Making malware classification more robust to adversarial attacks

摘要：现代恶意软件分类使用各种技术来判断特定示例是恶意的还是良性的。人工智能领域的最新进展为机器学习模型(如人工神经网络)在恶意软件分类中发挥重要作用铺平了道路。然而，现在众所周知的是，这种模型很容易受到对抗性例子的影响。对抗性的例子是这样一个例子，它被设计成故意欺骗分类器，以便它错误地分类它。已经讨论和提出了各种技术，以使分类器对此类攻击更具弹性，但大多数工作都是在图像识别领域(与恶意软件分类相反)进行的，这些技术并不是最优的。恶意软件分类中的弹性是绝对重要的，因此我们的目标是设计技术来对抗这一领域中的敌意例子的影响。-我们希望研究的各种技术，例如基于混合模型的系统、监管系统，甚至可能是基于机器学习的方法来对抗敌意例子是特别新颖的。由于缺乏这方面的工作，我目前正处于深入的文献综述阶段，以衡量这一领域的研究成果，因为这一领域大多未被探索。建议的研究方法如下：1.针对研究目标和现有工作领域的广泛文献综述。对这些现有的防御措施和其他更新颖的技术进行实验评估，从实用的角度了解当前的状态。确定现有技术中存在的问题以及改进的机会所在。开发能够反制对抗性例子的错误分类的技术。对开发的技术进行评价和分析，并与现有技术进行比较。讨论结果，并在期末论文中报告结果。

Abstract:Modern malware classification uses various techniques to gauge whether a particular example is malicious or benign. Recent advances in AI have paved the way for machine learning models (such as artificial neural networks) to play a substantial role in malware classification. However, it is now well-known that such models are susceptible to adversarial examples. An adversarial example is an example which is designed to intentionally deceive the classifier so that it misclassifies it. Various techniques have been discussed and presented to make classifiers more resilient against such attacks, but most work has been carried out in the image recognition domain (as opposed to malware classification) and these techniques are not optimal. Resilience in malware classification is absolutely vital and thus we aim to devise techniques to counter the effects of adversarial examples in this domain.---There are various techniques which we wish to research such as a system based on hybrid models, a regulatory system or perhaps even machine learning-based approaches to counter adversarial examples are especially novel. As a result of the lack of work in this area, I am currently in a deep literature review phase to gauge what has been done in this area since it is mostly unexplored for this domain.A proposed research methodology is below:1. Extensive literature review specific to areas in research objective as well as existing works.2. Experimental evaluation of these existing defences and other more novel techniques to understand the current state from a practical point of view.3. Identification of problems within existing techniques and where opportunities for enhancement lie.4. Development of techniques to be able to counter erroneous misclassification of adversarial examples.5. Evaluation and analysis of the developed techniques and comparison with existing techniques.6. Discussion of results and report on results through final thesis.