[论文解读] Deceiving End-to-End Deep Learning Malware Detectors using Adversarial Examples

Felix Kreuk, Assi Barak+4 more|arXiv (Cornell University)|Feb 13, 2018

Adversarial Robustness in Machine Learning参考文献 50被引用 104

一句话总结

该论文展示了如何通过向原始二进制文件注入有效负载，在端到端 CNN 恶意软件检测器中生成对抗样本，在保持功能性的同时实现高规避率，并展示了跨文件和位置的有效负载可传输性。

ABSTRACT

In recent years, deep learning has shown performance breakthroughs in many applications, such as image detection, image segmentation, pose estimation, and speech recognition. However, this comes with a major concern: deep networks have been found to be vulnerable to adversarial examples. Adversarial examples are slightly modified inputs that are intentionally designed to cause a misclassification by the model. In the domains of images and speech, the modifications are so small that they are not seen or heard by humans, but nevertheless greatly affect the classification of the model. Deep learning models have been successfully applied to malware detection. In this domain, generating adversarial examples is not straightforward, as small modifications to the bytes of the file could lead to significant changes in its functionality and validity. We introduce a novel loss function for generating adversarial examples specifically tailored for discrete input sets, such as executable bytes. We modify malicious binaries so that they would be detected as benign, while preserving their original functionality, by injecting a small sequence of bytes (payload) in the binary file. We applied this approach to an end-to-end convolutional deep learning malware detection model and show a high rate of detection evasion. Moreover, we show that our generated payload is robust enough to be transferable within different locations of the same file and across different files, and that its entropy is low and similar to that of benign data sections.

研究动机与目标

• 评估端到端深度神经网络恶意软件检测器对对抗样本的脆弱性。
• 开发一种通过嵌入空间扰动为离散二进制输入生成对抗样本的方法。
• 展示在多个位置以及不同恶意软件文件/家族中，注入的有效负载能够规避检测。

提出的方法

• 将二进制表示为字节序列并通过嵌入矩阵嵌入到连续空间。
• 通过使用 FGSM/迭代方法在 Z 空间添加扰动来构造对抗嵌入，使其错误分类为良性。
• 通过为每个位置选择最近的嵌入标记，将扰动后的嵌入映射回离散字节。
• 将修改限定为注入到非可执行段的较小有效负载，以保留运行时功能。
• 使用文件末端和中间段注入有效负载，确保原始文件在规避检测的同时仍可运行。

实验结果

研究问题

• RQ1 运行在原始二进制上的端到端 CNN 恶意软件检测器是否会被嵌入空间中的对抗扰动欺骗？
• RQ2 向二进制文件注入一个小的有效负载是否能可靠地导致错误分类，同时保持功能性？
• RQ3 对抗性有效负载是否在不同文件之间以及在文件中的不同位置之间具有可传输性？
• RQ4 有效负载长度如何影响规避能力和检测鲁棒性？

主要发现

• 在测试集中，使用长度为 500 到 999 字节的有效负载，规避率为 99.21%（p=2）和 98.83%（p=inf）。
• 通过将有效负载注入到非可执行段（中间文件或文件末尾）实现规避，同时保持二进制功能。
• 将对抗性有效负载放置在文件的不同位置时，该模型会被误导（重新定位时 100% 错误分类）。
• 为一个文件生成的有效负载在注入到不同文件时达到 75% 的可传输性。
• 同一有效负载在多个文件和多种恶意软件家族中都可能有效，表明跨文件传输性和鲁棒性。