Abstract:Windows malware is predominantly available in cyberspace and is a prime target for deliberate adversarial evasion attacks. Although researchers have investigated the adversarial malware attack problem, a multitude of important questions remain unanswered, including (a) Are the existing techniques to inject adversarial perturbations in Windows Portable Executable (PE) malware files effective enough for evasion purposes?; (b) Does the attack process preserve the original behavior of malware?; (c) Are there unexplored approaches/locations that can be used to carry out adversarial evasion attacks on Windows PE malware?; and (d) What are the optimal locations and sizes of adversarial perturbations required to evade an ML-based malware detector without significant structural change in the PE file? To answer some of these questions, this work proposes a novel approach that injects a code cave within the section (i.e., intra-section) of Windows PE malware files to make space for adversarial perturbations. In addition, a code loader is also injected inside the PE file, which reverts adversarial malware to its original form during the execution, preserving the malware's functionality and executability. To understand the effectiveness of our approach, we injected adversarial perturbations inside the .text, .data and .rdata sections, generated using the gradient descent and Fast Gradient Sign Method (FGSM), to target the two popular CNN-based malware detectors, MalConv and MalConv2. Our experiments yielded notable results, achieving a 92.31% evasion rate with gradient descent and 96.26% with FGSM against MalConv, compared to the 16.17% evasion rate for append attacks. Similarly, when targeting MalConv2, our approach achieved a remarkable maximum evasion rate of 97.93% with gradient descent and 94.34% with FGSM, significantly surpassing the 4.01% evasion rate observed with append attacks.

Evading Classifier in the Dark: Guiding Unpredictable Morphing Using Binary-Output Blackboxes.

A Feature-Vector Generative Adversarial Network for Evading PDF Malware Classifiers.

Evading Pdf Malware Classifiers With Generative Adversarial Network

Evading Black-box Classifiers Without Breaking Eggs

Malware Evasion Attack and Defense

One-and-a-Half-Class Multiple Classifier Systems for Secure Learning Against Evasion Attacks at Test Time

Advanced Evasion Attacks and Mitigations on Practical ML-Based Phishing Website Classifiers

An Evasion and Counter-Evasion Study in Malicious Websites Detection

Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables

Exposing Weaknesses of Malware Detectors with Explainability-Guided Evasion Attacks

Cracking Classifiers For Evasion: A Case Study On The Google'S Phishing Pages Filter

Black-Box Evasion Attack Method Based on Confidence Score of Benign Samples

Do You Think You Can Hold Me? The Real Challenge of Problem-Space Evasion Attacks

Explainability-Informed Targeted Malware Misclassification

A3CMal: Generating Adversarial Samples to Force Targeted Misclassification by Reinforcement Learning.

Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification

Evading classifiers in discrete domains with provable optimality guarantees

Binary Black-box Evasion Attacks Against Deep Learning-based Static Malware Detectors with Adversarial Byte-Level Language Model

A Wolf in Sheep's Clothing: Practical Black-box Adversarial Attacks for Evading Learning-based Windows Malware Detection in the Wild

Automatic Evasion of Machine Learning-Based Network Intrusion Detection Systems

Intra-Section Code Cave Injection for Adversarial Evasion Attacks on Windows PE Malware File