Adversarial Deep Learning for Robust Detection of Binary Encoded Malware

I Introduction

Deep neural networks (DNN) started as extensions of neural networks in artificial intelligence approaches to computer vision and speech recognition. They are also used in computer security applications such as malware detection. A large challenge in developing malware detection models is the intelligent adversaries who actively try to evade them by judiciously perturbing the detectable malware to create what are called Adversarial Examples (AEs), i.e. malware variants that evade detection.

Much of the work done to understand and counter AEs has occurred in the image classification domain. An adversarial attack on an image classifier perturbs an image so that it is perceptually no different to a human but now classified incorrectly by the classifier. To counter them, researchers have demonstrated how DNN models can be trained more robustly. These methods assume a continuous input domain .

Our interest is malware detection where, in contrast to images, detectors often use features represented as binary (${0,1})$ inputs. Malware AEs must not only fool the detector, they must also ensure that their perturbations do not alter the malicious payload. Our preliminary goal is to develop a method that, as is done in the continuous space, can generate (binary) perturbations of correctly classified malware that evade the detector. Our central goal is to investigate how the robust adversarial training methods for continuous domains can be transformed to serve the discrete or categorical feature domains that include malware. We can measure the effectiveness of a robust adversarial malware method on training a classifier by the evasion rate of AEs and we also seek an online training measure that expresses the general expectation of model robustness.

This leads to the following contributions at the intersection of security and adversarial machine learning:

The paper is structured as follows. section II presents background and related work. section III describes the method. Experiments are in section IV. Finally, conclusions are drawn and future work is outlined in section V.

II Background

Malware detection is moving away from hand-crafted rule-based approaches and towards machine learning techniques . In this section we focus on malware detection with neural networks (section II-A), adversarial machine learning (section II-B) and adversarial malware versions (section II-C).

Neural network methods for malware detection are increasingly being used. For features, one study combines DNN’s with random projections and another with two dimensional binary PE program features . Research has also been done on a variety of file types, such as Android and PE files . While the specifics can vary greatly, all machine learning approaches to malware detection share the same central vulnerability to AEs.

II-B Adversarial Machine Learning

Finding effective techniques that robustly handle AEs is one focus of adversarial machine learning . An adversarial example is created by making a small, essentially non-detectable change to a data sample $\mathbf{x}$ to create $\mathbf{x}_{adv}=\mathbf{x}+\delta$. If the detector misclassifies $\mathbf{x}_{adv}$ despite having correctly classified $\mathbf{x}$, then $\mathbf{x}_{adv}$ is a successful adversarial example. Goodfellow et al. provide a clear explanation for the existence of AEs.

There are a variety of techniques that generate AEs . One efficient and widely used technique is the fast gradient sign method (FGSM) . With respect to an input, this method finds the directions that move the outputs of the neural network the greatest degree and moves the inputs along these directions by small amounts, or perturbations. Let $\mathbf{x}$ represent an input, $\mathbf{\theta}$ the parameters of the model, $y$ the labels, and $L(\mathbf{\theta},\mathbf{x},y)$ be the associated loss generated by the network. Maintaining the restriction of $\epsilon$-max perturbation, we can obtain a max-norm output change using $\eta=\epsilon\textnormal{sgn}(\nabla_{\mathbf{x}}L(\mathbf{\theta},\mathbf{x},y))$. Because the technique references the detector’s parameters, it is known as a white-box attack model .

There have been multiple studies focused on advancing model performance against AEs, e.g. . One obvious approach is retraining with the AEs incorporated into the training set. We are attracted to the approach of . It casts model learning as a robust optimization problem with a saddle-point formulation where the outer minimization of detector (defensive) loss is tied to the inner maximization of detector loss (via AEs) . The approach successfully demonstrated robustness against adversarial images by incorporating, while training, AEs generated using projected gradient descent.

II-C Adversarial Malware

Security researchers have generated malware AEs using an array of machine learning approaches such as reinforcement learning, genetic algorithms and supervised learning including neural networks, decision trees and SVM . These approaches, with the exception of , are black box. They assume no knowledge of the detector though the detector can be queried for detection decisions. Multiple studies use binary features, typically where each index acts as an indicator to express the presence or absence of an API call, e.g. . One study also includes byte/entropy histogram features . Studies to date have only retrained with AEs.

Uniquely, this work generates functional white-box AEs in the discrete, binary domain while incorporating them into the training of a malware classifier that is robust to AEs.

III Method

To address the problem of hardening machine learning anti-malware detectors via adversarial learning, we formulate the adversarial learning procedure as a saddle-point problem in line with . Before describing the problem formally and presenting our proposed approach to tackle the same, we introduce the notation and terminology used in the rest of the paper.

