sandboxing may estimate whether malicious functionality is preserved.
  • Feature-space manipulations: Feature-space manipulations flip binary features from 0 to 1 or from 1 to 0 by adding, removing, or hiding APK objects.Examples include increasing components, system APIs, and IP addresses, or removing activity names and public or static APIs.

B. Evaluating the Effectiveness of Attacks and Defenses

The evaluation measures six malware classifiers on Drebin and Androzoo without attacks and under diverse evasion attacks, including gradient-based, gradient-free, obfuscation, mixture, and transfer attacks. Mixture-based adversarial training improves robustness broadly, but ensemble defenses remain vulnerable to several attacks and transfer attacks can downgrade VirusTotal.

  • Evaluation setup: The study evaluates six classifiers on Drebin and Androzoo using standard FNR, FPR, accuracy, balanced accuracy, and F1 metrics.The attack evaluation covers 26 evasion attacks across five categories.
  • No-attack effectiveness: AT-MA achieves the lowest no-attack FNR—1.59% on Drebin and 1.32% on Androzoo—but adversarial training increases FPR by up to 4.64% and 3.84%, respectively.The broader trade-off includes lower F1 score, while ensemble defenses can further reduce effectiveness.
  • Attack robustness: AT-MA, ADE-MA, and dADE-MA achieve at least 90.13% under 19 attacks, 88.25% under 18 attacks, and 89.75% under 19 attacks, respectively.These defenses outperform the basic and alternative hardened models overall, with exceptions under GDKDE and obfuscation attacks.
  • Attack robustness: ADE-MA and dADE-MA improve robustness against gradient-free, obfuscation, and transfer attacks but reduce accuracy against I-“max” PGDs by 26.88% and 12.38% relative to AT-MA.All defenses remain weak against GDKDE, PGD-ℓ∞, Mimicry×30, Pointwise, and the three mixture attacks.
  • Dataset and attack effects: Robustness varies with dataset and attack: gradient-based attacks are less competitive than gradient-free attacks on Androzoo, contrary to Drebin.The authors attribute this difference to malicious features being closer to benign features in Androzoo.
  • Iteration effects: With increasing iterations, GDKDE eventually evades all hardened models, while dADE-MA can outperform ADE-MA against several attacks at large iteration counts.AT-MA and ADE-MA can exchange relative performance as iterations increase.
  • Transfer attack: The transfer mixture attack lowers VirusTotal detections for most perturbed examples, but it does not evade the service completely and affects scanners unevenly.Kaspersky, ESET-NOD32, and F-Secure are barely affected, whereas McAfee, Comodo, and Symantec show vulnerability.
  • Feature analysis: Feature analysis examines dADE-MA and I-“max” PGDs+GDKDE by ranking influential features with a surrogate model and masking them to measure accuracy changes.Among the top 20 features, 18 benefit benign-example detection.

VI. DISCUSSION

The discussion highlights both the practical difficulty of preserving malicious functionality during perturbation and the dual role of ensemble methods in malware detection. It also identifies feature robustness, validation, and attack design as continuing research needs.

  • Functionality Estimation: Functionality testing found that only 3 of 10 sampled perturbed applications executed successfully, underscoring the difficulty of retaining malicious behavior.Two malware examples and their perturbed versions could not run; additional applications were deployable but failed to run or could not be installed.
  • Feature Analysis: The feature table records each feature’s effect on benign or malicious classification and whether attacks flip it from 1 to 0 or 0 to 1.It summarizes the top 20 features used in dADE-MA’s defense against the I-“max” PGDs+GDKDE attack.
  • Ensemble Analysis: Under Mimicry, mean correlation coefficients were 0.4 ± 0.16 for ADE-MA and 0.56 ± 0.15 for dADE-MA.Under I-“max” PGDs+GDKDE, the corresponding means were 0.18 ± 0.22 and 0.39 ± 0.17, with most observations supporting the stated pattern.
  • Overall Findings: Adversarial deep ensembles defend against a broad range of evasion attacks but cannot thwart mimicry attacks or mixtures of attacks.Ensemble methods improve robustness when base classifiers are already robust, while also improving attack effectiveness.
  • Future Work: Future work includes effective attacks, robust feature extraction, malicious functionality estimation, defense validation metrics, and more robust defenses.The paper presents these as continuing research problems in adversarial malware detection.
Loading 2006.16545v1…