Optimization of code caves in malware binaries to evade machine learning detectors
This research was supported by the Ministerio de Ciencia, Innovación y Universidades (Grant Refs. PGC2018-095322-B-C22 and PID2019-111429RB-C21), by the Region of Madrid grant CYNAMON-CM (P2018/TCS-4566), co-financed by European Structural Funds ESF and FEDER, and the Excellence Program EPUC3M17. Th...
| Authors: | ; ; |
|---|---|
| Format: | Article |
| Publication date: | 2022 |
| Country: | España |
| Institution: | Universidad Rey Juan Carlos |
| Repository: | BURJC-Digital. Repositorio Institucional de la Universidad Rey Juan Carlos |
| OAI Identifier: | oai:burjcdigital.urjc.es:10115/24407 |
| Online Access: | https://hdl.handle.net/10115/24407 |
| Access Level: | Open access |
| Keyword: | Malware Evasion Machine learning Adversarial example Genetic algorithm |
| _version_ | 1878737269225947136 |
|---|---|
| author | Yuste, Javier |
| author2 | García Pardo, Eduardo Tapiador, Juan |
| author2_role | author author |
| author_browse | García Pardo, Eduardo Tapiador, Juan Yuste, Javier |
| author_facet | Yuste, Javier García Pardo, Eduardo Tapiador, Juan |
| author_role | author |
| collection | BURJC-Digital. Repositorio Institucional de la Universidad Rey Juan Carlos |
| description | This research was supported by the Ministerio de Ciencia, Innovación y Universidades (Grant Refs. PGC2018-095322-B-C22 and PID2019-111429RB-C21), by the Region of Madrid grant CYNAMON-CM (P2018/TCS-4566), co-financed by European Structural Funds ESF and FEDER, and the Excellence Program EPUC3M17. The opinions, findings, conclusions, or recommendations expressed are those of the authors and do not necessarily reflect those of any of the funders. |
| eu_rights_str_mv | openAccess |
| format | article |
| id | ES_9d3a70a1a0cbcfcc32e567c1938f3edf |
| institution | Universidad Rey Juan Carlos |
| instname_str | Universidad Rey Juan Carlos |
| network_acronym_str | ES |
| network_name_str | España |
| oai_identifier_str | oai:burjcdigital.urjc.es:10115/24407 |
| publishDate | 2022 |
| publishDateSort | 2022 |
| publisher | Elsevier |
| publisherStr | Elsevier |
| reponame_str | BURJC-Digital. Repositorio Institucional de la Universidad Rey Juan Carlos |
| spelling | Optimization of code caves in malware binaries to evade machine learning detectors Yuste, Javier García Pardo, Eduardo Tapiador, Juan Malware Evasion Machine learning Adversarial example Genetic algorithm This research was supported by the Ministerio de Ciencia, Innovación y Universidades (Grant Refs. PGC2018-095322-B-C22 and PID2019-111429RB-C21), by the Region of Madrid grant CYNAMON-CM (P2018/TCS-4566), co-financed by European Structural Funds ESF and FEDER, and the Excellence Program EPUC3M17. The opinions, findings, conclusions, or recommendations expressed are those of the authors and do not necessarily reflect those of any of the funders. Machine Learning (ML) techniques, especially Artificial Neural Networks, have been widely adopted as a tool for malware detection due to their high accuracy when classifying programs as benign or malicious. However, these techniques are vulnerable to Adversarial Examples (AEs), i.e., carefully crafted samples designed by an attacker to be misclassified by the target model. In this work, we propose a general method to produce AEs from existing malware, which is useful to increase the robustness of ML-based models. Our method dynamically introduces unused blocks (caves) in malware binaries, preserving their original functionality. Then, by using optimization techniques based on Genetic Algorithms, we determine the most adequate content to place in such code caves to achieve misclassification. We evaluate our model in a black-box setting with a well-known state-of-the-art architecture (MalConv), resulting in a successful evasion rate of 97.99 % from the 2k tested malware samples. Additionally, we successfully test the transferability of our proposal to commercial AV engines available at VirusTotal, showing a reduction in the detection rate for the crafted AEs. Finally, the obtained AEs are used to retrain the ML-based malware detector previously evaluated, showing an improve on its robustness. Elsevier https://hdl.handle.net/10115/24407 |
| spellingShingle | Optimization of code caves in malware binaries to evade machine learning detectors Yuste, Javier Malware Evasion Machine learning Adversarial example Genetic algorithm |
| title | Optimization of code caves in malware binaries to evade machine learning detectors |
| title_full | Optimization of code caves in malware binaries to evade machine learning detectors |
| title_fullStr | Optimization of code caves in malware binaries to evade machine learning detectors |
| title_full_unstemmed | Optimization of code caves in malware binaries to evade machine learning detectors |
| title_short | Optimization of code caves in malware binaries to evade machine learning detectors |
| title_sort | Optimization of code caves in malware binaries to evade machine learning detectors |
| topic | Malware Evasion Machine learning Adversarial example Genetic algorithm |
| topic_facet | Malware Evasion Machine learning Adversarial example Genetic algorithm |
| url | https://hdl.handle.net/10115/24407 |