Malware Makeover: Breaking ML-based Static Analysis by Modifying Executable Bytes

2019-12-19 · Keane Lucas, Mahmood Sharif, Lujo Bauer, Michael K. Reiter, Saurabh Shintre

Motivated by the transformative impact of deep neural networks (DNNs) in various domains, researchers and anti-virus vendors have proposed DNNs for malware detection from raw bytes that do not require manual feature engineering. In this work, we propose an attack that interweaves binary-diversification techniques and optimization frameworks to mislead such DNNs while preserving the functionality of binaries. Unlike prior attacks, ours manipulates instructions that are a functional part of the binary, which makes it particularly challenging to defend against. We evaluated our attack against three DNNs in white- and black-box settings, and found that it often achieved success rates near 100%. Moreover, we found that our attack can fool some commercial anti-viruses, in certain cases with a success rate of 85%. We explored several defenses, both new and old, and identified some that can foil over 80% of our evasion attempts. However, these defenses may still be susceptible to evasion by attacks, and so we advocate for augmenting malware-detection systems with methods that do not rely on machine learning.

📄 PDF Abstract BibTeX arXiv:1912.09064

Code (1)

pwwl/enhanced-binary-diversification 공식 구현

Tasks

Feature Engineering Malware Detection Speech Recognition

Certifiably robust malware detectors by design

2025-08-10 · Pierre-Francois Gimenez, Sarath Sivaprasad, Mario Fritz arxiv

Malware analysis involves analyzing suspicious software to detect malicious payloads. Static malware analysis, which does not require software execution, relies increasingly on machine learning techniques to achieve scal…

Malware Detection

Dynamic Malware Classification of Windows PE Files using CNNs and Greyscale Images Derived from Runtime API Call Argument Conversion

2025-05-30 · Md Shahnawaz, Bishwajit Prasad Gond, Durga Prasad Mohapatra

Malware detection and classification remains a topic of concern for cybersecurity, since it is becoming common for attackers to use advanced obfuscation on their malware to stay undetected. Conventional static analysis i…

Malware Classification Malware Detection

Integration of Static and Dynamic Analysis for Malware Family Classification with Composite Neural Network

2019-12-24 · Yao Saint Yen, Zhe Wei Chen, Ying Ren Guo, Meng Chang Chen

Deep learning has been used in the research of malware analysis. Most classification methods use either static analysis features or dynamic analysis features for malware family classification, and rarely combine them as …

Classification General Classification Malware Analysis Malware Classification

Light up that Droid! On the Effectiveness of Static Analysis Features against App Obfuscation for Android Malware Detection

2023-10-24 · Borja Molina-Coronado, Antonio Ruggia, Usue Mori, Alessio Merlo 외

Malware authors have seen obfuscation as the mean to bypass malware detectors based on static analysis features. For Android, several studies have confirmed that many anti-malware products are easily evaded with simple p…

Android Malware Detection Malware Detection

A Comparison of Static, Dynamic, and Hybrid Analysis for Malware Detection

2022-03-13 · Anusha Damodaran, Fabio Di Troia, Visaggio Aaron Corrado, Thomas H. Austin 외

In this research, we compare malware detection techniques based on static, dynamic, and hybrid analysis. Specifically, we train Hidden Markov Models (HMMs ) on both static and dynamic feature sets and compare the resulti…