[Paper Review] Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection

Xiao Chen, Chaoran Li+6 more|arXiv (Cornell University)|Aug 10, 2018

Advanced Malware Detection Techniques44 references318 citations

TL;DR

This paper proposes a novel adversarial attack framework, Android HIV, that evades modern machine learning-based Android malware detectors by applying optimal perturbations directly to the Dalvik bytecode (classes.dex) rather than syntactic features like permissions or manifest declarations. The method uses a deep neural network substitute model to generate perturbations that preserve malware functionality while reducing detection rates to 0% on state-of-the-art detectors like MaMaDroid and Drebin, demonstrating effectiveness against semantic-feature-based models.

ABSTRACT

Machine learning based solutions have been successfully employed for automatic detection of malware on Android. However, machine learning models lack robustness to adversarial examples, which are crafted by adding carefully chosen perturbations to the normal inputs. So far, the adversarial examples can only deceive detectors that rely on syntactic features (e.g., requested permissions, API calls, etc), and the perturbations can only be implemented by simply modifying application's manifest. While recent Android malware detectors rely more on semantic features from Dalvik bytecode rather than manifest, existing attacking/defending methods are no longer effective. In this paper, we introduce a new attacking method that generates adversarial examples of Android malware and evades being detected by the current models. To this end, we propose a method of applying optimal perturbations onto Android APK that can successfully deceive the machine learning detectors. We develop an automated tool to generate the adversarial examples without human intervention. In contrast to existing works, the adversarial examples crafted by our method can also deceive recent machine learning based detectors that rely on semantic features such as control-flow-graph. The perturbations can also be implemented directly onto APK's Dalvik bytecode rather than Android manifest to evade from recent detectors. We demonstrate our attack on two state-of-the-art Android malware detection schemes, MaMaDroid and Drebin. Our results show that the malware detection rates decreased from 96% to 0% in MaMaDroid, and from 97% to 0% in Drebin, with just a small number of codes to be inserted into the APK.

Motivation & Objective

• To address the vulnerability of modern Android malware detectors that rely on semantic features from Dalvik bytecode.
• To develop a practical, automated method for generating adversarial malware examples that evade state-of-the-art machine learning detectors.
• To overcome the limitations of prior attacks that only target syntactic features like permissions or API calls.
• To demonstrate that perturbations applied directly to the bytecode can evade detectors even when they use complex semantic features such as control-flow graphs.
• To provide a proactive security assessment of current detection systems by simulating realistic adversarial scenarios.

Proposed method

• A deep neural network (DNN) substitute model is trained to approximate the behavior of the target malware detector, enabling gradient-based optimization for adversarial example generation.
• Optimal perturbations are computed using a white-box attack strategy on the substitute model, ensuring the perturbations are effective against the actual detector.
• The perturbations are applied directly to the Dalvik bytecode (classes.dex) of the APK, preserving the original malware functionality.
• An automated tool is developed to inject the perturbations into the smali code of the malware, then reassemble the APK without human intervention.
• The method respects APK file structure and feature interdependencies, ensuring the modified APK remains valid and functionally equivalent to the original.
• The attack is evaluated as a black-box attack on real-world detectors, including MaMaDroid (semantic-based) and Drebin (syntactic and semantic-based).

Experimental results

Research questions

• RQ1 Can adversarial examples be effectively generated for modern Android malware detectors that rely on semantic features from Dalvik bytecode rather than syntactic features from the manifest?
• RQ2 How can perturbations be applied to the Dalvik bytecode in a way that maintains malware functionality while evading detection?
• RQ3 To what extent can a substitute model trained on a DNN classifier effectively guide the generation of adversarial examples for black-box detection systems?
• RQ4 Can the proposed method reduce detection rates of state-of-the-art detectors like MaMaDroid and Drebin to zero with minimal code modifications?
• RQ5 Is it feasible to automate the entire adversarial example generation pipeline from code injection to APK reconstruction?

Key findings

• The detection rate of MaMaDroid, a semantic-feature-based detector, dropped from 96% to 0% after applying the adversarial perturbations.
• The detection rate of Drebin, which uses both syntactic and semantic features, also decreased from 97% to 0% with minimal code injection.
• The attack successfully evades detectors that rely on control-flow-graph features, demonstrating effectiveness beyond syntactic feature manipulation.
• The proposed method generates adversarial examples that are functionally equivalent to the original malware, preserving all malicious behaviors.
• The automated tool enables end-to-end generation of adversarial APKs without human intervention, increasing practicality and scalability.
• The results show that current state-of-the-art detectors are vulnerable to adversarial attacks when perturbations are applied at the bytecode level, highlighting a critical security gap.