[Paper Review] Examining Adversarial Learning against Graph-based IoT Malware Detection Systems

Ahmed Abusnaina, Aminollah Khormali+5 more|arXiv (Cornell University)|Feb 12, 2019

Adversarial Robustness in Machine Learning11 references4 citations

TL;DR

This paper investigates the robustness of graph-based deep learning models for IoT malware detection against adversarial attacks. It proposes two methods—Off-the-Shelf Adversarial Attacks (OSAA) and Graph Embedding and Augmentation (GEA)—to generate adversarial IoT malware samples that evade detection while preserving functionality. The key finding is that GEA successfully misclassifies 100% of malware samples as benign, demonstrating severe vulnerability in practical settings.

ABSTRACT

The main goal of this study is to investigate the robustness of graph-based Deep Learning (DL) models used for Internet of Things (IoT) malware classification against Adversarial Learning (AL). We designed two approaches to craft adversarial IoT software, including Off-the-Shelf Adversarial Attack (OSAA) methods, using six different AL attack approaches, and Graph Embedding and Augmentation (GEA). The GEA approach aims to preserve the functionality and practicality of the generated adversarial sample through a careful embedding of a benign sample to a malicious one. Our evaluations demonstrate that OSAAs are able to achieve a misclassification rate (MR) of 100%. Moreover, we observed that the GEA approach is able to misclassify all IoT malware samples as benign.

Motivation & Objective

• To evaluate the robustness of graph-based deep learning models in detecting IoT malware under adversarial attacks.
• To address the gap in research on adversarial learning's impact on CFG-based IoT malware detection systems.
• To generate adversarial examples that maintain functionality and practicality while evading detection.
• To compare the effectiveness and practicality of off-the-shelf adversarial attacks versus a novel graph embedding approach.

Proposed method

• Constructed Control Flow Graphs (CFGs) from IoT binaries using GCC and Radare2 for feature extraction.
• Extracted 23 graph-based features (e.g., betweenness, closeness, degree centrality, density, edge/vertex counts) from CFGs.
• Trained a CNN-based classifier on 2,557 IoT samples (2,281 malware, 276 benign) achieving 97.13% accuracy.
• Applied six off-the-shelf adversarial attack methods (C&W, DeepFool, ElasticNet, JSMA, MIM, PGD) to perturb feature space.
• Proposed Graph Embedding and Augmentation (GEA) to merge a benign graph into a malicious one, preserving functionality.
• Evaluated GEA on varying graph sizes and densities, measuring misclassification rate and computational cost.

Experimental results

Research questions

• RQ1 Can off-the-shelf adversarial attacks achieve high misclassification rates in graph-based IoT malware detection?
• RQ2 Can adversarial examples be crafted to maintain the original functionality and practicality of IoT malware?
• RQ3 How does graph size and density affect the success rate and computational cost of adversarial sample generation?
• RQ4 To what extent can the GEA approach misclassify malware as benign while preserving executable behavior?

Key findings

• OSAA methods achieved a maximum misclassification rate (MR) of 100% across all six attack types, with PGD and MIM requiring the highest number of feature changes (22.56 and 20.60, respectively).
• The GEA approach successfully misclassified 100% of malware samples as benign when targeting the largest malicious graph (455 nodes), with a computational time of 1,123.12 ms.
• For benign-to-malware misclassification, GEA achieved 88.04% MR on the largest benign graph (367 nodes), demonstrating high evasion capability.
• The misclassification rate in GEA increased with graph size, indicating that larger, more complex graphs are more susceptible to adversarial manipulation.
• GEA maintained functional correctness of original samples, unlike OSAA, which does not guarantee practicality or executability.
• The high False Negative Rate (11.26%) in the trained model is attributed to class imbalance, highlighting a challenge in real-world deployment.