[Paper Review] Deceiving End-to-End Deep Learning Malware Detectors using Adversarial Examples

Felix Kreuk, Assi Barak+4 more|arXiv (Cornell University)|Feb 13, 2018

Adversarial Robustness in Machine Learning50 references104 citations

TL;DR

The paper shows how to generate adversarial examples for end-to-end CNN malware detectors by injected payloads in raw binaries, achieving high evasion rates while preserving functionality, and demonstrating payload transferability across files and positions.

ABSTRACT

In recent years, deep learning has shown performance breakthroughs in many applications, such as image detection, image segmentation, pose estimation, and speech recognition. However, this comes with a major concern: deep networks have been found to be vulnerable to adversarial examples. Adversarial examples are slightly modified inputs that are intentionally designed to cause a misclassification by the model. In the domains of images and speech, the modifications are so small that they are not seen or heard by humans, but nevertheless greatly affect the classification of the model. Deep learning models have been successfully applied to malware detection. In this domain, generating adversarial examples is not straightforward, as small modifications to the bytes of the file could lead to significant changes in its functionality and validity. We introduce a novel loss function for generating adversarial examples specifically tailored for discrete input sets, such as executable bytes. We modify malicious binaries so that they would be detected as benign, while preserving their original functionality, by injecting a small sequence of bytes (payload) in the binary file. We applied this approach to an end-to-end convolutional deep learning malware detection model and show a high rate of detection evasion. Moreover, we show that our generated payload is robust enough to be transferable within different locations of the same file and across different files, and that its entropy is low and similar to that of benign data sections.

Motivation & Objective

• Assess the vulnerability of end-to-end deep neural malware detectors to adversarial examples.
• Develop a method to generate adversarial examples for discrete binary inputs via embedding-space perturbations.
• Show that injected payloads can evade detection across multiple locations and across different malware files/families.

Proposed method

• Represent binaries as sequences of bytes and embed them into a continuous space via an embedding matrix.
• Craft adversarial embeddings by adding perturbations in Z space using FGSM/iterative methods to misclassify to benign.
• Map perturbed embeddings back to discrete bytes by choosing closest embedding tokens for each position.
• Constrain modifications to a small payload injected into non-executable sections to preserve runtime functionality.
• Use end-file and mid-file payload injections to ensure the original file remains runnable while evading detection.

Experimental results

Research questions

• RQ1 Can end-to-end CNN malware detectors operating on raw binaries be fooled by adversarial perturbations in embedding space?
• RQ2 Does injecting a small payload into a binary reliably cause misclassification while preserving functionality?
• RQ3 Are adversarial payloads transferable across different files and across positions within a file?
• RQ4 How does the payload length affect evasion capability and detection robustness?

Key findings

• Evasion rates of 99.21% (p=2) and 98.83% (p=inf) were achieved on the test set with payload lengths between 500 and 999 bytes.
• Evasion achieved while preserving binary functionality by injecting payloads into non-executable sections (mid-file or end-of-file).
• Adversarial payloads can fool the model when placed at different positions within the file (100% misclassification when repositioned).
• Payloads generated for one file achieved 75% transferability when injected into different files.
• The same payload could be effective across multiple files and malware families, indicating cross-file transferability and robustness.