Adversary Resistant Deep Neural Networks with an Application to Malware Detection

Abstract

Beyond its highly publicized victories in Go, there have been numerous successful applications of deep learning in information retrieval, computer vision and speech recognition. In cybersecurity, an increasing number of companies have become excited about the potential of deep learning, and have started to use it for various security incidents, the most popular being malware detection.ese companies assert that deep learning (DL) could help turn the tide in the ba le against malware infections. However, deep neural networks (DNNs) are vulnerable to adversarial samples, a aw that plagues most if not all statistical learning models. Recent research has demonstrated that those with malicious intent can easily circumvent deep learning-powered malware detection by exploiting this aw.In order to address this problem, previous work has developed various defense mechanisms that either augmenting training data or enhance model's complexity. However, a er a thorough analysis of the fundamental aw in DNNs, we discover that the e ectiveness of current defenses is limited and, more importantly, cannot provide theoretical guarantees as to their robustness against adversarial sampled-based a acks. As such, we propose a new adversary resistant technique that obstructs a ackers from constructing impactful adversarial samples by randomly nullifying features within samples. In this work, we evaluate our proposed technique against a real world dataset with 14,679 malware variants and 17,399 benign programs. We theoretically validate the robustness of our technique, and empirically show that our technique signi cantly boosts DNN robustness to adversarial samples while maintaining high accuracy in classi cation. To demonstrate the general applicability of our proposed method, we also conduct experiments using the MNIST and CIFAR-10 datasets, generally used in image recognition research. ACM Reference format:

Adversarial Learning Targeting Deep Neural Network Classification: A Comprehensive Review of Defenses Against Attacks

“…It also "services" multiple active learning objectives. As seen later (and also earlier, in [91]), randomization plays an important role more generally in some defensive schemes against adversarial attacks.…”

“…Moreover, irrespective of whether detection is truly "easier", this argument (that detection is essentially a subset of robust classification) is not made in many of the robust classification defense papers -it is simply assumed that the only objective of interest is to defeat the attack by correctly classifying in the face of it. Attack detection is not even considered in [23], [91], [72], [52], [100]. By contrast, in Section IV, we will give much stronger arguments for the intrinsic value in making detection inferences and will point out that, in some scenarios, when an attack is present, making robust classification inferences in fact has no utility.…”

“…a) Feature Obfuscation: This approach alters features so as to hopefully destroy the attack pattern. For example, [91] considers DNNs for digit recognition and malware detection. They randomly nullify (zero) input features, both during training and testing/inference.…”

“…This may "eliminate" perturbed features in a test-time pattern. However, for the malware domain, the features as defined in [91] are binary ∈ {0, 1}. Thus, nullifying (zeroing) does not necessarily alter a feature's original value (if it is already zero).…”

Stochastic Substitute Training

“…Wang et al in [36] proposed an adversary resistant technique to obstruct attackers from constructing impactful adversarial samples. They called this adversarial resistant technique "random feature nullification" and is described as follows: For each batch of inputs denoted by X ∈ R n×m , where n is the number of samples and m is the feature vector size, random feature nullification performs element-wise multiplication of X with a randomly generated mask matrix I p ∈ R n×m , where its elements are only 1 or 0.…”