Abstract:During the past four years, Flash malware has become one of the most insidious threats to detect, with almost 600 critical vulnerabilities targeting Adobe Flash disclosed in the wild. Research has shown that machine learning can be successfully used to detect Flash malware by leveraging static analysis to extract information from the structure of the file or its bytecode. However, the robustness of Flash malware detectors against well-crafted evasion attempts - also known as adversarial examples - has never been investigated. In this paper, we propose a security evaluation of a novel, representative Flash detector that embeds a combination of the prominent, static features employed by state-of-the-art tools. In particular, we discuss how to craft adversarial Flash malware examples, showing that it suffices to manipulate the corresponding source malware samples slightly to evade detection. We then empirically demonstrate that popular defense techniques proposed to mitigate evasion attempts, including re-training on adversarial examples, may not always be sufficient to ensure robustness. We argue that this occurs when the feature vectors extracted from adversarial examples become indistinguishable from those of benign data, meaning that the given feature representation is intrinsically vulnerable. In this respect, we are the first to formally define and quantitatively characterize this vulnerability, highlighting when an attack can be countered by solely improving the security of the learning algorithm, or when it requires also considering additional features. We conclude the paper by suggesting alternative research directions to improve the security of learning-based Flash malware detectors.

Dismantling Common Internet Services for Ad-Malware Detection

Ads and Fraud: A Comprehensive Survey of Fraud in Online Advertising

A First Look at Ad-block Detection: A New Arms Race on the Web

Understanding In-App Ads and Detecting Hidden Attacks Through the Mobile App-Web Interface

Beyond the Blacklist: Modeling Malware Spread and the Effect of Interventions

An Adversarial Attack Analysis on Malicious Advertisement URL Detection Framework

A Malware Classification Survey on Adversarial Attacks and Defences

Online Advertising Security: Issues, Taxonomy, and Future Directions

The Devil is in the Details: Analyzing the Lucrative Ad Fraud Patterns of the Online Ad Ecosystem

A Study of Malware Prevention in Linux Distributions

What Makes a “Bad” Ad? User Perceptions of Problematic Online Advertising

Malware Detection and Analysis Tools

Adversarial Detection of Flash Malware: Limitations and Open Issues

Block the blocker: Studying the effects of Anti Ad-blocking

Measuring Abuse in Web Push Advertising

"Are Adversarial Phishing Webpages a Threat in Reality?" Understanding the Users' Perception of Adversarial Webpages

Malware Characteristics and Threats on the Internet Ecosystem

Click Fraud Detection On The Advertiser Side

Exploitation of Human Trust, Curiosity and Ignorance by Malware

MadDroid: Characterizing and Detecting Devious Ad Contents for Android Apps

Artificial Intelligence-Based Malware Detection, Analysis, and Mitigation