一句话：提出可解释性引导、模型无关的测试框架，用累积恶意量（AMM）定位易操纵特征以评估恶意软件检测器的逃逸鲁棒性。
恶意软件检测器（含商业杀毒引擎）面临对抗性逃逸攻击，攻击者可通过特征空间操纵使恶意样本逃避检测。本文提出一个可解释性引导、模型无关的鲁棒性测试框架，引入累积恶意量（AMM）概念，用于识别哪些恶意软件特征可被操纵以最大化逃逸检测的概率；并利用该框架生成测试用例，系统评估多个最先进检测器的鲁棒性。实验发现：(i) 商业杀毒引擎易受 AMM 引导的测试用例攻击；(ii) 利用一个检测器生成的操纵样本能否逃逸另一个检测器（迁移性），取决于不同检测器间大 AMM 值特征的重叠程度；(iii) AMM 值可有效度量特征脆弱性（即特征空间操纵翻转预测结果的能力），并解释检测器面对逃逸攻击时的鲁棒性差异。这些发现揭示了当前恶意软件检测器的局限及改进方向。
Numerous open-source and commercial malware detectors are available. However, their efficacy is threatened by new adversarial attacks, whereby malware attempts to evade detection, e.g., by performing feature-space manipulation. In this work, we propose an explainability-guided and model-agnostic testing framework for robustness of malware detectors when confronted with adversarial attacks. The framework introduces the concept of Accrued Malicious Magnitude (AMM) to identify which malware features could be manipulated to maximize the likelihood of evading detection. We then use this framework to test several state-of-the-art malware detectors' ability to detect manipulated malware. We find that (i) commercial antivirus engines are vulnerable to AMM-guided test cases; (ii) the ability of a manipulated malware generated using one detector to evade detection by another detector (i.e., transferability) depends on the overlap of features with large AMM values between the different detectors; and (iii) AMM values effectively measure the fragility of features (i.e., capability of feature-space manipulation to flip the prediction results) and explain the robustness of malware detectors facing evasion attacks. Our findings shed light on the limitations of current malware detectors, as well as how they can be improved.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{SunXTDLWZCN23,
title = {Mate! Are You Really Aware? An Explainability-Guided Testing Framework for Robustness of Malware Detectors},
author = {Ruoxi Sun and Minhui Xue and Gareth Tyson and Tian Dong and Shaofeng Li and Shuo Wang and Haojin Zhu and Seyit Camtepe and Surya Nepal},
booktitle = {FSE},
year = {2023},
doi = {10.1145/3611643.3616309}
}