Being Single Has Benefits. Instance Poisoning to Deceive Malware Classifiers

Abstract

The performance of a machine learning-based malware classifier depends on the large and updated training set used to induce its model. In order to maintain an up-to-date training set, there is a need to continuously collect benign and malicious files from a wide range of sources, providing an exploitable target to attackers. In this study, we show how an attacker can launch a sophisticated and efficient poisoning attack targeting the dataset used to train a malware classifier. The attacker's ultimate goal is to ensure that the model induced by the poisoned dataset will be unable to detect the attacker's malware yet capable of detecting other malware. As opposed to other poisoning attacks in the malware detection domain, our attack does not focus on malware families but rather on specific malware instances that contain an implanted trigger, reducing the detection rate from 99.23% to 0% depending on the amount of poisoning. We evaluate our attack on the EMBER dataset with a state-of-the-art classifier and malware samples from VirusTotal for end-to-end validation of our work. We propose a comprehensive detection approach that could serve as a future sophisticated defense against this newly discovered severe threat.

Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art

“…In addition, it is almost impossible to control and manipulate the labeling process for the poisoning data samples for the adversary, since most of training samples normally are labeled with multiple independent anti-virus engines by security companies and further used to trained the malware detection models. Therefore, considering the practicality of the attack scenario in the wild, both following [119] and [122] belong to the clean-label poisoning attack [120], in which the adversary can control manipulate the poison instance itself, but cannot control the labeling of the poison instance.…”

“…Shapira et al [122] argue that the attack assumption of feature-space manipulations in [119] is unrealistic and unreasonable for real-world malware classifiers. In pursuit of a poisoning attack in a problem space, Shapira et al propose a novel instance poisoning attack by first selecting the goodware that are most similar to the target malware instance and then adding sections to the goodware for adversarially training the poisoned model.…”

A map-based model-driven testing framework for automated driving systems

“…• User-installed Malwares Some AVs allow passengers to install user applications into the onboard entertainment system. When malware [88][89][90][91] is accidentally installed, it may obtain privileged permission and a certain level of control over the vehicle.…”