[Paper Review] Intra-Section Code Cave Injection for Adversarial Evasion Attacks on Windows PE Malware File

Kshitiz Aryal, Maanak Gupta+2 more|arXiv (Cornell University)|Mar 11, 2024

Advanced Malware Detection Techniques4 citations

TL;DR

This paper proposes a novel intra-section code cave injection technique to evade ML-based Windows PE malware detectors by embedding adversarial perturbations within the .text, .data, or .rdata sections of malware files. It achieves up to 97.93% evasion rate against MalConv2 using gradient descent, significantly outperforming append-based attacks and demonstrating effective functionality preservation via a custom code loader that restores original malware behavior at runtime.

ABSTRACT

Windows malware is predominantly available in cyberspace and is a prime target for deliberate adversarial evasion attacks. Although researchers have investigated the adversarial malware attack problem, a multitude of important questions remain unanswered, including (a) Are the existing techniques to inject adversarial perturbations in Windows Portable Executable (PE) malware files effective enough for evasion purposes?; (b) Does the attack process preserve the original behavior of malware?; (c) Are there unexplored approaches/locations that can be used to carry out adversarial evasion attacks on Windows PE malware?; and (d) What are the optimal locations and sizes of adversarial perturbations required to evade an ML-based malware detector without significant structural change in the PE file? To answer some of these questions, this work proposes a novel approach that injects a code cave within the section (i.e., intra-section) of Windows PE malware files to make space for adversarial perturbations. In addition, a code loader is also injected inside the PE file, which reverts adversarial malware to its original form during the execution, preserving the malware's functionality and executability. To understand the effectiveness of our approach, we injected adversarial perturbations inside the .text, .data and .rdata sections, generated using the gradient descent and Fast Gradient Sign Method (FGSM), to target the two popular CNN-based malware detectors, MalConv and MalConv2. Our experiments yielded notable results, achieving a 92.31% evasion rate with gradient descent and 96.26% with FGSM against MalConv, compared to the 16.17% evasion rate for append attacks. Similarly, when targeting MalConv2, our approach achieved a remarkable maximum evasion rate of 97.93% with gradient descent and 94.34% with FGSM, significantly surpassing the 4.01% evasion rate observed with append attacks.

Motivation & Objective

• To address the lack of effective, stealthy adversarial evasion techniques for Windows PE malware that preserve functionality.
• To investigate whether injecting adversarial perturbations within existing PE sections (intra-section) is more effective than appending them at the end of the file.
• To develop a method that maintains malware executability and original behavior after adversarial perturbation injection.
• To evaluate the impact of perturbation size and location on evasion success against state-of-the-art deep learning malware detectors.
• To explore the feasibility and effectiveness of using code caves inside sections rather than inter-section or end-of-file injection.

Proposed method

• Injects adversarial perturbations into existing code caves located within the .text, .data, or .rdata sections of Windows PE files, rather than appending them at the end of the file.
• Uses gradient descent and Fast Gradient Sign Method (FGSM) to generate adversarial perturbations targeting MalConv and MalConv2 models.
• Injects a 24-byte code loader into the malware that overwrites the perturbations at runtime, restoring the original malware functionality.
• Disables Address Space Layout Randomization (ASLR) in the PE header to ensure predictable memory loading and reliable code loader execution.
• Employs a custom binary manipulation pipeline to insert code caves and modify section headers while preserving PE file structure and integrity.
• Verifies functionality via execution in a Windows virtual machine and debugging to ensure no runtime errors or crashes.

Experimental results

Research questions

• RQ1 Are existing adversarial perturbation injection techniques for Windows PE malware files effective enough for evasion purposes?
• RQ2 Does the attack process preserve the original behavior and executability of the malware after perturbation injection?
• RQ3 Are there unexplored injection locations within the PE file structure—specifically intra-section code caves—that can improve evasion success?
• RQ4 What are the optimal locations and sizes of adversarial perturbations required to evade ML-based malware detectors without altering the file’s structural integrity?
• RQ5 Can intra-section code cave injection outperform traditional append-based attack methods in terms of evasion rate and stealth?

Key findings

• The proposed intra-section code cave injection achieved a 92.31% evasion rate against MalConv using gradient descent, significantly outperforming the 16.17% evasion rate of append-based attacks.
• Against MalConv2, the method achieved a maximum evasion rate of 97.93% with gradient descent, compared to only 4.01% for append attacks.
• Using FGSM, the evasion rate reached 96.26% against MalConv and 94.34% against MalConv2, demonstrating high effectiveness across different attack methods.
• The injection of a code loader successfully restored the original malware behavior at runtime, ensuring functionality preservation despite large-scale byte modifications.
• Intra-section injection proved more effective and stealthier than end-of-file or inter-section injection, as perturbations were co-located with legitimate code and less detectable by static analysis.
• The approach is limited to 32-bit x86 binaries due to hardcoded code loader and ASLR disabling, but portability to other architectures is feasible with minor adjustments.