A method for automatically generating adversarial samples for Pareto multi-objective genetic algorithm
The Pareto optimal adversarial samples are generated by the Pareto multi-objective genetic algorithm, which solves the redundancy problem of adversarial sample generation in the malware detection model and achieves malware attacks with high similarity and high success rate.
Patent Information
- Application Number
- CN202210430618.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-04-22
- Publication Date
- 2025-09-09
- Estimated Expiration
- 2042-04-22
AI Technical Summary
Existing technologies make it difficult to generate malicious code PE adversarial samples that are consistent with the original functions, have high similarity, and have no redundant added actions, resulting in a low attack success rate of the malware detection model.
The Pareto multi-objective genetic algorithm is used to build an action strategy library, design a fitness objective function, and generate Pareto optimal adversarial samples through multi-objective genetic algorithm evolution. Benign executable PE files are used to inject content and are detected through classifier models to ensure that the malicious functions of the samples are not destroyed and the similarity is high.
In the black-box attack scenario, the malicious functions of the generated adversarial samples are not destroyed, the similarity is high, the number of added actions is small, and there is no action redundancy, which significantly improves the attack success rate of the model.
Smart Images
Figure CN114970860B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to a method for automatically generating adversarial samples for a Pareto multi-objective genetic algorithm, and belongs to the technical field of machine learning and network security. Background Art
[0002] In recent years, with the continuous development of the Internet, mobile devices have become an indispensable part of people's lives and work. As big data assets have become increasingly large, users' data and personal privacy have been threatened by malicious software. According to the network security report, new security vulnerabilities and malware in 2021 showed an upward trend compared to 2020. The increased types of malware are mainly concentrated in ransomware, worm viruses and new variants. They mainly attack large enterprises and cause significant economic losses. This has brought severe challenges to our country's network security.
[0003] Malware detection, analysis, and defense are key areas of focus for security researchers. The daily proliferation of new malware variants, their diverse forms, and the complexity of analysis create a significant workload for security professionals. Traditional signature-based detection methods are no longer adequate. The development of machine learning has brought hope to both security professionals and commercial enterprises. Machine learning has matured in the field of malware detection, and the emerging deep learning method, which uses neural networks to extract malware features, offers rapid detection speeds and near-100% success rates.
[0004] Different machine learning models and commercial engines focus on different features for malware detection. To evade classifier detection, attackers subtly modify malware, pack it with a packer, or obfuscate its characters to generate adversarial samples. These samples attack detection models, extracting relevant information to generate new variants that evade detection. Research on adversarial techniques, to ensure the real-world usability of generated samples, mostly uses black-box attack scenarios. These generated adversarial samples can be used for training to improve model accuracy and robustness.
[0005] Currently, adversarial technology has achieved good results in the image field. Modifying pixels and adding subtle perturbations to images can achieve a deceptive effect, with an attack success rate of over 90%. However, for binary executable files, the file format is complex. Generating images based on image field methods and modifying pixels and adding perturbations may cause file format corruption, disappearance of malicious functions, and inability to execute. The attack success rate of adversarial samples that can be generated for models is much lower than that in the image field. Therefore, how to automatically generate malicious code PE adversarial samples that are consistent with the original functions, have high similarity (small perturbation scale), and add no redundant actions to improve the attack success rate of the model is the current research direction. Summary of the Invention
[0006] The technical problem to be solved by the present invention is to provide a method for automatically generating adversarial samples for a Pareto multi-objective genetic algorithm, ensuring that the samples automatically generate the original malicious functions without the need for human intervention, reducing action redundancy, ensuring that the number of added and modified actions is small, and the adversarial samples have a high similarity with the original samples. The content injected into an action section append in the action strategy library is extracted from a benign executable PE file to increase the probability of successful attack, which meets the real executable nature of the generated adversarial samples.
[0007] In order to solve the above technical problems, the technical solution adopted by the present invention is:
[0008] The present invention provides a method for automatically generating adversarial samples for a Pareto multi-objective genetic algorithm, which adopts the following steps:
[0009] Step 1: Build an action strategy library;
[0010] Step 2: Design the fitness objective function;
[0011] Step 3: Select a classifier model. The classifier model detects whether the sample modified by the added action is malicious or benign.
