Abstract:Recent methods have demonstrated that machine learning (ML) based static malware detection models are vulnerable to adversarial attacks. However, the generated malware often fails to generalize to production-level anti-malware software (AMS), as they usually involve multiple detection methods. This calls for universal solutions to the problem of malware variants generation. In this work, we demonstrate how the proposed method, MalwareTotal, has allowed malware variants to continue to abound in ML-based, signature-based, and hybrid anti-malware software. Given a malicious binary, we develop sequential bypass tactics that enable malicious behavior to be concealed within multi-faceted manipulations. Through 12 experiments on real-world malware, we demonstrate that an attacker can consistently bypass detection (98.67%, and 100% attack success rate against ML-based methods EMBER and MalConv, respectively; 95.33%, 92.63%, and 98.52% attack success rate against production-level anti-malware software ClamAV, AMS A, and AMS B, respectively) without modifying the malware functionality. We further demonstrate that our approach outperforms state-of-the-art adversarial malware generation techniques both in attack success rate and query consumption (the number of queries to the target model). Moreover, the samples generated by our method have demonstrated transferability in the real-world integrated malware detector, VirusTotal. In addition, we show that common mitigation such as adversarial training on known attacks cannot effectively defend against the proposed attack. Finally, we investigate the value of the generated adversarial examples as a means of hardening victim models through an adversarial training procedure, and demonstrate that the accuracy of the retrained model against generated adversarial examples increases by 88.51 percentage points.

The effects of different representations on static structure analysis of computer malware signatures

Bio-inspired data mining: Treating malware signatures as biosequences

Mining Malware Specifications through Static Reachability Analysis

Discovering Malicious Signatures in Software from Structural Interactions

From Malware Signatures to Anti-Virus Assisted Attacks

Malware Analysis Using Machine Learning and Deep Learning Techniques

A malware detection framework based on kolmogorov complexity

Impeding Behavior-Based Malware Analysis Via Replacement Attacks to Malware Specifications

MALIGN: Explainable Static Raw-byte Based Malware Family Classification using Sequence Alignment

On labeling Android malware signatures using minhashing and further classification with Structural Equation Models

MAGIC: Malware behaviour analysis and impact quantification through signature co-occurrence and regression

Misleading Malware Similarities Analysis By Automatic Data Structure Obfuscation

TS-Mal: Malware Detection Model Using Temporal and Structural Features Learnin

Assessing the Impact of Packing on Machine Learning-Based Malware Detection and Classification Systems

Automatic Malware Description via Attribute Tagging and Similarity Embedding

Malware Detection Approach Based on Artifacts in Memory Image and Dynamic Analysis

Detecting Malware Variants Via Function-Call Graph Similarity

MalwareTotal: Multi-Faceted and Sequence-Aware Bypass Tactics Against Static Malware Detection

Mitigating the Impact of Malware Evolution on API Sequence-based Windows Malware Detector

Malware Detection in Adversarial Settings