[论文解读] Attack and Defense of Dynamic Analysis-Based, Adversarial Neural Malware Classification Models

Jack W. Stokes, De Wang+3 more|arXiv (Cornell University)|Dec 16, 2017

Adversarial Robustness in Machine Learning参考文献 22被引用 18

一句话总结

本文研究了针对基于动态分析的深度神经网络（DNN）恶意软件分类器的对抗性攻击，提出了六种针对二值化、稀疏输入的攻击策略。评估了三种防御方法——蒸馏、集成和权重衰减，发现集成防御在不损失准确率的情况下提供了最强的鲁棒性，而更深的网络则提升了对抗性鲁棒性。

ABSTRACT

Recently researchers have proposed using deep learning-based systems for malware detection. Unfortunately, all deep learning classification systems are vulnerable to adversarial attacks. Previous work has studied adversarial attacks against static analysis-based malware classifiers which only classify the content of the unknown file without execution. However, since the majority of malware is either packed or encrypted, malware classification based on static analysis often fails to detect these types of files. To overcome this limitation, anti-malware companies typically perform dynamic analysis by emulating each file in the anti-malware engine or performing in-depth scanning in a virtual machine. These strategies allow the analysis of the malware after unpacking or decryption. In this work, we study different strategies of crafting adversarial samples for dynamic analysis. These strategies operate on sparse, binary inputs in contrast to continuous inputs such as pixels in images. We then study the effects of two, previously proposed defensive mechanisms against crafted adversarial samples including the distillation and ensemble defenses. We also propose and evaluate the weight decay defense. Experiments show that with these three defensive strategies, the number of successfully crafted adversarial samples is reduced compared to a standard baseline system without any defenses. In particular, the ensemble defense is the most resilient to adversarial attacks. Importantly, none of the defenses significantly reduce the classification accuracy for detecting malware. Finally, we demonstrate that while adding additional hidden layers to neural models does not significantly improve the malware classification accuracy, it does significantly increase the classifier's robustness to adversarial attacks.

研究动机与目标

• 研究针对基于动态分析的、处理稀疏二值输入的恶意软件分类器的对抗性攻击策略。
• 评估现有防御方法——蒸馏与集成——在动态分析环境下对对抗性恶意软件样本的有效性。
• 提出并分析一种新型的权重衰减防御机制，以提升模型鲁棒性。
• 评估增加网络深度是否能在不降低恶意软件检测准确率的前提下增强对抗性鲁棒性。
• 确定防御机制是否显著降低恶意软件检测系统的分类性能。

提出的方法

• 通过选择性地移除恶意特征或添加良性特征，生成对抗性恶意软件样本，以扰动输入的二进制表示。
• 应用基于梯度的优化技术，生成保持原始恶意软件标签但被DNN错误分类的对抗性输入。
• 通过训练学生模型模仿教师模型的软标签来实现蒸馏防御，以降低对微小输入扰动的敏感性。
• 通过训练多个多样化DNN模型并聚合其预测结果来实现集成防御，降低对定向对抗性样本的敏感性。
• 通过在模型训练过程中应用L2正则化来引入权重衰减防御，以约束模型权重并提升泛化能力。
• 训练具有递增深度的深度神经网络，以评估网络架构深度对准确率和对抗性鲁棒性的影响。

实验结果

研究问题

• RQ1 六种不同的对抗性攻击策略在生成可逃避基于动态分析的DNN分类器的扰动恶意软件样本方面效果如何？
• RQ2 蒸馏与集成防御在多大程度上降低了对抗性攻击在动态恶意软件分类器上的成功率？
• RQ3 所提出的权重衰减防御是否显著提升了对对抗性恶意软件样本的鲁棒性？
• RQ4 在DNN中增加隐藏层数量如何影响分类准确率和对抗性攻击的抵御能力？
• RQ5 如蒸馏、集成和权重衰减等防御机制是否显著降低了基线恶意软件检测准确率？

主要发现

• 集成防御在抵抗对抗性攻击方面显著优于蒸馏和权重衰减，更有效地减少了成功构造的对抗性样本数量。
• 蒸馏防御降低了特征移除攻击的有效性，表现出中等程度的鲁棒性，但不如集成方法有效。
• 权重衰减防御对对抗性样本的保护作用微乎其微，与基线相比在鲁棒性方面几乎没有改善。
• 在DNN中增加更多隐藏层虽未显著提升恶意软件分类准确率，但大幅增强了模型对对抗性攻击的鲁棒性。
• 三种防御机制均未显著降低整体恶意软件检测准确率，满足了不损害检测能力的关键要求。
• 结果证实，即使准确率提升有限，深层神经网络在本质上也比浅层模型更具对抗性攻击鲁棒性。