[Paper Review] Exposing Weaknesses of Malware Detectors with Explainability-Guided Evasion Attacks

Wei Wang, Ruoxi Sun+5 more|arXiv (Cornell University)|Nov 19, 2021

Adversarial Robustness in Machine Learning37 references7 citations

TL;DR

This paper proposes an explainability-guided evasion attack that combines feature-space manipulation and problem-space obfuscation to bypass state-of-the-art malware detectors without requiring white-box access. By leveraging SHAP for feature selection, the attack achieves high evasion success rates, revealing widespread vulnerabilities in current detection systems.

ABSTRACT

Numerous open-source and commercial malware detectors are available. However, the efficacy of these tools has been threatened by new adversarial attacks, whereby malware attempts to evade detection using, for example, machine learning techniques. In this work, we design an adversarial evasion attack that relies on both feature-space and problem-space manipulation. It uses explainability-guided feature selection to maximize evasion by identifying the most critical features that impact detection. We then use this attack as a benchmark to evaluate several state-of-the-art malware detectors. We find that (i) state-of-the-art malware detectors are vulnerable to even simple evasion strategies, and they can easily be tricked using off-the-shelf techniques; (ii) feature-space manipulation and problem-space obfuscation can be combined to enable evasion without needing white-box understanding of the detector; (iii) we can use explainability approaches (e.g., SHAP) to guide the feature manipulation and explain how attacks can transfer across multiple detectors. Our findings shed light on the weaknesses of current malware detectors, as well as how they can be improved.

Motivation & Objective

• To investigate the vulnerability of state-of-the-art malware detectors to adversarial evasion attacks.
• To develop a black-box evasion attack that leverages explainability techniques like SHAP to guide effective feature manipulation.
• To evaluate the transferability of evasion attacks across multiple malware detection systems.
• To assess the effectiveness of combining feature-space and problem-space obfuscation in evading detection without requiring detailed model knowledge.

Proposed method

• The attack uses SHAP (SHapley Additive exPlanations) to identify the most influential features affecting malware detection decisions.
• Feature-space manipulation is performed by modifying the most critical features identified via SHAP to minimize detection probability.
• Problem-space obfuscation is applied to alter the input structure (e.g., code layout or control flow) without changing functionality.
• The attack is executed in a black-box setting, requiring no access to the internal architecture or parameters of the target detector.
• The approach is evaluated as a benchmark across multiple state-of-the-art malware detectors to measure evasion success and transferability.
• The attack is designed to be transferable, enabling evasion across diverse detection models using only feature importance insights.

Experimental results

Research questions

• RQ1 How effective are explainability-guided feature selection techniques in identifying critical features for evasion in malware detection?
• RQ2 To what extent can feature-space manipulation and problem-space obfuscation be combined to achieve evasion without white-box access?
• RQ3 How transferable are evasion attacks across different malware detectors when guided by explainability methods?
• RQ4 What are the success rates of such attacks on current state-of-the-art malware detection systems?
• RQ5 Can off-the-shelf techniques combined with explainability tools bypass advanced detectors with minimal model knowledge?

Key findings

• State-of-the-art malware detectors are highly vulnerable to simple evasion strategies, even without detailed model access.
• The combination of feature-space manipulation and problem-space obfuscation enables effective evasion without requiring white-box knowledge of the detector.
• Explainability methods like SHAP successfully guide the selection of critical features, significantly increasing evasion success rates.
• The attack demonstrates strong transferability across multiple detectors, indicating a systemic vulnerability in current detection approaches.
• Even off-the-shelf techniques, when guided by explainability, can bypass advanced malware detectors with high effectiveness.
• The findings highlight that current malware detectors lack robustness to explainability-driven adversarial manipulations.