[Paper Review] PAD: Towards Principled Adversarial Malware Detection Against Evasion Attacks

Deqiang Li, Shicheng Cui+4 more|arXiv (Cornell University)|Feb 22, 2023

Advanced Malware Detection Techniques4 citations

TL;DR

PAD proposes a principled adversarial malware detection framework using a learnable convex measurement to quantify discrete perturbations, enabling theoretically guaranteed robust optimization. It outperforms state-of-the-art defenses by achieving over 83.45% detection accuracy against 27 evasion attacks while incurring less than 2.16% accuracy drop in clean settings.

ABSTRACT

Machine Learning (ML) techniques can facilitate the automation of malicious software (malware for short) detection, but suffer from evasion attacks. Many studies counter such attacks in heuristic manners, lacking theoretical guarantees and defense effectiveness. In this paper, we propose a new adversarial training framework, termed Principled Adversarial Malware Detection (PAD), which offers convergence guarantees for robust optimization methods. PAD lays on a learnable convex measurement that quantifies distribution-wise discrete perturbations to protect malware detectors from adversaries, whereby for smooth detectors, adversarial training can be performed with theoretical treatments. To promote defense effectiveness, we propose a new mixture of attacks to instantiate PAD to enhance deep neural network-based measurements and malware detectors. Experimental results on two Android malware datasets demonstrate: (i) the proposed method significantly outperforms the state-of-the-art defenses; (ii) it can harden ML-based malware detection against 27 evasion attacks with detection accuracies greater than 83.45%, at the price of suffering an accuracy decrease smaller than 2.16% in the absence of attacks; (iii) it matches or outperforms many anti-malware scanners in VirusTotal against realistic adversarial malware.

Motivation & Objective

• To address the lack of theoretical guarantees in existing adversarial malware detection methods that rely on heuristic adversarial training.
• To close the robustness gap between feature space and problem space by ensuring convergence in both inner maximization and outer minimization during adversarial training.
• To enhance defense effectiveness through a novel mixture of evasion attacks tailored for deep neural network-based malware detectors.
• To develop a principled, verifiable defense framework that maintains high detection accuracy under both clean and adversarial conditions.
• To enable formal treatment of robustness in discrete malware representation spaces, where traditional smoothness assumptions may not hold.

Proposed method

• Introduces a learnable convex measurement to quantify distribution-wise discrete perturbations in malware representations, enabling theoretical convergence guarantees.
• Employs a min-max adversarial training framework where the inner maximization (adversarial example generation) and outer minimization (model training) are theoretically grounded.
• Uses a mixture of evasion attacks—specifically designed for malware detection—to instantiate the PAD framework and improve robustness.
• Leverages smooth deep neural networks (DNNs) to ensure gradient-based convergence in the outer minimization, facilitating stable optimization.
• Designs a dual-detection mechanism: a primary malware detector and a secondary adversarial example indicator, both trained under the same principled framework.
• Applies theoretical analysis based on convexity and smoothness to ensure that robustness achieved in the feature space propagates effectively to the problem space.

Experimental results

Research questions

• RQ1 Can a convex, learnable measurement be used to formalize adversarial training in discrete malware representation spaces with convergence guarantees?
• RQ2 How can a mixture of evasion attacks be designed to effectively instantiate adversarial training and enhance robustness in malware detection?
• RQ3 To what extent does the proposed framework maintain detection accuracy under clean data while defending against a wide range of evasion attacks?
• RQ4 Can the framework ensure that robustness from the feature space propagates to the actual malware detection task, avoiding the robustness gap?
• RQ5 Does the use of smooth, convex DNNs enable stable and theoretically grounded optimization in adversarial malware detection?

Key findings

• The PAD framework achieves detection accuracy above 83.45% against 27 distinct evasion attacks, significantly outperforming state-of-the-art defenses.
• In the absence of attacks, the model suffers a clean accuracy drop of less than 2.16%, demonstrating minimal performance degradation.
• The framework matches or exceeds the detection performance of multiple commercial antivirus scanners on VirusTotal when evaluated on realistic adversarial malware samples.
• Theoretical convergence guarantees are achieved for both the inner maximization (adversarial example search) and outer minimization (model training) steps.
• The use of a convex measurement enables robustness to propagate effectively from the feature space to the problem space, mitigating the robustness gap observed in prior work.
• The mixture of attacks used in adversarial training enhances the model's ability to generalize against diverse evasion strategies, including practical ones.