2021/09/21 by Hadjer Benkraouda, Benkraouda, Hadjer, Jingyu Qian +5
Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Anomaly Detection Techniques and Applications #Cryptography and Security (cs.CR) #FOS: Computer and information sciences
paper · pdf · doi:10.48550/arxiv.2109.10417
openalex publication_date 2021/09/21 · openalex created_date 2022/07/25 · openalex updated_date 2026/07/28
With the rapid development of machine learning for image classification,\nresearchers have found new applications of visualization techniques in malware\ndetection. By converting binary code into images, researchers have shown\nsatisfactory results in applying machine learning to extract features that are\ndifficult to discover manually. Such visualization-based malware detection\nmethods can capture malware patterns from many different malware families and\nimprove malware detection speed. On the other hand, recent research has also\nshown adversarial attacks against such visualization-based malware detection.\nAttackers can generate adversarial examples by perturbing the malware binary in\nnon-reachable regions, such as padding at the end of the binary. Alternatively,\nattackers can perturb the malware image embedding and then verify the\nexecutability of the malware post-transformation. One major limitation of the\nfirst attack scenario is that a simple pre-processing step can remove the\nperturbations before classification. For the second attack scenario, it is hard\nto maintain the original malware's executability and functionality. In this\nwork, we provide literature review on existing malware visualization techniques\nand attacks against them. We summarize the limitation of the previous work, and\ndesign a new adversarial example attack against visualization-based malware\ndetection that can evade pre-processing filtering and maintain the original\nmalware functionality. We test our attack on a public malware dataset and\nachieve a 98% success rate.\n