Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper investigates adversarial evasion attacks against deep learning-based malware detectors in non-stationary environments, where attackers aim to evade detection while minimizing drift signals that could alert defenders. They propose generating adversarial malware examples in the classifier's feature space, using similarity regularizers to constrain perturbations and maintain distributional similarity with benign malware. Experiments demonstrate that $\ell_2$ regularization effectively reduces drift signals, although a trade-off exists between attack success rate and detectability based on the perturbation budget.
Adversarial attacks can successfully evade malware detection while minimizing drift signals, highlighting a critical vulnerability in current deep learning-based security systems.
Deep learning has emerged as a powerful approach for malware detection, demonstrating impressive accuracy across various data representations. However, these models face critical limitations in real-world, non-stationary environments where both malware characteristics and detection systems continuously evolve. Our research investigates a fundamental security question: Can an attacker generate adversarial malware samples that simultaneously evade classification and remain inconspicuous to drift monitoring mechanisms? We propose a novel approach that generates targeted adversarial examples in the classifier's standardized feature space, augmented with sophisticated similarity regularizers. By carefully constraining perturbations to maintain distributional similarity with clean malware, we create an optimization objective that balances targeted misclassification with drift signal minimization. We quantify the effectiveness of this approach by comprehensively comparing classifier output probabilities using multiple drift metrics. Our experiments demonstrate that similarity constraints can reduce output drift signals, with $\ell_2$ regularization showing the most promising results. We observe that perturbation budget significantly influences the evasion-detectability trade-off, with increased budget leading to higher attack success rates and more substantial drift indicators.