Adversarial Malware Detection via Feature Perturbation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional machine learning techniques are susceptible to adversarial malware that evades detection by modifying features, making it difficult to distinguish between benign and malicious software, leading to compromised security.
Innovation Solution
An adversarial malware detector system that includes a sandbox for feature extraction, a machine learning engine for classification, and a feature perturber to identify and remove extraneous features, using techniques like Jacobian-based saliency map attacks to reclassify potentially masked malware as malicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional machine learning techniques are used for malware detection, then the detection process is simple and fast, but the system becomes susceptible to adversarial malware that modifies features to evade detection
Solution Approach 1:
The system performs preliminary actions by generating multiple perturbed versions of the program before final classification. The feature perturber creates modified feature representations that are classified separately, and the original classification is only finalized after comparing with perturbed results. This preliminary perturbation and comparison process prevents adversarial malware from evading detection through feature modification.
Solution Approach 2:
The perturbed feature representations serve as intermediaries between the original program features and the final classification decision. By introducing these intermediate perturbed versions, the system can compare classifications across multiple representations and identify cases where adversarial modifications have occurred, thereby improving reliability without requiring complete system redesign.
2Measurement precision
If the system classifies programs based on original feature representations only, then the classification process is fast, but adversarial malware can be misclassified as benign
Solution Approach 1:
The system applies partial perturbation rather than exhaustive analysis. It generates a limited number of perturbed feature representations (controlled by maximum perturbations parameter) and compares their classifications. This partial action approach maintains reasonable processing speed while significantly improving classification accuracy by catching adversarial modifications through multiple sampling rather than complete analysis.
Solution Approach 2:
The classification process uses periodic perturbation and re-classification at controlled intervals. The system periodically perturbs features and re-classifies the program, with the cycle controlled by the maximum perturbations parameter. This periodic action ensures thorough checking for adversarial malware while maintaining productivity by limiting the frequency and number of perturbation cycles.
3Reliability
If no feature perturbation is performed, then the detection system operates efficiently, but it cannot identify adversarial malware that masks malicious features
Solution Approach 1:
The system extracts and separately analyzes perturbed feature representations from the original program features. By taking out these perturbed versions and classifying them separately, the system can compare classifications to detect adversarial malware. This extraction approach improves reliability by isolating the perturbation analysis process while managing complexity through modular design of the feature perturber component.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
Methods and apparatus to detect adversarial malware are disclosed. An example adversarial malware detector includes a machine learning engine to classify a first feature representation representing features of a program as benign or malware, a feature perturber to, when the first feature representation is classified as benign, remove a first one of the features to form a second feature representation, and a decider to classify the program as adversarial malware when the machine learning engine classifies the second feature representation as malware.