2019/12/10 by Behzad Asadi, Asadi, Behzad, Vijay Varadharajan +1
Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Digital and Cyber Forensics #FOS: Computer and information sciences #Information Theory (cs.IT) #Machine Learning (cs.LG) #Machine Learning (stat.ML)
paper · pdf · doi:10.48550/arxiv.1912.05945
openalex publication_date 2019/12/10 · openalex created_date 2022/07/26 · openalex updated_date 2026/07/28
We address the problem of adversarial examples in machine learning where an\nadversary tries to misguide a classifier by making functionality-preserving\nmodifications to original samples. We assume a black-box scenario where the\nadversary has access to only the feature set, and the final hard-decision\noutput of the classifier. We propose a method to generate adversarial examples\nusing the minimum description length (MDL) principle. Our final aim is to\nimprove the robustness of the classifier by considering generated examples in\nrebuilding the classifier. We evaluate our method for the application of static\nmalware detection in portable executable (PE) files. We consider API calls of\nPE files as their distinguishing features where the feature vector is a binary\nvector representing the presence-absence of API calls. In our method, we first\ncreate a dataset of benign samples by querying the target classifier. We next\nconstruct a code table of frequent patterns for the compression of this dataset\nusing the MDL principle. We finally generate an adversarial example\ncorresponding to a malware sample by selecting and adding a pattern from the\nbenign code table to the malware sample. The selected pattern is the one that\nminimizes the length of the compressed adversarial example given the code\ntable. This modification preserves the functionalities of the original malware\nsample as all original API calls are kept, and only some new API calls are\nadded. Considering a neural network, we show that the evasion rate is 78.24\npercent for adversarial examples compared to 8.16 percent for original malware\nsamples. This shows the effectiveness of our method in generating examples that\nneed to be considered in rebuilding the classifier.\n