Adversarial Attacks with Defense Mechanisms on Convolutional Neural Networks and Recurrent Neural Networks for Malware Classification
Source abstract
Abstract
In the field of behavioral detection, deep learning has been extensively utilized. For example, deep learning models have been utilized to detect and classify malware. Deep learning, however, has vulnerabilities that can be exploited with crafted inputs, resulting in malicious files being misclassified. Cyber-Physical Systems (CPS) may be compromised by malicious files, which can have catastrophic consequences. This paper presents a method for classifying Windows portable executables (PEs) using Recurrent Neural Networks (RNNs) and Convolutional Neural Networks (CNNs). To generate malware executable adversarial examples of PE, we conduct two white-box attacks, Jacobian-based Saliency Map Attack (JSMA) and Carlini and Wagner attack (C&W). An adversarial payload was injected into the DOS header, and a section was added to the file to preserve the PE functionality. The attacks successfully evaded the CNN model with a 91% evasion rate, whereas the RNN model evaded attacks at an 84.6% rate. Two defense mechanisms based on distillation and training techniques are examined in this study for overcoming adversarial example challenges. Distillation and training against JSMA resulted in the highest reductions in the evasion rates of 48.1% and 41.49%, respectively. Distillation and training against C&W resulted in the highest decrease in evasion rates, at 48.1% and 49.9%, respectively.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Adversarial Robustness in Machine Learning · Advanced Malware Detection Techniques · Security and Verification in Computing
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computer Science, College of Computer and Information Sciences, Imam Mohammad Ibn Saud Islamic University (IMSIU), Riyadh 13318, Saudi Arabia
Funding
Imam Mohammad Ibn Saud Islamic University
References (30)
Show source-provided references
1. Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. (2014, January 14–16). Intriguing properties of neural networks. Proceedings of the 2nd International Conference on Learning Representations, ICLR 2014—Conference Track Proceedings, Banff, AB, Canada.
2. Goodfellow, I.J., Shlens, J., and Szegedy, C. (2015, January 7–9). Explaining and harnessing adversarial examples. Proceedings of the 3rd International Conference on Learning Representations, ICLR 2015—Conference Track Proceedings, San Diego, CA, USA.
3. Papernot, N., Mcdaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., and Swami, A. (2016, January 21–24). The limitations of deep learning in adversarial settings. Proceedings of the 2016 IEEE European Symposium on Security and Privacy, EuroS&P 2016, Saarbrücken, Germany.10.1109/EuroSP.2016.36 ↗
4. Moosavi-Dezfooli, S.M., Fawzi, A., and Frossard, P. (2016, January 27–30). Deepfool: A simple and accurate method to fool deep neural networks. Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Las Vegas, NV, USA.10.1109/CVPR.2016.282 ↗
5. Carlini, N., and Wagner, D. (2017, January 22–26). Towards evaluating the robustness of neural networks. Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA.10.1109/SP.2017.49 ↗
6. Kurakin, A., Goodfellow, I.J., and Bengio, S. (2017, January 24–26). Adversarial examples in the physical world. Proceedings of the 5th International Conference on Learning Representations, ICLR 2017—Workshop Track Proceedings, Toulon, France.
7. Liu, A., Guo, J., Wang, J., Liang, S., Tao, R., Zhou, W., Liu, C., Liu, X., and Tao, D. (2023, January 9–11). XX-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detection. Proceedings of the 32nd USENIX Security Symposium, Anaheim, CA, USA.
8. Li, Y., Li, Y., Dai, X., Guo, S., and Xiao, B. (2023, January 17–24). Physical-World Optical Adversarial Attacks on 3D Face Recognition. Proceedings of the 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Vancouver, BC, Canada.10.1109/CVPR52729.2023.02366 ↗
9. Symmetric Saliency-Based Adversarial Attack to Speaker Identification10.1109/LSP.2023.3236509 ↗
10. Android HIV: A study of repackaging malware for evading machine-learning detection10.1109/TIFS.2019.2932228 ↗
11. Suciu, O., Coull, S.E., and Johns, J. (2019, January 19–23). Exploring adversarial examples in malware detection. Proceedings of the 2019 IEEE Symposium on Security and Privacy Workshops (SPW), San Francisco, CA, USA.10.1109/SPW.2019.00015 ↗
12. Kreuk, F., Barak, A., Aviv-Reuven, S., Baruch, M., Pinkas, B., and Keshet, J. (2019). Deceiving end-to-end deep learning malware detectors using adversarial examples. arXiv.
