一句话：提出 MalwareTotal，通过多层面、序列感知的二进制操纵，在不改变功能下绕过多种静态恶意软件检测。
针对基于机器学习的静态恶意软件检测易受对抗攻击、但生成变体难以泛化到多检测方法的生产级反恶意软件的问题，MalwareTotal 提出多层面、序列感知的绕过策略：给定恶意二进制，通过一系列操纵在不改变功能的前提下隐蔽恶意行为，绕过 ML、签名及混合检测器。在 12 组真实恶意软件实验中，对 EMBER 和 MalConv 的攻击成功率达 98.67% 和 100%，对 ClamAV、AMS A、AMS B 达 95.33%、92.63% 和 98.52%；在成功率与查询开销上优于现有方法，并可迁移至 VirusTotal。对抗训练等常见防御效果有限，但重训练可使模型对生成样本准确率提升 88.51 个百分点。
Recent methods have demonstrated that machine learning (ML) based static malware detection models are vulnerable to adversarial attacks. However, the generated malware often fails to generalize to production-level anti-malware software (AMS), as they usually involve multiple detection methods. This calls for universal solutions to the problem of malware variants generation. In this work, we demonstrate how the proposed method, MalwareTotal, has allowed malware variants to continue to abound in ML-based, signature-based, and hybrid anti-malware software. Given a malicious binary, we develop sequential bypass tactics that enable malicious behavior to be concealed within multi-faceted manipulations. Through 12 experiments on real-world malware, we demonstrate that an attacker can consistently bypass detection (98.67%, and 100% attack success rate against ML-based methods EMBER and MalConv, respectively; 95.33%, 92.63%, and 98.52% attack success rate against production-level anti-malware software ClamAV, AMS A, and AMS B, respectively) without modifying the malware functionality. We further demonstrate that our approach outperforms state-of-the-art adversarial malware generation techniques both in attack success rate and query consumption (the number of queries to the target model). Moreover, the samples generated by our method have demonstrated transferability in the real-world integrated malware detector, VirusTotal. In addition, we show that common mitigation such as adversarial training on known attacks cannot effectively defend against the proposed attack. Finally, we investigate the value of the generated adversarial examples as a means of hardening victim models through an adversarial training procedure, and demonstrate that the accuracy of the retrained model against generated adversarial examples increases by 88.51 percentage points.
@inproceedings{paperbot11363,
title = {MalwareTotal: Multi-Faceted and Sequence-Aware Bypass Tactics against Static Malware Detection},
author = {Shuai He and Cai Fu and Hong Hu and Jiahe Chen and Jianqiang Lv and Shuai Jiang},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639141}
}