Improving Adversarial Robustness in Android Malware Detection by Reducing the Impact of Spurious Correlations

TL;DR

This paper introduces a domain adaptation method to enhance Android malware detection robustness by aligning malware and adversarial example distributions, reducing reliance on spurious features and improving resistance to evasion attacks.

Contribution

It proposes a novel domain adaptation technique that leverages meaningful feature dependencies to improve generalization and robustness of malware classifiers against evasion attacks.

Findings

Outperforms Sec-SVM in adversarial robustness by up to 55%.

Improves generalization by aligning malware and adversarial example distributions.

Reduces reliance on spurious correlations in feature space.

Abstract

Machine learning (ML) has demonstrated significant advancements in Android malware detection (AMD); however, the resilience of ML against realistic evasion attacks remains a major obstacle for AMD. One of the primary factors contributing to this challenge is the scarcity of reliable generalizations. Malware classifiers with limited generalizability tend to overfit spurious correlations derived from biased features. Consequently, adversarial examples (AEs), generated by evasion attacks, can modify these features to evade detection. In this study, we propose a domain adaptation technique to improve the generalizability of AMD by aligning the distribution of malware samples and AEs. Specifically, we utilize meaningful feature dependencies, reflecting domain constraints in the feature space, to establish a robust feature space. Training on the proposed robust feature space enables malware classifiers to learn from predefined patterns associated with app functionality rather than from individual features. This approach helps mitigate spurious correlations inherent in the initial feature space. Our experiments conducted on DREBIN, a renowned Android malware detector, demonstrate that our approach surpasses the state-of-the-art defense, Sec-SVM, when facing realistic evasion attacks. In particular, our defense can improve adversarial robustness by up to 55% against realistic evasion attacks compared to Sec-SVM.