[论文解读] Automatic Generation of Adversarial Examples for Interpreting Malware Classifiers.

Wei Song, Xuezixiang Li+4 more|arXiv (Cornell University)|Mar 6, 2020

Advanced Malware Detection Techniques参考文献 52被引用 21

一句话总结

本文提出了一种框架，通过结合代码随机化和二进制操作，生成能够绕过现实世界杀毒软件系统的逼真对抗性恶意软件样本。实验表明，24.3%至41.9%的恶意软件样本可绕过静态检测器——有时仅需修改一个字节——且部分静态绕过方法也能绕过离线动态分析，揭示了商业杀毒软件中的关键漏洞。

ABSTRACT

Recent advances in adversarial attacks have shown that machine learning classifiers based on static analysis are vulnerable to adversarial attacks. However, real-world antivirus systems do not rely only on static classifiers, thus many of these static evasions get detected by dynamic analysis whenever the malware runs. The real question is to what extent these adversarial attacks are actually harmful to the real users? In this paper, we propose a systematic framework to create and evaluate realistic adversarial malware to evade real-world systems. We propose new adversarial attacks against real-world antivirus systems based on code randomization and binary manipulation, and use our framework to perform the attacks on 1000 malware samples and test four commercial antivirus software and two open-source classifiers. We demonstrate that the static detectors of real-world antivirus can be evaded 24.3%-41.9% of the cases and often by changing only one byte. We also find that the adversarial attacks are transferable between different antivirus up to 16% of the cases. We also tested the efficacy of the complete (i.e. static + dynamic) classifiers in protecting users. While most of the commercial antivirus use their dynamic engines to protect the users' device when the static classifiers are evaded, we are the first to demonstrate that for one commercial antivirus, static evasions can also evade the offline dynamic detectors and infect users' machines. Our framework can also help explain which features are responsible for evasion and thus can help improve the robustness of malware detectors.

研究动机与目标

• 评估对抗性攻击在现实世界恶意软件分类器上的有效性，超越静态分析。
• 开发一种系统化框架，用于生成可绕过商业杀毒软件中静态与动态分析的对抗性恶意软件。
• 探究为静态分类器生成的对抗性样本是否也能绕过动态分析引擎。
• 识别恶意软件中对成功绕过最具影响力的特征，从而提升检测器的鲁棒性。

提出的方法

• 该框架通过在1,000个真实恶意软件样本上应用代码随机化和二进制操作，生成对抗性恶意软件。
• 在四个商业杀毒引擎和两个开源分类器上评估生成的对抗性样本。
• 该方法聚焦于最小代码修改——如单字节更改——以在保持功能的同时规避检测。
• 通过在多个引擎上测试绕过成功率，衡量对抗性样本在不同杀毒系统间的可迁移性。
• 使用特征归因技术识别对绕过成功贡献最大的代码级特征。

实验结果

研究问题

• RQ1 通过二进制操作生成的对抗性恶意软件在多大程度上能绕过现实世界商业杀毒系统？
• RQ2 能绕过静态分析的对抗性样本是否也能绕过商业杀毒引擎的离线动态分析？
• RQ3 对抗性样本在不同杀毒检测系统间的可迁移性如何？
• RQ4 哪些代码级特征最能促进恶意软件分类器的绕过？

主要发现

• 所提出的对抗性攻击在24.3%至41.9%的情况下成功绕过了现实世界杀毒软件的静态检测器。
• 在某些情况下，仅修改一个字节即可实现绕过，凸显了当前静态分析的脆弱性。
• 对抗性样本在最多16%的情况下表现出跨不同杀毒引擎的可迁移性。
• 某款商业杀毒产品即使其静态分类器被绕过，仍未能检测到恶意软件，因其离线动态引擎也未触发。
• 该框架使我们能够识别出导致绕过的关键特征，为提升检测器鲁棒性提供了洞见。