Deceiving End-to-End Deep Learning Malware Detectors using Adversarial Examples

TLDR

Deep learning has achieved breakthroughs across many domains but is vulnerable to adversarial examples, and while it has been applied to malware detection, crafting such examples is difficult because small byte modifications can break functionality. The authors propose a novel loss function designed to generate adversarial examples for discrete inputs such as executable bytes. They inject a small payload of bytes into malicious binaries to make them appear benign to an end‑to‑end convolutional malware detector while preserving functionality. The method achieves a high evasion rate, and the payload is robust, transferable across file locations and files, and has low entropy similar to benign sections.

Abstract

In recent years, deep learning has shown performance breakthroughs in many applications, such as image detection, image segmentation, pose estimation, and speech recognition. However, this comes with a major concern: deep networks have been found to be vulnerable to adversarial examples. Adversarial examples are slightly modified inputs that are intentionally designed to cause a misclassification by the model. In the domains of images and speech, the modifications are so small that they are not seen or heard by humans, but nevertheless greatly affect the classification of the model. Deep learning models have been successfully applied to malware detection. In this domain, generating adversarial examples is not straightforward, as small modifications to the bytes of the file could lead to significant changes in its functionality and validity. We introduce a novel loss function for generating adversarial examples specifically tailored for discrete input sets, such as executable bytes. We modify malicious binaries so that they would be detected as benign, while preserving their original functionality, by injecting a small sequence of bytes (payload) in the binary file. We applied this approach to an end-to-end convolutional deep learning malware detection model and show a high rate of detection evasion. Moreover, we show that our generated payload is robust enough to be transferable within different locations of the same file and across different files, and that its entropy is low and similar to that of benign data sections.