论文标题
深度学习中的功能级恶意软件混淆
Feature-level Malware Obfuscation in Deep Learning
论文作者
论文摘要
我们考虑使用深度学习模型来检测恶意软件的问题，其中恶意软件可以与大量的良性代码结合使用。其中的例子包括在系统上藏在系统上的背包和特洛伊木马攻击，其中恶意行为被隐藏在有用的应用中。这种增强恶意软件的灵活性可以显着增加代码混淆。因此，我们专注于使用静态功能，尤其是意图，权限和API调用，我们认为这不能最终隐藏在Android系统中，但只能增强更多此类功能。我们首先使用良性和恶意软件样本的功能训练深层神经网络分类器进行恶意软件分类。然后，我们仅通过将良性应用程序的功能随机添加到恶意软件中，证明了假负率的急剧增加（即攻击成功）。最后，我们测试了数据增强的使用，以使分类器与此类攻击相比。我们发现，对于API呼叫，可以拒绝使用意图或权限不太成功的绝大多数攻击。
We consider the problem of detecting malware with deep learning models, where the malware may be combined with significant amounts of benign code. Examples of this include piggybacking and trojan horse attacks on a system, where malicious behavior is hidden within a useful application. Such added flexibility in augmenting the malware enables significantly more code obfuscation. Hence we focus on the use of static features, particularly Intents, Permissions, and API calls, which we presume cannot be ultimately hidden from the Android system, but only augmented with yet more such features. We first train a deep neural network classifier for malware classification using features of benign and malware samples. Then we demonstrate a steep increase in false negative rate (i.e., attacks succeed), simply by randomly adding features of a benign app to malware. Finally we test the use of data augmentation to harden the classifier against such attacks. We find that for API calls, it is possible to reject the vast majority of attacks, where using Intents or Permissions is less successful.
