Abstract:Malware has been one of the most damaging threats to computers that span across multiple operating systems and various file formats. To defend against ever-increasing and ever-evolving malware, tremendous efforts have been made to propose a variety of malware detection that attempt to effectively and efficiently detect malware so as to mitigate possible damages as early as possible. Recent studies have shown that, on the one hand, existing machine learning (ML) and deep learning (DL) techniques enable superior solutions in detecting newly emerging and previously unseen malware. However, on the other hand, ML and DL models are inherently vulnerable to adversarial attacks in the form of adversarial examples, which are maliciously generated by slightly and carefully perturbing the legitimate inputs to misbehave. Adversarial attacks are initially studied in the domain of computer vision like image classification, and then quickly extended to other domains, including natural language processing, audio recognition, and even malware detection. In this paper, we focus on malware with the file format of portable executable (PE) in the family of Windows operating systems, namely Windows PE malware , as a representative case to study the adversarial attack methods in such adversarial settings. To be specific, we start by first outlining the general learning framework of Windows PE malware detection based on ML/DL and subsequently highlighting three unique challenges of performing adversarial attacks in the context of Windows PE malware. Then, we conduct a comprehensive and systematic review to categorize the state-of-the-art adversarial attacks against PE malware detection, as well as corresponding defenses to increase the robustness of Windows PE malware detection. Finally, we conclude the paper by first presenting other related attacks against Windows PE malware detection beyond the adversarial attacks and then shedding light on future research directions and opportunities.

A Flexible Framework for Malicious Open XML Document Detection Based on APT Attacks

PDF File Vulnerability Detection

Malicious Word Document Detection Based on Multi-View Features Learning

A Universal Malicious Documents Static Detection Framework Based on Feature Generalization

A Research on Architecture of APT Attack Detection and Countering Technology

APTSHIELD: A Stable, Efficient and Real-time APT Detection System for Linux Hosts

Gldoc: Detection of Implicitly Malicious Ms-Office Documents Using Graph Convolutional Networks

A malware detection framework based on kolmogorov complexity

An Intelligence-Driven Security-Aware Defense Mechanism for Advanced Persistent Threats.

Mate! Are You Really Aware? an Explainability-Guided Testing Framework for Robustness of Malware Detectors

Open Source Intelligence for Malicious Behavior Discovery and Interpretation

A Model of APT Attack Defense Based on Cyber Threat Detection

IDU-Detector: A Synergistic Framework for Robust Masquerader Attack Detection

A Framework for Understanding Dynamic Anti-Analysis Defenses.

Double-Layer Detection Model of Malicious PDF Documents Based on Entropy Method with Multiple Features

Explaining and Measuring Functionalities of Malware Detectors

Capturing the symptoms of malicious code in electronic documents by file's entropy signal combined with Machine learning

De-obfuscation and Detection of Malicious PDF Files with High Accuracy

Adversarial attacks against Windows PE malware detection: A survey of the state-of-the-art

Detecting APT-Exploited Processes through Semantic Fusion and Interaction Prediction

Combating Advanced Persistent Threats: Challenges and Solutions