Abstract:For efficient malware detection, there are more and more deep learning methods based on raw software binaries. Recent studies show that deep learning models can easily be fooled to make a wrong decision by introducing subtle perturbations to inputs, which attracts a large influx of work in adversarial attacks. However, most of the existing attack methods are based on manual features (e.g., API calls) or in the white-box setting, making the attacks impractical in current real-world scenarios. In this work, we propose a novel attack framework called GAPGAN, which generates adversarial payloads (padding bytes) with generative adversarial networks (GANs). To the best of our knowledge, it is the first work that performs endto-end black-box attacks at the byte-level against deep learning based malware binaries detection. In our attack framework, we map input discrete malware binaries to continuous space, then feed it to the generator of GAPGAN to generate adversarial payloads. We append payloads to the original binaries to craft an adversarial sample while preserving its functionality. We propose to use a dynamic threshold for reducing the loss of the effectiveness of the payloads when mapping it from continuous format back to the original discrete format. For balancing the attention of the generator to the payloads and the adversarial samples, we use an automatic weight tuning strategy. We train GAPGAN with both malicious and benign software. Once the training is finished, the generator can generate an adversarial sample with only the input malware in less than twenty milliseconds. We apply GAPGAN to attack the state-of-the-art detector MalConv and achieve 100% attack success rate with only appending payloads of 2.5% of the total length of the data for detection. We also attack deep learning models with different structures under different defense methods. The experiments show that GAPGAN outperforms other state-of-the-art attack models in efficiency and effectiveness.

A Practical Adversarial Attack Against Sequence-based Deep Learning Malware Classifiers

Black-Box Adversarial Attacks Against Deep Learning Based Malware Binaries Detection with GAN

DeepMal: maliciousness-Preserving adversarial instruction learning against static malware detection

An Efficient Method for Generating Adversarial Malware Samples

Attack and Defense of Dynamic Analysis-Based, Adversarial Neural Malware Classification Models

MalAder: Decision-Based Black-Box Attack Against API Sequence Based Malware Detectors

Single-Shot Black-Box Adversarial Attacks Against Malware Detectors: A Causal Language Model Approach

Binary Black-box Evasion Attacks Against Deep Learning-based Static Malware Detectors with Adversarial Byte-Level Language Model

Adversarial Malware Sample Generation Method Based on the Prototype of Deep Learning Detector

Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables

ATWM: Defense against adversarial malware based on adversarial training

Enhanced DNNs for malware classification with GAN-based adversarial training

An Adversarial Robust Behavior Sequence Anomaly Detection Approach Based on Critical Behavior Unit Learning

SeqAdver: Automatic Payload Construction and Injection in Sequence-based Android Adversarial Attack

MalwareTotal: Multi-Faceted and Sequence-Aware Bypass Tactics Against Static Malware Detection

Practical Black-Box Attacks against Deep Learning Systems using Adversarial Examples

Adversarial Deep Learning for Robust Detection of Binary Encoded Malware

Black-Box Evasion Attack Method Based on Confidence Score of Benign Samples

A3CMal: Generating Adversarial Samples to Force Targeted Misclassification by Reinforcement Learning.

Automated Poisoning Attacks and Defenses in Malware Detection Systems: An Adversarial Machine Learning Approach

Multi-Stage Defense: Enhancing Robustness in Sequence-Based Log Anomaly Detection