[0012] Step 4: Using the malicious executable PE file as the sample input, generate a random action sequence, perform action mapping according to the action strategy library, modify the input sample, and detect the modified sample with the classifier model selected in step 3. The samples with benign detection results are retained, namely the adversarial samples. The action sequences corresponding to the retained adversarial samples are used to construct a population initialization set so that the Pareto optimal adversarial samples can be obtained through subsequent evolution.
[0013] In step 1 of the present invention, one of the actions in the action policy library constructed is section append, which extracts the content injected into the section of the malicious executable PE file from the benign executable PE sample, uses a third-party Pefile library to parse the benign executable PE file, and obtains the offset PionterRawData mapped to the section content and the corresponding section name.
[0014] The fitness objective function in step 2 of the present invention includes:
[0015] 2.1) Verify the existence of the original malicious function and the similarity between the adversarial sample and the original input sample to ensure that the content injected or deleted when adding actions is minimally modified. The expression is as follows:
[0016] F(M,M′)=s(M,M′)+fun(M′) (1)
[0017] Where M represents the malicious executable PE sample input, M′ represents the adversarial sample, s(M,M′) represents the similarity score between the malicious executable PE sample and the adversarial sample, and fun(M′) represents the reward and punishment mechanism for verifying the original malicious function of the adversarial sample. The verification method uses a local Cuckoo sandbox. If the Cuckoo sandbox executes the adversarial sample with malicious functions, the sample is rewarded with a reward of 1, that is:
[0018]
[0019] 2.2) Reduce the number of modification actions to ensure that the modification of malicious executable PE samples is minimized, and prevent the addition of redundant actions that cause excessive file changes and cause detection anomalies. Calculate the random action sequence A = [a0, a1, ..., a j ] is expressed as follows:
[0020]
[0021] Among them, a i =0 or 1, j represents the number of actions in the action strategy library in step 1.
[0022] The specific steps for generating adversarial samples from malicious executable PE files in step 4 of the present invention are as follows:
[0023] Step 4.1). Generate a random action sequence based on the number of actions in the action strategy library, and use the action strategy library for action mapping;
[0024] Step 4.2). Modify the input malicious executable PE file according to the action mapping;
[0025] Step 4.3) Use the classifier model in step 3 to detect the modified sample generated in step 4.2. If the detection result is benign, that is, an adversarial sample, retain the adversarial sample and construct a population initialization set for the action sequence corresponding to the retained adversarial sample;
[0026] Step 4.4). Evolve the population initialization set using a multi-objective genetic algorithm, following the two fitness objective function constraints in step 2 during the evolution process;
[0027] Step 4.5). Calculate the fitness objective function value, perform non-dominated sorting and crowding calculation according to the fitness objective function value, and finally obtain multiple Pareto optimal adversarial samples that meet the fitness objective function.
[0028] The non-dominated sorting of the present invention takes any two malicious executable PE files M i ,M j:If and only if, for the fitness objective function F(M,M′) and G, F(M i ,M′ i )>F(M j ,M′ j ) and G i <G j , then M i Domination M j ; If there exists a function that satisfies: F(M i ,M′ i )>F(M j ,M′ j ) or G i <G j , then M i and M j Do not dominate each other; when there is no dominated solution for the malicious executable PE file, M i It is called the Pareto optimal solution;
[0029] The crowding degree calculation is to sort the adversarial sample calculation values corresponding to the population in ascending order according to the fitness objective function formula (1) and formula (2), and calculate the sum of the distance differences between the adversarial sample corresponding to the population and the two adjacent individuals in each fitness objective function value. The expression is as follows:
[0030]
[0031] Among them, m is the number of objective functions, and the adversarial sample congestion P corresponding to the maximum and minimum values of the fitness objective function value is dis [i]=∞,f m Represents the mth fitness objective function, f m (i+1) represents the function value of the mth fitness objective function and the i+1th adversarial sample, is the maximum value of the mth fitness objective function after sorting in ascending order, It is the minimum value of the mth fitness objective function after sorting in ascending order.
