[Paper Review] Defending Malware Classification Networks Against Adversarial Perturbations with Non-Negative Weight Restrictions

Alex Kouzemtchenko|arXiv (Cornell University)|Jun 23, 2018

Adversarial Robustness in Machine Learning6 references4 citations

TL;DR

This paper proposes training malware classification neural networks with non-negative weight restrictions to defend against adversarial perturbations that manipulate boolean features in Android malware. By enforcing hard non-negative weights or N1/N2 regularization, the model becomes fully resistant to gradient-based attacks that enable features to fool the classifier, achieving 0% misclassification rate with hard constraints and outperforming baseline methods including defensive distillation.

ABSTRACT

There is a growing body of literature showing that deep neural networks are vulnerable to adversarial input modification. Recently this work has been extended from image classification to malware classification over boolean features. In this paper we present several new methods for training restricted networks in this specific domain that are highly effective at preventing adversarial perturbations. We start with a fully adversarially resistant neural network that has hard non-negative weight restrictions and is equivalent to learning a monotonic boolean function and then attempt to relax the constraints to improve classifier accuracy.

Motivation & Objective

• To address the vulnerability of deep neural networks in malware classification to adversarial perturbations that enable boolean features to misclassify malicious software as benign.
• To investigate whether non-negative weight constraints can make malware classifiers fully resistant to gradient-based adversarial attacks.
• To evaluate the trade-off between adversarial robustness and classification accuracy by relaxing hard constraints through regularization techniques.
• To compare the effectiveness of non-negative weight constraints against existing defenses like defensive distillation, which may rely on gradient masking rather than true robustness.

Proposed method

• Train a fully connected deep neural network with ReLU activations and 50% dropout on the DREBIN dataset using hard non-negative weight constraints to enforce monotonicity in boolean feature learning.
• Implement N1 and N2 regularization penalties that penalize negative weights by applying L1 and L2 norms only to negative weight values, respectively.
• Explore alternative regularization placements by applying penalties to pre-sum activation values or to activations themselves to prevent large negative contributions from small negative weights.
• Use non-negative weight initialization (absolute value of Glorot normal) to accelerate convergence and improve training stability.
• Replicate Grosse et al.'s adversarial attack method by enabling only manifest-based binary features to fool the classifier, using gradient-based feature selection.
• Evaluate defenses using metrics including misclassification rate (MR), false negative rate (FNR), and false positive rate (FPR), comparing hard constraints, regularization, and distillation.

Experimental results

Research questions

• RQ1 Can hard non-negative weight constraints fully prevent adversarial perturbations in malware classification networks trained on boolean features?
• RQ2 To what extent does N1/N2 regularization improve robustness while maintaining high classification accuracy compared to hard constraints?
• RQ3 Does alternative placement of regularization (on activations or pre-sum values) enhance adversarial robustness compared to standard weight regularization?
• RQ4 How does defensive distillation compare to non-negative weight constraints in resisting adversarial attacks, and is its success due to genuine robustness or gradient masking?
• RQ5 Can non-negative weight networks still achieve high accuracy despite being restricted from learning non-monotonic boolean rules?

Key findings

• The hard non-negative weight constraint network achieved 0% misclassification rate, 6.29% FNR, and 0.75% FPR, outperforming all other methods including distillation.
• The 0.67 N1 regularization model performed worse than the hard-restricted network, with 18.86% misclassification rate, 11.15% FNR, and 1.71% FPR, indicating that soft regularization is less effective.
• N2 regularization provided no meaningful improvement in adversarial resistance, suggesting that L2 penalties on negative weights are insufficient for robustness.
• Alternative regularization placements—on activations or pre-sum values—did not improve performance, implying that the root cause lies in the weight values themselves.
• Defensive distillation at high temperatures (e.g., 100) showed low misclassification rates (3.4%) but was found to rely on gradient masking, as 95.3% of adversarial examples were still misclassified when tested on the distilled model.
• The hard-restricted network is equivalent to learning a monotonic boolean function, suggesting potential for future work in leveraging monotonicity for robust malware detection.