Being Single Has Benefits. Instance Poisoning to Deceive Malware Classifiers

TL;DR

This paper demonstrates a novel poisoning attack on malware classifiers that targets specific malware instances with triggers, significantly reducing detection rates and highlighting the need for advanced defenses.

Contribution

It introduces a new poisoning attack method focusing on individual malware instances with triggers, and proposes a detection approach to defend against this threat.

Findings

Poisoning attack reduces detection from 99.23% to 0%.

Attack effective on EMBER dataset and VirusTotal samples.

Proposes a detection method for this poisoning threat.

Abstract

The performance of a machine learning-based malware classifier depends on the large and updated training set used to induce its model. In order to maintain an up-to-date training set, there is a need to continuously collect benign and malicious files from a wide range of sources, providing an exploitable target to attackers. In this study, we show how an attacker can launch a sophisticated and efficient poisoning attack targeting the dataset used to train a malware classifier. The attacker's ultimate goal is to ensure that the model induced by the poisoned dataset will be unable to detect the attacker's malware yet capable of detecting other malware. As opposed to other poisoning attacks in the malware detection domain, our attack does not focus on malware families but rather on specific malware instances that contain an implanted trigger, reducing the detection rate from 99.23% to 0% depending on the amount of poisoning. We evaluate our attack on the EMBER dataset with a state-of-the-art classifier and malware samples from VirusTotal for end-to-end validation of our work. We propose a comprehensive detection approach that could serve as a future sophisticated defense against this newly discovered severe threat.