Evaluating the robustness of adversarial defenses in malware detection systems

2025/05/14 by Mostafa Jafari, Jafari, Mostafa, Alireza Shameli‐Sendi +1
Computer Science · #68M25 #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Artificial Intelligence (cs.AI) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #I.2.1 #Machine Learning (cs.LG) #Network Security and Intrusion Detection

paper · pdf · doi:10.48550/arxiv.2505.09342

openalex publication_date 2025/05/14 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/30

Abstract

Machine learning is a key tool for Android malware detection, effectively identifying malicious patterns in apps. However, ML-based detectors are vulnerable to evasion attacks, where small, crafted changes bypass detection. Despite progress in adversarial defenses, the lack of comprehensive evaluation frameworks in binary-constrained domains limits understanding of their robustness. We introduce two key contributions. First, Prioritized Binary Rounding, a technique to convert continuous perturbations into binary feature spaces while preserving high attack success and low perturbation size. Second, the sigma-binary attack, a novel adversarial method for binary domains, designed to achieve attack goals with minimal feature changes. Experiments on the Malscan dataset show that sigma-binary outperforms existing attacks and exposes key vulnerabilities in state-of-the-art defenses. Defenses equipped with adversary detectors, such as KDE, DLA, DNN+, and ICNN, exhibit significant brittleness, with attack success rates exceeding 90% using fewer than 10 feature modifications and reaching 100% with just 20. Adversarially trained defenses, including AT-rFGSM-k, AT-MaxMA, improves robustness under small budgets but remains vulnerable to unrestricted perturbations, with attack success rates of 99.45% and 96.62%, respectively. Although PAD-SMA demonstrates strong robustness against state-of-the-art gradient-based adversarial attacks by maintaining an attack success rate below 16.55%, the sigma-binary attack significantly outperforms these methods, achieving a 94.56% success rate under unrestricted perturbations. These findings highlight the critical need for precise method like sigma-binary to expose hidden vulnerabilities in existing defenses and support the development of more resilient malware detection systems.

Citations

• Unraveling the Key of Machine Learning Solutions for Android Malware Detection
• σ-zero: Gradient-based Optimization of ℓ₀-norm Adversarial Examples
• MalPurifier: Enhancing Android Malware Detection with Adversarial Purification against Evasion Attacks
• Black-box Adversarial Example Attack towards FCG Based Android Malware Detection under Incomplete Feature Information
• Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent
• On Evaluating Adversarial Robustness
• Theoretically Principled Trade-off between Robustness and Accuracy
• HashTran-DNN: A Framework for Enhancing Robustness of Deep Neural Networks against Adversarial Malware Samples
• Adversarial Deep Learning for Robust Detection of Binary Encoded Malware
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Automated Poisoning Attacks and Defenses in Malware Detection Systems: An Adversarial Machine Learning Approach
• On the (Statistical) Detection of Adversarial Examples
• Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
• MaMaDroid: Detecting Android Malware by Building Markov Chains of\n Behavioral Models
• Towards Evaluating the Robustness of Neural Networks
• Explaining and Harnessing Adversarial Examples
• Generative Adversarial Networks

Related

• Level Up with ML Vulnerability Identification: Leveraging Domain Constraints in Feature Space for Robust Android Malware Detection
• Improving Adversarial Robustness in Android Malware Detection by Reducing the Impact of Spurious Correlations
• MalPurifier: Enhancing Android Malware Detection with Adversarial Purification against Evasion Attacks
• Adversarial Patterns: Building Robust Android Malware Classifiers
• LLM-Driven Feature-Level Adversarial Attacks on Android Malware Detectors