[0032] The present invention calculates the similarity between the malicious executable PE file input sample and the adversarial sample based on s(M,M′) in formula (1), and converts the malicious executable PE file M and the adversarial sample M′ into grayscale images; uses the differential hash algorithm to calculate the image similarity, which generates a fingerprint string for each image, compares the fingerprints of the two images, calculates the Hamming distance between the fingerprints, and finally obtains the similarity score.
[0033] The classifier model in step three of the present invention is a pre-trained deep learning model.
[0034] In step 4.3 of the present invention, the samples detected as benign by the classifier in step 3, i.e., the adversarial samples, are used as the first condition for implementing subsequent evolution.
[0035] In the evolution process of step 4.4 of the present invention, an elite retention strategy is adopted. The number of adversarial samples obtained is obtained according to the initialization parameter setting in the algorithm, and the adversarial samples obtained are constrained by the fitness function in step 2 and are Pareto optimal adversarial samples.
[0036] The technical effects achieved by adopting the above technical solution are:
[0037] The present invention inserts actions into malicious executable PE files to generate new samples. These new samples are then tested with a classifier. Benign samples undergo a multi-objective genetic algorithm evolution based on fitness objective constraints, resulting in Pareto-optimal adversarial samples. In black-box attack scenarios, a Pareto-oriented multi-objective genetic algorithm is used to ensure that the generated adversarial samples retain their malicious functionality and exhibit high similarity to the original input samples. The algorithm also includes a small number of added actions and eliminates redundant actions, resulting in multiple Pareto-optimal adversarial samples. The content injected into an action section append in the action strategy library is retrieved from a benign executable PE file, increasing the likelihood of a successful attack using the generated adversarial samples. BRIEF DESCRIPTION OF THE DRAWINGS
[0038] Figure 1 It is a flow chart of the method of the present invention. DETAILED DESCRIPTION
[0039] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.
[0040] like Figure 1 As shown in FIG, a method for automatically generating adversarial samples for a Pareto multi-objective genetic algorithm includes the following steps:
[0041] Step 1: Build an action policy library; one of the actions in the action policy library is sectionappend, which extracts the content injected into the section of the malicious executable PE file from the benign executable PE sample. The third-party Pefile library is used to parse the benign executable PE file to obtain the offset PionterRawData mapped to the section content and the corresponding section name.
[0042] Step 2: Design the fitness objective function; it mainly includes the following two parts:
[0043] 2.1) Verify the existence of the original malicious function and the similarity between the adversarial sample and the original input sample to ensure that the content injected or deleted when adding actions is minimally modified. The expression is as follows:
[0044] F(M,M′)=s(M,M′)+fun(M′) (1)
[0045] Where M represents the malicious executable PE sample input, M′ represents the adversarial sample, s(M,M′) represents the similarity score between the malicious executable PE sample and the adversarial sample. The similarity comparison method is as follows: the original input sample M and the adversarial sample M′ are converted into grayscale images; the image similarity is calculated using the differential hashing algorithm, which generates a fingerprint string for each image, compares the fingerprints of the two images, calculates the Hamming distance, and finally obtains the similarity score; fun(M′) represents the reward and punishment mechanism for verifying the original malicious function of the adversarial sample. The verification method uses a local Cuckoo sandbox. If the Cuckoo sandbox executes the malicious function of the adversarial sample, the sample is rewarded with a reward of 1, that is:
[0046]
[0047] 2.2) Reduce the number of modification actions to ensure that the modification of malicious executable PE samples is minimized, and prevent the addition of redundant actions that cause excessive file changes and cause detection anomalies. Calculate the random action sequence A = [a0, a1, ..., a j ] is expressed as follows:
[0048]
[0049] Among them, a i =0 or 1, j represents the number of actions in the action strategy library in step 1;
[0050] Step 3: Select a classifier model. The classifier model detects whether the sample after adding the action modification is malicious or benign. The classifier model of the present invention is a pre-trained deep learning model.
