论文标题
对抗性深层合奏：逃避攻击和恶意软件检测的防御措施
Adversarial Deep Ensemble: Evasion Attacks and Defenses for Malware Detection
论文作者
论文摘要
恶意软件仍然对网络安全构成巨大威胁，要求基于机器学习的恶意软件检测。虽然有希望，但已知这些探测器容易受到逃避攻击的影响。合奏学习通常会促进对策，而攻击者也可以利用这一技术来提高攻击效率。这激发了我们调查合奏攻击可以实现的合奏防御或有效性的鲁棒性，尤其是当他们相互作战时。因此，我们提出了一种新的攻击方法，称为攻击的混合物，通过渲染能够使用多种生成方法和多种操纵集的攻击者来扰动恶意软件示例而不会破坏其恶意功能。这自然会导致对抗训练的新实例化，这进一步旨在增强深度神经网络的合奏。我们使用Android恶意软件探测器评估防御措施，以针对两个实际数据集进行26次不同的攻击。实验结果表明，新的对抗训练可显着增强深神经网络对广泛攻击的鲁棒性，当基本分类器足够强大时，合奏方法促进了鲁棒性，但是合奏攻击可以有效地逃避增强的恶意软件探测器，甚至可以显着降低病毒性服务。
Malware remains a big threat to cyber security, calling for machine learning based malware detection. While promising, such detectors are known to be vulnerable to evasion attacks. Ensemble learning typically facilitates countermeasures, while attackers can leverage this technique to improve attack effectiveness as well. This motivates us to investigate which kind of robustness the ensemble defense or effectiveness the ensemble attack can achieve, particularly when they combat with each other. We thus propose a new attack approach, named mixture of attacks, by rendering attackers capable of multiple generative methods and multiple manipulation sets, to perturb a malware example without ruining its malicious functionality. This naturally leads to a new instantiation of adversarial training, which is further geared to enhancing the ensemble of deep neural networks. We evaluate defenses using Android malware detectors against 26 different attacks upon two practical datasets. Experimental results show that the new adversarial training significantly enhances the robustness of deep neural networks against a wide range of attacks, ensemble methods promote the robustness when base classifiers are robust enough, and yet ensemble attacks can evade the enhanced malware detectors effectively, even notably downgrading the VirusTotal service.
