[Paper Review] A Malware Classification Survey on Adversarial Attacks and Defences

Mahesh Datta Sai Ponnuru, Likhitha Amasala+2 more|arXiv (Cornell University)|Dec 15, 2023

Advanced Malware Detection Techniques4 citations

TL;DR

This survey provides a comprehensive analysis of adversarial attacks and defenses in malware classification using deep learning, categorizing methods into generative models, feature-based approaches, ensemble techniques, and hybrid strategies. It evaluates their effectiveness, limitations, and current benchmarks, offering insights into datasets, evaluation metrics, and open challenges for future research in adversarial robustness for malware detection systems.

ABSTRACT

As the number and complexity of malware attacks continue to increase, there is an urgent need for effective malware detection systems. While deep learning models are effective at detecting malware, they are vulnerable to adversarial attacks. Attacks like this can create malicious files that are resistant to detection, creating a significant cybersecurity risk. Recent research has seen the development of several adversarial attack and response approaches aiming at strengthening deep learning models' resilience to such attacks. This survey study offers an in-depth look at current research in adversarial attack and defensive strategies for malware classification in cybersecurity. The methods are classified into four categories: generative models, feature-based approaches, ensemble methods, and hybrid tactics. The article outlines cutting-edge procedures within each area, assessing their benefits and drawbacks. Each topic presents cutting-edge approaches and explores their advantages and disadvantages. In addition, the study discusses the datasets and assessment criteria that are often utilized on this subject. Finally, it identifies open research difficulties and suggests future study options. This document is a significant resource for malware categorization and cyber security researchers and practitioners.

Motivation & Objective

• To systematically review recent advancements in adversarial attacks targeting malware classification models.
• To analyze defensive strategies that enhance the robustness of deep learning models against such attacks.
• To classify and compare existing approaches into four categories: generative models, feature-based methods, ensemble methods, and hybrid tactics.
• To evaluate the performance, strengths, and limitations of current methods using standard datasets and evaluation criteria.
• To identify open research challenges and suggest directions for future work in adversarial robustness for malware detection.

Proposed method

• The authors conduct a structured literature review focusing on adversarial attack and defense techniques in malware classification.
• Methods are categorized into four types: generative models (e.g., GANs), feature-based approaches (e.g., adversarial feature perturbation), ensemble methods (e.g., model averaging), and hybrid strategies combining multiple techniques.
• The study evaluates each method based on attack success rate, model robustness, and computational efficiency.
• Standard datasets such as Malware-Benchmark and DREBIN are analyzed for consistency and representativeness in benchmarking.
• Evaluation metrics include detection accuracy, adversarial attack success rate, and robustness under various perturbation types.
• The survey synthesizes findings across studies to highlight trends, gaps, and methodological inconsistencies in current research.

Experimental results

Research questions

• RQ1 What are the primary types of adversarial attacks used against deep learning-based malware classifiers?
• RQ2 How do different defense strategies—such as adversarial training, input preprocessing, and ensemble models—perform in mitigating these attacks?
• RQ3 What are the key limitations and trade-offs in current adversarial defense mechanisms for malware detection?
• RQ4 Which datasets and evaluation protocols are most commonly used in this research area, and how do they affect reproducibility and generalization?
• RQ5 What are the major open challenges and future research directions in building robust malware classification systems under adversarial conditions?

Key findings

• Generative models, particularly GAN-based approaches, show high success in crafting adversarial malware samples that evade detection.
• Feature-based defense methods demonstrate moderate robustness but often require prior knowledge of malware structure and are sensitive to input representation.
• Ensemble-based defenses improve model robustness by combining predictions from multiple models, reducing vulnerability to targeted attacks.
• Hybrid defense strategies that combine adversarial training with input transformation show improved resilience across diverse attack types.
• Despite progress, many methods suffer from poor generalization across datasets and lack standardization in evaluation protocols.
• The study identifies a critical need for standardized benchmarks and more robust, transferable defense mechanisms to improve real-world applicability.