MAB-Malware: A Reinforcement Learning Framework for Blackbox Generation of Adversarial Malware
MAB-Malware: A Reinforcement Learning Framework for Blackbox Generation of Adversarial Malware
复制标题
DOI：
10.1145/3488932.3497768
复制
发表时间：
2022-05
期刊：
影响因子：
--
通讯作者：
Wei Song;Xuezixiang Li;Sadia Afroz;Deepali Garg;Dmitry Kuznetsov;Heng Yin
中科院分区：
文献类型：
--
作者：
Wei Song;Xuezixiang Li;Sadia Afroz;Deepali Garg;Dmitry Kuznetsov;Heng Yin
现代商业防病毒系统越来越依赖机器学习（ML），以跟上新恶意软件的猖a。但是，众所周知，机器学习模型容易受到对抗性示例（AES）的影响。先前的工作表明，ML恶意软件分类器在白色框对抗攻击中脆弱。但是，商业防病毒（AV）产品中使用的ML模型通常不适合攻击者，而仅返回硬分类标签。因此，以纯黑盒方式评估ML模型和现实世界AV的鲁棒性更为实用。我们提出了一个基于黑框增强学习（RL）框架，以生成PE恶意软件分类器和AV引擎的AES。它将对抗性攻击问题视为一个多臂强盗问题，该问题在利用成功模式和探索更多品种之间找到了最佳平衡。与其他框架相比，我们的改进分为三点：1）通过将生成过程建模为无状态过程以避免组合爆炸，2）重复建模中的有效负载； 3）最小化AE样本的更改以正确分配RL学习中的奖励（这也有助于确定逃避的根本原因）。结果，我们的框架比其他现成的框架具有更高的逃避率。结果表明，在纯黑色盒子设置中，两个最先进的ML检测器的逃避率超过74％ - 逃避率超过97％，商业AV的逃避率超过32％。我们还证明，基于ML的分类器之间对抗性攻击的可转移性高于基于ML的分类器和商业AV之间的分类。
Modern commercial antivirus systems increasingly rely on machine learning (ML) to keep up with the rampant inflation of new malware. However, it is well-known that machine learning models are vulnerable to adversarial examples (AEs). Previous works have shown that ML malware classifiers are fragile to the white-box adversarial attacks. However, ML models used in commercial antivirus (AV) products are usually not available to attackers and only return hard classification labels. Therefore, it is more practical to evaluate the robustness of ML models and real-world AVs in a pure black-box manner. We propose a black-box Reinforcement Learning (RL) based framework to generate AEs for PE malware classifiers and AV engines. It regards the adversarial attack problem as a multi-armed bandit problem, which finds an optimal balance between exploiting the successful patterns and exploring more varieties. Compared to other frameworks, our improvements lie in three points: 1) limiting the exploration space by modeling the generation process as a stateless process to avoid combination explosions, 2) reusing the successful payload in modeling; and 3) minimizing the changes on AE samples to correctly assign the rewards in RL learning (which also helps identify the root cause of evasions). As a result, our framework has much higher evasion rates than other off-the-shelf frameworks. Results show it has over 74%--97% evasion rate for two state-of-the-art ML detectors and over 32%--48% evasion rate for commercial AVs in a pure black-box setting. We also demonstrate that the transferability of adversarial attacks among ML-based classifiers is higher than that between ML-based classifiers and commercial AVs.