[0051] Step 4: Using the malicious executable PE file as sample input, generate a random action sequence and perform action mapping according to the action strategy library. Modify the input sample and then test the modified sample with the classifier model selected in step 3. Keep the samples with benign test results as adversarial samples. Construct a population initialization set for the action sequences corresponding to the retained adversarial samples so as to obtain the Pareto optimal adversarial samples in the subsequent evolution. The specific steps are as follows:
[0052] Step 4.1). Generate a random action sequence based on the number of actions in the action strategy library, and use the action strategy library for action mapping; the action strategy library contains 10 modification actions, so the generated random action sequence is [a0, a1, ..., a9], a i 0 or 1 represents whether the corresponding action is selected;
[0053] Step 4.2) Modify the input malicious executable PE file according to the action mapping in step 4.1; if section append is used, obtain the injection content of the benign executable PE file from step 1 above;
[0054] Step 4.3) Use the classifier model from step 3 to test the modified sample generated in step 4.2. If the test result is benign, i.e., an adversarial sample, the adversarial sample is retained, and a population initialization set is constructed for the action sequence corresponding to the retained adversarial sample. During the evolution process, the sample detected as benign by the classifier from step 3, i.e., the adversarial sample, is used as the first condition for subsequent evolution operations. The purpose of setting this condition is to reduce the overall evolution time, more quickly find the Pareto optimal adversarial sample, and accelerate algorithm convergence.
[0055] Step 4.4) Evolve the population initialization set using a multi-objective genetic algorithm, adhering to the two fitness objective function constraints in step 2. The algorithm evolves for 20 generations in this invention. The generation of adversarial samples not only bypasses the detection of the classifier model but also requires malicious functionality detection in the Cuckoo sandbox to observe whether the adversarial sample format and executability are damaged, thereby ensuring the authenticity of the generated adversarial samples and improving the success rate of the attack.
[0056] Step 4.5). Calculate the fitness objective function value, perform non-dominated sorting and crowding distance calculation based on the fitness objective function value, and finally obtain multiple Pareto optimal adversarial examples that meet the fitness objective function. The specific steps are as follows:
[0057] Step 4.5.1). The adversarial sample corresponding to the population initialization is calculated according to the fitness objective function in step 2. First, the adversarial sample is executed using the Cuckoo sandbox to detect the executableness of the sample and the consistency of the original malicious function. A reward is given for the existence of both, and the reward score is 1. The sample and the original input PE sample are transformed into a grayscale image of 256×256 pixels, and the image fingerprint is generated by the difference hash algorithm. The main steps of calculating the fingerprint are: reducing the image size to 9×8 pixels, calculating the difference value, and generating 8 different differences between 9 pixels in each row according to the size, with a total of 8 rows, forming 64 difference values; obtaining the fingerprint hash value, calculating the Hamming distance between the two image fingerprints, and finally calculating the similarity score, and then obtaining the function value of formula (1) of the adversarial sample. The calculation of the value of formula (2) is the non-zero number of random action sequences generated in step 4.1;
[0058] That is, each adversarial example has two attribute values: F(M,M′) and G. The fitness objective function values of the adversarial examples corresponding to the population are calculated to form sets F and G. The adversarial examples are non-dominated sorted, that is, the adversarial examples that satisfy both Max{F} and Min{G} are selected for the next generation of evolution.
[0059] The present invention has two fitness objective functions F(M,M′) and G, where the non-dominated sorting takes any two malicious executable PE files M i ,M j :If and only if, for the fitness objective function F(M,M′) and G in step 2, there is F(M i ,M′ i )>F(M j ,M′ j ) and G i <G j , then M i Domination M j ; If there exists a function that satisfies: F(M i ,M′ i )>F(M j ,M′ j ) or G i <G j , then M i and M j Do not dominate each other; when there is no dominated solution for the malicious executable PE file, M i It is called the Pareto optimal solution; where M′ i Indicates a malicious executable PE file M i Generated adversarial samples detected by the classifier model, M′ j Indicates a malicious executable PE file M j Generated adversarial samples detected by the classifier model, Gi and G j Represent M′ respectively i and M′ j Substitute the corresponding action sequence into the fitness objective function to calculate the non-zero function value;
[0060] Step 4.5.2). Using the elite retention strategy, select the best sample according to the non-dominated level division to form the first generation parent population P t ;
[0061] Step 4.5.3) For the parent population P t In the genetic algorithm, the selection, crossover, and mutation operations are performed using a binary tournament selection method. The optimal population action sequence is crossover and mutation operations are performed to ensure population dominance. The offspring population C is generated and the population is merged. The number of the offspring population is twice that of the initial population.
