在恶意软件检测系统中评估对抗防御的鲁棒性
Evaluating the robustness of adversarial defenses in malware detection systems
AI总结：
本文提出sigma-二进制攻击方法，揭示现有恶意软件检测防御的脆弱性，提升对抗防御的鲁棒性。
摘要：
机器学习是Android恶意软件检测的关键工具，能够有效识别应用程序中的恶意模式。然而，基于机器学习的检测器容易受到规避攻击的攻击，其中微小的、人为制造的更改可以绕过检测。尽管在对抗防御方面取得了进展，但在二进制受限领域缺乏全面的评估框架，限制了对其鲁棒性的理解。我们介绍了两个关键贡献。首先，优先级二进制舍入，是一种将连续扰动转换为二进制特征空间的技术，同时保持高攻击成功率和低扰动大小。其次，sigma-二进制攻击，一种新的对抗方法用于二进制领域，旨在通过最小的特征更改实现攻击目标。在Malscan数据集上的实验表明，sigma-二进制攻击优于现有攻击方法，并暴露了现有最先进防御中的关键漏洞。配备对手检测器的防御，如KDE、DLA、DNN+和ICNN，表现出显著的脆弱性，使用少于10个特征修改，攻击成功率超过90%，使用20个特征修改可达到100%。对抗训练的防御，包括AT-rFGSM-k、AT-MaxMA，通过小预算提高了鲁棒性，但仍然容易受到不受限制的扰动攻击，攻击成功率分别为99.45%和96.62%。虽然PAD-SMA在对抗最先进梯度对抗攻击方面表现出强大的鲁棒性，通过保持攻击成功率低于16.55%，但sigma-二进制攻击显著优于这些方法，在不受限制的扰动下实现94.56%的成功率。这些发现突显了需要精确的方法如sigma-二进制来暴露现有防御中的隐藏漏洞，并支持开发更稳健的恶意软件检测系统的重要性。
英文摘要：
Machine learning is a key tool for Android malware detection, effectively identifying malicious patterns in apps. However, ML-based detectors are vulnerable to evasion attacks, where small, crafted changes bypass detection. Despite progress in adversarial defenses, the lack of comprehensive evaluation frameworks in binary-constrained domains limits understanding of their robustness. We introduce two key contributions. First, Prioritized Binary Rounding, a technique to convert continuous perturbations into binary feature spaces while preserving high attack success and low perturbation size. Second, the sigma-binary attack, a novel adversarial method for binary domains, designed to achieve attack goals with minimal feature changes. Experiments on the Malscan dataset show that sigma-binary outperforms existing attacks and exposes key vulnerabilities in state-of-the-art defenses. Defenses equipped with adversary detectors, such as KDE, DLA, DNN+, and ICNN, exhibit significant brittleness, with attack success rates exceeding 90% using fewer than 10 feature modifications and reaching 100% with just 20. Adversarially trained defenses, including AT-rFGSM-k, AT-MaxMA, improves robustness under small budgets but remains vulnerable to unrestricted perturbations, with attack success rates of 99.45% and 96.62%, respectively. Although PAD-SMA demonstrates strong robustness against state-of-the-art gradient-based adversarial attacks by maintaining an attack success rate below 16.55%, the sigma-binary attack significantly outperforms these methods, achieving a 94.56% success rate under unrestricted perturbations. These findings highlight the critical need for precise method like sigma-binary to expose hidden vulnerabilities in existing defenses and support the development of more resilient malware detection systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
