On the Robustness of Malware Detectors to Adversarial Samples

TL;DR

This paper investigates how robust malware detectors are against adversarially modified malware, finding that such attacks are less transferable across different detectors and that ensemble methods can improve resilience.

Contribution

It provides a comprehensive analysis of adversarial attack transferability on malware detectors and evaluates ensemble approaches for enhanced robustness.

Findings

Adversarial malware crafted for one detector is less effective against others.

Ensemble detectors can mitigate adversarial attack impacts.

Significant program modifications can be detected, limiting attack effectiveness.

Abstract

Adversarial examples add imperceptible alterations to inputs with the objective to induce misclassification in machine learning models. They have been demonstrated to pose significant challenges in domains like image classification, with results showing that an adversarially perturbed image to evade detection against one classifier is most likely transferable to other classifiers. Adversarial examples have also been studied in malware analysis. Unlike images, program binaries cannot be arbitrarily perturbed without rendering them non-functional. Due to the difficulty of crafting adversarial program binaries, there is no consensus on the transferability of adversarially perturbed programs to different detectors. In this work, we explore the robustness of malware detectors against adversarially perturbed malware. We investigate the transferability of adversarial attacks developed against one detector, against other machine learning-based malware detectors, and code similarity techniques, specifically, locality sensitive hashing-based detectors. Our analysis reveals that adversarial program binaries crafted for one detector are generally less effective against others. We also evaluate an ensemble of detectors and show that they can potentially mitigate the impact of adversarial program binaries. Finally, we demonstrate that substantial program changes made to evade detection may result in the transformation technique being identified, implying that the adversary must make minimal changes to the program binary.