Tarallo: Evading Behavioral Malware Detectors in the Problem Space

TL;DR

Tarallo introduces a novel adversarial attack framework that effectively evades behavioral malware detectors by addressing malware nondeterminism with new algorithms, achieving up to 99% success in fooling detectors with minimal modifications.

Contribution

The paper presents PS-FGSM and problem space strategies to improve adversarial attacks on malware detectors, accounting for malware nondeterminism, and implements them in the Tarallo framework.

Findings

Achieves up to 99% success rate in evading malware detectors.

Significantly reduces the number of modifications needed for successful attacks.

Outperforms previous adversarial attack methods in both white and black-box scenarios.

Abstract

Machine learning algorithms can effectively classify malware through dynamic behavior but are susceptible to adversarial attacks. Existing attacks, however, often fail to find an effective solution in both the feature and problem spaces. This issue arises from not addressing the intrinsic nondeterministic nature of malware, namely executing the same sample multiple times may yield significantly different behaviors. Hence, the perturbations computed for a specific behavior may be ineffective for others observed in subsequent executions. In this paper, we show how an attacker can augment their chance of success by leveraging a new and more efficient feature space algorithm for sequential data, which we have named PS-FGSM, and by adopting two problem space strategies specially tailored to address nondeterminism in the problem space. We implement our novel algorithm and attack strategies in Tarallo, an end-to-end adversarial framework that significantly outperforms previous works in both white and black-box scenarios. Our preliminary analysis in a sandboxed environment and against two RNN-based malware detectors, shows that Tarallo achieves a success rate up to 99% on both feature and problem space attacks while significantly minimizing the number of modifications required for misclassification.