III-B Malware Adversarial Learning as a Saddle Point Problem

Blind spots are regions in a model’s decision space, on either side of the decision boundary, where, because no training example was provided, the decision boundary is inaccurate. Blind spots of malware detection models—such as the one learned in (1)—can be exploited to craft misclassified adversarial malware samples from a correctly classified malware, while still preserving malicious functionality. An adversarial malware version $\mathbf{x}_{adv}$ (which may or may not be misclassified) of a correctly classified malware $\mathbf{x}$ can be generated by perturbing $\mathbf{x}$ in a way that maximizes the loss $L$, i.e.,

where $\mathcal{S}(\mathbf{x})\subseteq\mathcal{X}$ is the set of binary indicator vectors that preserve the functionality of malware $\mathbf{x}$, and $\mathcal{S}^{*}(\mathbf{x})\subseteq\mathcal{S}(\mathbf{x})$ is the set of adversarial malware versions that maximize the adversarial loss.

To harden the model learned in (1) against the adversarial versions generated in (2), one needs to incorporate them into the learning process. We choose to do so by making use of the saddle-point formulation presented in . Thus, our adversarial learning composes (1) and (2) as:

III-C Adapting Gradient-Based Inner Maximization Methods for Binary Feature Spaces

III-D Blind Spots Coverage

With adversarial learning, we aim to discover and address blind spots of the model while learning its parameters simultaneously. In other words, we would like to incorporate as many members of $\mathcal{S}^{*}(\mathbf{x})$ as possible in training the model. In line with this notion, we propose a new measure called the blind spots covering number, denoted $\mathcal{N}_{BS}$, which measures the effectiveness of an algorithm $\mathcal{A}$ in computing the inner maximizers of (3). The measure is defined as the expected ratio of the number of adversarial malware versions crafted by $\mathcal{A}$ during training, denoted by $\mathcal{S}^{*}_{\mathcal{A}}(\mathbf{x})$, to the maximum possible number of the same. Formally, it can be written as follows.

Models trained with high $\mathcal{N}_{BS}$ have seen more AEs in training, and because training against multiple AEs implies more exhaustive approximations of the inner maximization problem, they are expected to be more robust against adversarial attacks . While it may be computationally expensive to compute (4) exactly, we provide a probabilistic approximation of it in section IV-B.

III-E Adversarial Learning Framework

Having specified four methods for approximating the inner maximizers of (3) and a measure of their effectiveness, we can now describe Sleipnir, our adversarial learning framework for robust malware detection. Consider a training dataset $D$ of $n$ independent and identically distributed samples drawn from $\mathcal{D}$. As outlined in Algorithm 1 and depicted in Fig. 2, Sleipnir groups $D$ into minibatches $B$ of $s$ examples similar to . However, the grouping here is governed by the examples’ labels: the first $r<s$ examples are malicious, followed by $s-r$ benign examples. At each training step, the model’s parameters $\mathbf{\theta}$ are optimized with respect to the adversarial loss (2) of malware executables and the natural loss (1) of benign executables. This is motivated by the fact that authors of benign applications have no interest in having their binaries misclassified as malwares . However, one should note that a malware author might wish to create adversarial benign applications to poison the training dataset. This possibility is considered for future work. As an equation, our empirical saddle-point problem at each training step has the form

IV Experiments

This section provides an empirical evaluation of our proposition in section III. We conduct experiments to validate and compare the efficacy of the proposed methods in terms of classification accuracy, evasion rates, and blind spots coverage. First, the setup of our experiments is described in section IV-A, followed by a presentation of the results in section IV-B.

Dataset. The Portable Executable (PE) format is a file format for executables in Windows operating systems. The format encapsulates information necessary for Windows OS to manage the wrapped code. PE files have widespread use as malware. We created a corpus of malicious and benign PE files from VirusShare and internet download sites, respectively.

To label the collected PEs, we use VirusTotal’s ensemble of virus detectors. We require benign files to have 0% positive detections from the ensemble and malicious files to have greater than 50% positive detections to avoid false positives. At the time of writing this paper, we have 34,995 malicious and 19,696 benign PEs.

Feature Representation. As mentioned earlier, each portable executable is represented as a binary indicator feature vector. Each index of the feature vector represents a unique Windows API call and a ”1” in a location represents the presence of the corresponding API call. In our dataset of PEs, we found a total of 22,761 unique API calls. Thus, each PE file is represented by a binary indicator vector $\mathbf{x}\in\{0,1\}^{m}$, with $m=22,761$. We use the LIEF library to parse each PE and turn it into its representative binary feature vector. The generated feature vectors are available by request.

Neural Net ($N$) Architecture. We use a feed-forward network for our malware classifier $N$ with 3 hidden layers of 300 neurons each. The ReLU activation function is applied to all the $3\times 300$ hidden neurons. The LogSoftMax function is applied to the output layer’s two neurons which correspond to the two labels at hand: benign and malicious. The model is implemented in PyTorch .