[0062] Step 4.5.4). Perform non-dominated sorting on the merged population, and calculate the crowding degree between individuals of the same non-dominated level according to the non-dominated level division to ensure the diversity of individuals in the population and avoid falling into the local optimum; when selecting two individuals, if they are in different non-dominated layers, they are selected according to the non-dominated level, otherwise they are judged according to the crowding degree; put them into the new population P t+1 until the population size of this generation is equal to the initial population size;
[0063] The crowding calculation is to sort the adversarial sample calculation values corresponding to the population in ascending order according to the fitness objective function formula (1) and formula (2), and calculate the sum of the distance differences between the adversarial sample corresponding to the population and the two adjacent individuals in each fitness objective function value. The expression is as follows:
[0064]
[0065] Among them, m is the number of objective functions, the initial parameter P dis [i] = 0, the adversarial sample crowding degree P corresponding to the maximum and minimum values of the fitness objective function value dis [i]=∞,f m Represents the mth fitness objective function, f m (i+1) represents the function value of the mth fitness objective function and the i+1th adversarial sample, is the maximum value of the mth fitness objective function after sorting in ascending order, It is the minimum value of the mth fitness objective function after sorting in ascending order;
[0066] Step 4.5.5). Repeat steps 4.5.3 and 4.5.4 until the number of evolutions set by the present invention is met; form a Pareto frontier and generate a Pareto optimal adversarial sample that meets the multi-objective constraints.
[0067] The present invention inserts actions into malicious executable PE files to generate new samples. These new samples are then tested with a classifier. Benign samples undergo a multi-objective genetic algorithm evolution based on fitness objective constraints, resulting in Pareto-optimal adversarial samples. In black-box attack scenarios, a Pareto-oriented multi-objective genetic algorithm is used to ensure that the generated adversarial samples retain their malicious functionality and exhibit high similarity to the original input samples. The algorithm also includes a small number of added actions and eliminates redundant actions, resulting in multiple Pareto-optimal adversarial samples. The content injected into an action section append in the action strategy library is retrieved from a benign executable PE file, increasing the likelihood of a successful attack using the generated adversarial samples.
[0068] In the scenario of black-box attack, the present invention uses Pareto optimal adversarial samples generated experimentally to form an adversarial sample set; attacks are carried out on multiple commercial detection engines, and the attack results demonstrate the feasibility of the method and the authenticity of the generated adversarial samples, significantly improving the attack success rate.
[0069] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions or improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.
