Search papers, labs, and topics across Lattice.
This paper investigates the adversarial robustness of drift-adaptive malware detectors, specifically focusing on AdvDA, which uses adversarial domain adaptation. They find that undefended AdvDA is highly vulnerable to PGD attacks and moderately vulnerable to MalGuise attacks due to distribution shift between source and target domains. To mitigate this, they propose a universal robustification framework that fine-tunes AdvDA on adversarially transformed inputs, demonstrating that source adversarial training is crucial for PGD defense but detrimental for MalGuise defense.
Adversarially training your drift-adaptive malware detector on the wrong data (source vs. target) can actually *increase* its vulnerability to certain attacks, revealing a surprising interaction between domain adaptation and adversarial robustness.
Concept drift and adversarial evasion are two major challenges for deploying machine learning-based malware detectors. While both have been studied separately, their combination, the adversarial robustness of drift-adaptive detectors, remains unexplored. We address this problem with AdvDA, a recent malware detector that uses adversarial domain adaptation to align a labeled source domain with a target domain with limited labels. The distribution shift between domains poses a unique challenge: robustness learned on the source may not transfer to the target, and existing defenses assume a fixed distribution. To address this, we propose a universal robustification framework that fine-tunes a pretrained AdvDA model on adversarially transformed inputs, agnostic to the attack type and choice of transformations. We instantiate it with five defense variants spanning two threat models: white-box PGD attacks in the feature space and black-box MalGuise attacks that modify malware binaries via functionality-preserving control-flow mutations. Across nine defense configurations, five monthly adaptation windows on Windows malware, and three false-positive-rate operating points, we find the undefended AdvDA completely vulnerable to PGD (100% attack success) and moderately to MalGuise (13%). Our framework reduces these rates to as low as 3.2% and 5.1%, respectively, but the optimal strategy differs: source adversarial training is essential for PGD defenses yet counterproductive for MalGuise defenses, where target-only training suffices. Furthermore, robustness does not transfer across these two threat models. We provide deployment recommendations that balance robustness, detection accuracy, and computational cost.