Learning Setup. We use $19,000$ benign PEs and $19,000$ malicious PEs to construct our training ($60\%$), validation ($20\%$), and test ($20\%$) sets. The training set is grouped into minibatches of $16$ PE samples according to Line 3 of Algorithm 1. The classifier $N$’s parameters $\mathbf{\theta}$ are tuned with respect to (5), where $L$ is the negative log likelihood loss, using the ADAM optimization algorithm with a 0.001 learning rate over 150 epochs. Note that one step of ADAM corresponds to Line 6 of Algorithm 1. To avoid overfitting, model parameters at the minimum validation loss are used as the final learned parameters $\mathbf{\theta}^{*}$. With regard to the inner maximizers algorithms (Table I), all were set to perform $50$ steps, i.e., $k=50$. This makes the step size $\epsilon$ for d$\texttt{FGSM}^{k}$ and r$\texttt{FGSM}^{k}$ small enough (we set it to $\epsilon=0.02$) to follow the gradient accurately while also ensuring that multi-steps could reach close to other vertices of the binary feature space (Fig. 1) and not be suppressed by rounding. With $50$ steps and $0.02$ step size, both these conditions are met. We run Algorithm 1 with $\mathcal{A}$ being set to each of the inner maximizers from Table I to obtain 4 adversarially trained models in addition to the model trained naturally. We also used the adversarial sample crafting method presented by Grosse et al. [13, Algorithm 1] which trains a model adversarially without using a saddle-point formulation: the AEs in are tuned with respect to the value of the benign output neuron rather than the loss $L$. Though not directly, this does maximize the adversarial loss value. All experiments for the six models were run on a CUDA-enabled GTX 1080 Ti GPU.

IV-B Results

For brevity, we refer to the trained models by their inner maximizer methods. Experiment results are presented in Tables II and III as follows.

Classification Performance. Based on Table II, all the adversarially trained models achieve a classification accuracy comparable to the naturally trained counterpart. However, we observe that models trained using inner maximizers of Table I tend to have higher false positive rate (FPR) and lower false negative rate (FNR)—positive denotes malicious. The FPR increase can be explained by the transforming of malware samples when models are trained adversarially. Such transformations could turn malware feature vectors into ones more similar to those of the benign population, and subsequently the benign test set. Likewise, the FNR decrease can be attributed to the adversarial versions boosting the model’s confidence on vertices with less original malicious samples compared to the benign samples. With ’s method, it is the other way around. Arguably, the reason is that its adversarial objective is to maximize just the benign (negative) neuron’s output and it is indifferent to the malicious (positive) neuron. As a result, the crafted adversarial malware version does not necessarily end up at a vertex at which the model’s confidence, with respect to the malicious label, is low, which consequently improves the FPR and worsens the FNR.

Robustness to Evasion Attacks. We tried the adversarial attackers generated by the inner maximizers and ’s method as inputs to each of the trained models to assess their robustness against the adversaries generated during training as well as other adversaries. It can be seen in Table III that r$\texttt{FGSM}^{k}$ is our most successful adversarial training method, achieving relatively low evasion rates across all attack methods. As expected, all training methods are resistant to attacks using the same method, but each method aside from r$\texttt{FGSM}^{k}$ has at least one adversarial method that it performs poorly against. Evasion rates for Natural training, which uses non-altered malicious samples, provide a baseline for comparison.

Blind Spots Coverage. Given the high-dimension feature vectors and the sizeable dataset, it was computationally expensive to compute $\mathcal{N}_{BS}$ exactly. Instead, we computed an approximate probabilistic measure $\bar{\mathcal{N}}_{BS}$ using a Bloom filter . The computed measures are presented in the last column of Table II as the ratio of total adversarial malware versions to original samples over all the training epochs. Natural training has a ratio of $1.0$ since we do not modify the malicious samples in any way. A coverage value of $4.0$ for r$\texttt{FGSM}^{k}$ means that with high probability we explored $4$ times as many malicious samples compared to Natural training. A high coverage value indicates that the adversarial training explored more of the valid region $\mathcal{S}(\mathbf{x})$ for malware sample $\mathbf{x}$, resulting in a more robust model. This observation is substantiated by the correlation between coverage values in Table II and evasion rates in Table III. Note that $\bar{\mathcal{N}}_{BS}$ is computed and updated after each training step. Thus, it can be used as an online measure to assess training methods’ robustness to adversarial attacks.

V Conclusions and Future Work

We investigated methods that reduce the adversarial blind spots for neural network malware detectors. We approached this as a saddle-point optimization problem in the binary domain and used this to train DNNs via multiple inner maximization methods that are robust to adversarial malware versions of the dataset.

We used a dataset of PE files to assess the robustness against evasion attacks. Our experiments have demonstrated once again the power of randomization in addressing challenging problems, conforming to the conclusions provided by state-of-art attack papers . Equipping projected gradient descent with randomness in rounding helped uncover roughly 4 times as many malicious samples in the binary feature space as those uncovered in natural training. This performance correlated with the online measure we introduced to assess the general expectation of robustness.

There are several future research questions. First, we would like to study the loss landscape of the adversarial malware versions and the effect of starting point $\mathbf{x}^{0}$ initialization for inner maximizers, in comparison to their continuous-domain counterparts. Second, $\mathcal{N}_{BS}$ quantifies how many different adversarial examples are generated but it does not capture how they are located with regard to the benign examples and, subsequently, their effect on the model’s FPR and FNR. We hope that investigating these directions will lead towards fully resistant deep learning models for malware detection.

Acknowledgment

This work was supported by the MIT-IBM Watson AI Lab and CSAIL CyberSecurity Initiative.

References