Research Article
Are Malware Detection Classifiers Adversarially Vulnerable to Actor-Critic based Evasion Attacks?
@ARTICLE{10.4108/eai.31-5-2022.174087, author={Hemant Rathore and Sujay C Sharma and Sanjay K. Sahay and Mohit Sewak}, title={Are Malware Detection Classifiers Adversarially Vulnerable to Actor-Critic based Evasion Attacks?}, journal={EAI Endorsed Transactions on Scalable Information Systems}, volume={10}, number={1}, publisher={EAI}, journal_a={SIS}, year={2022}, month={5}, keywords={Adversarial Robustness, Android, Deep Neural Network, Malware Analysis and Detection, Machine Learning}, doi={10.4108/eai.31-5-2022.174087} }- Hemant Rathore
Sujay C Sharma
Sanjay K. Sahay
Mohit Sewak
Year: 2022
Are Malware Detection Classifiers Adversarially Vulnerable to Actor-Critic based Evasion Attacks?
SIS
EAI
DOI: 10.4108/eai.31-5-2022.174087
Abstract
Android devices like smartphones and tablets have become immensely popular and are an integral part of our daily lives. However, it has also attracted malware developers to design android malware which have grown aggressively in the last few years. Research shows that machine learning, ensemble, and deep learning models can successfully be used to detect android malware. However, the robustness of these models against well-crafted adversarial samples is not well investigated. Therefore, we first stepped into the adversaries’ shoes and proposed the ACE attack that adds limited perturbations in malicious applications such that they are forcefully misclassified as benign and remain undetected by different malware detection models. The ACE agent is designed based on an actor-critic architecture that uses reinforcement learning to add perturbations (maximum ten) while maintaining the structural and functional integrity of the adversarial malicious applications. The proposed attack is validated against twenty-two different malware detection models based on two feature sets and eleven different classification algorithms. The ACE attack accomplished an average fooling rate (with maximum of ten perturbations) of 46.63% across eleven permission based malware detection models and 95.31% across eleven intent based detection models. The attack forced a massive number of misclassifications that led to an average accuracy drop of 18.07% and 36.62% in the above permission and intent based malware detection models. Later we also design a defense mechanism using the adversarial retraining strategy, which uses adversarial malware samples with correct class labels to retrain the models. The defense mechanism improves the average accuracy by 24.88% and 76.51% for the eleven permission and eleven intent based malware detection models. In conclusion, we found that malware detection models based on machine learning, ensemble, and deep learning perform poorly against adversarial samples. Thus malware detection models should be investigated for vulnerabilities and mitigated to enhance their overall forensic knowledge and adversarial robustness.
Copyright © 2022 Hemant Rathore et al., licensed to EAI. This is an open access article distributed under the terms of the Creative Commons Attribution license, which permits unlimited use, distribution and reproduction in any medium so long as the original work is properly cited.