Claims
1. A method for automatically generating adversarial samples for Pareto multi-objective genetic algorithm, characterized by: Use the following steps: Step 1: Build an action strategy library; Step 2: Design the fitness objective function; The fitness objective function includes: 2.1) Verify the existence of the original malicious function and the similarity between the adversarial sample and the original input sample to ensure that the content injected or deleted when adding actions is minimally modified. The expression is as follows: F(M,M ′ )=s(M,M ′ )+fun(M ′ ) (1) Where M represents the malicious executable PE sample input, M ′ Denotes adversarial samples, s(M,M ′ ) represents the similarity score between malicious executable PE samples and adversarial samples, fun(M ′ ) represents the reward and punishment mechanism for verifying the original malicious functions of the adversarial sample. The verification method uses a local Cuckoo sandbox. If the Cuckoo sandbox executes the adversarial sample with malicious functions, the sample is rewarded with a reward of 1, that is: 2.2) Reduce the number of modification actions to ensure that the modification of malicious executable PE samples is minimized, and prevent the addition of redundant actions that cause excessive file changes and cause detection anomalies. Calculate the random action sequence A = [a0, a1, ..., a j ] is expressed as follows: Among them, a i =0 or 1, j represents the number of actions in the action strategy library in step 1; Step 3: Select a classifier model. The classifier model detects whether the sample modified by the added action is malicious or benign. Step 4: Generate a random action sequence based on the number of actions in the action strategy library, and use the action strategy library to perform action mapping; modify the input malicious executable PE file according to the action mapping; use the classifier model in step 3 to detect the modified sample. If the detection result is benign, that is, an adversarial sample, the adversarial sample is retained, and a population initialization set is constructed for the action sequence corresponding to the retained adversarial sample; perform multi-objective genetic algorithm evolution on the population initialization set, and follow the two fitness objective function constraints in step 2 during the evolution process; calculate the fitness objective function value, perform non-dominated sorting and crowding calculation according to the fitness objective function value, and finally obtain multiple Pareto optimal adversarial samples that meet the fitness objective function.
2. The method for automatically generating adversarial samples for a Pareto multi-objective genetic algorithm according to claim 1, characterized in that: One of the actions in the action policy library constructed in step one is section append, which extracts the content injected into the section of the malicious executable PE file from the benign executable PE sample, uses a third-party Pefile library to parse the benign executable PE file, and obtains the offset PionterRawData mapped to the section content and the corresponding section name.
3. The method for automatically generating adversarial samples for a Pareto multi-objective genetic algorithm according to claim 1, characterized in that: The non-dominated sorting takes any two malicious executable PE files M i ,M j :If and only if, for the fitness objective function F(M,M′) and G, F(M i ,M′ i )>F(M j ,M′ j ) and G i <G j , then M i Domination M j ; If there exists a function that satisfies: F(M i ,M′ i )>F(M j ,M′ j ) or G i <G j , then M i and M j Do not dominate each other; when there is no dominated solution for the malicious executable PE file, M i It is called the Pareto optimal solution; The crowding degree calculation is to sort the adversarial sample calculation values corresponding to the population in ascending order according to the fitness objective function formula (1) and formula (2), and calculate the sum of the distance differences between the adversarial sample corresponding to the population and the two adjacent individuals in each fitness objective function value. The expression is as follows: Among them, m is the number of objective functions, and the adversarial sample congestion P corresponding to the maximum and minimum values of the fitness objective function value is dis [i]=∞,f m Represents the mth fitness objective function, f m (i+1) represents the function value of the mth fitness objective function and the i+1th adversarial sample, is the maximum value of the mth fitness objective function after sorting in ascending order, It is the minimum value of the mth fitness objective function after sorting in ascending order.
4. The method for automatically generating adversarial samples for a Pareto multi-objective genetic algorithm according to claim 1, characterized in that: For s(M,M in formula (1) ′ ) Calculate the similarity between the malicious executable PE file input sample and the adversarial sample, and compare the malicious executable PE file M and the adversarial sample M ′ Convert to grayscale image; The image similarity is calculated using the differential hashing algorithm, which generates a fingerprint string for each image, compares the fingerprints of two images, calculates the Hamming distance between the fingerprints, and finally obtains a similarity score.
5. The method for automatically generating adversarial samples for a Pareto multi-objective genetic algorithm according to claim 1, characterized in that: The classifier model in step three is a pre-trained deep learning model.
6. The method for automatically generating adversarial samples for a Pareto multi-objective genetic algorithm according to claim 1, characterized in that: In the step 4, the samples detected as benign by the classifier in the step 3, i.e., the adversarial samples, are used as the first condition for implementing subsequent evolution.
7. The method for automatically generating adversarial samples for a Pareto multi-objective genetic algorithm according to claim 1, characterized in that: In the fourth step of the evolution process, an elite retention strategy is adopted. The number of adversarial samples obtained is determined according to the initialization parameter settings in the algorithm. The adversarial samples obtained are constrained by the fitness function in the second step and are Pareto optimal adversarial samples.