13. Kolosnjaji, B., Demontis, A., Biggio, B., Maiorca, D., Giacinto, G., Eckert, C., and Roli, F. (2018, January 3–7). Adversarial malware binaries: Evading deep learning for malware detection in executables. Proceedings of the 2018 26th European Signal Processing Conference (EUSIPCO), Rome, Italy.10.23919/EUSIPCO.2018.8553214 ↗
14. Demetrio, L., Biggio, B., Lagorio, G., Roli, F., and Jan, C.R. (2019). Explaining vulnerabilities of deep learning to adversarial malware binaries. arXiv.
15. Podschwadt, R., and Takabi, H. (2019, January 23–25). Effectiveness of adversarial examples and defenses for malware classificatio. Proceedings of the International Conference on Security and Privacy in Communication Systems, Orlando, FL, USA.10.1007/978-3-030-37231-6_22 ↗
16. Hinton, G., Vinyals, O., and Dean, J. (2015). Distilling the knowledge in a neural network. arXiv.
17. Huang, Y., Verma, U., Fralick, C., Infantec-Lopez, G., Kumar, B., and Woodward, C. (2019, January 24–27). Malware evasion attack and defense. Proceedings of the 2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W), Portland, OR, USA.10.1109/DSN-W.2019.00014 ↗
18. Stokes, J.W., Wang, D., Marinescu, M., Marino, M., and Bussone, B. (2018, January 29–31). Attack and defense of dynamic analysis-based, adversarial neural malware detection models. Proceedings of the MILCOM 2018-2018 IEEE Military Communications Conference (MILCOM), Los Angeles, CA, USA.10.1109/MILCOM.2018.8599855 ↗
19. Grosse, K., Papernot, N., Manoharan, P., Backes, M., and McDaniel, P. (2017, January 11–15). Adversarial examples for malware detection. Proceedings of the 22nd European Symposium on Research in Computer Security, Oslo, Norway.10.1007/978-3-319-66399-9_4 ↗
20. Liu, X., Zhang, J., Lin, Y., and Li, H. (2019, January 24–25). ATMPA: Attacking machine learning-based malware visualization detection methods via adversarial examples. Proceedings of the International Symposium on Quality of Service, Phoenix, AZ, USA.10.1145/3326285.3329073 ↗
21. Khormali, A., Abusnaina, A., Chen, S., Nyang, D., and Mohaisen, A. (2019). COPYCAT: Practical adversarial attacks on visualization-based malware detection. arXiv.
22. Park, D., Khan, H., and Yener, B. (2019, January 16–19). Short Paper: Creating adversarial malware examples using code insertion. Proceedings of the 18th IEEE International Conference on Machine Learning and Applications (ICMLA), Boca Raton, FL, USA.
23. Li, K., Zhang, F., and Guo, W. (2023). FGAM:Fast Adversarial Malware Generation Method Based on Gradient Sign. arXiv.
24. Li, H., Cheng, Z., Wu, B., Yuan, L., Gao, C., Yuan, W., and Luo, X. (2023, January 9–11). Black-box Adversarial Example Attack towards FCG Based Android Malware Detection under Incomplete Feature Information. Proceedings of the 32nd USENIX Security Symposium, Anaheim, CA, USA.
25. Anderson, H.S., and Roth, P. (2018). Ember: An open dataset for training static pe malware machine learning models. arXiv.
26. Sebastián, M., Rivera, R., Kotzias, P., and Caballero, J. (2016, January 19–21). Avclass: A tool for massive malware labeling. Proceedings of the 19th International Symposium on Research in Attacks, Intrusions, and Defenses, Paris, France.10.1007/978-3-319-45719-2_11 ↗
27. Raff, E., Barker, J., Sylvester, J., Brandon, R., Catanzaro, B., and Nicholas, C. (2017, January 2–7). Malware detection by eating a whole EXE. Proceedings of the Workshops at the Thirty-Second AAAI Conference on Artificial Intelligence, New Orleans, LA, USA.
28. Raff, E., Sylvester, J., and Nicholas, C. (2017, January 3). Learning the PE header, malware detection with minimal domain knowledge. Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, Co-located with CCS 2017, Dallas, TX, USA.10.1145/3128572.3140442 ↗
29. Bahdanau, D., Cho, K.H., and Bengio, Y. (2015, January 7–9). Neural machine translation by jointly learning to align and translate. Proceedings of the 3rd International Conference on Learning Representations, ICLR 2015—Conference Track Proceedings, San Diego, CA, USA.
30. Grosse, K., Papernot, N., Manoharan, P., Backes, M., and McDaniel, P. (2016). Adversarial perturbations against deep neural networks for malware classification. arXiv.10.1109/SP.2016.41 ↗