Overview
Malware detectors that rely on machine learning are susceptible to adversarial manipulation due to their dependence on static features. A framework utilizing a Conditional Variational Autoencoder (CVAE) has been developed to investigate whether malware can be intentionally misclassified as a specific benign software category. This method involves the addition of Win32 API imports characteristic of a chosen benign category, without removing existing imports or retraining the detector, thereby preserving malware functionality.
Research Context
Machine learning-based malware detectors are commonly deployed in antivirus and endpoint detection systems. These systems often analyze static features, making them potentially vulnerable to adversarial attacks. The research addresses a specific vulnerability: whether malware can not only evade detection as 'malware' but also be actively misclassified into a benign category, using targeted modifications.
Approach
The research proposes a framework centered on a Conditional Variational Autoencoder (CVAE). The CVAE's decoder is designed to be strictly additive, allowing it to introduce new API calls without removing existing ones. This design choice aims to preserve the original functionality of the malware during the evasion process. For each malware sample, the framework automatically identifies the benign category it most closely resembles, designating this as the evasion target.
A knowledge-distilled differentiable proxy was employed to enable gradient-based training. This proxy facilitated training against a non-differentiable ensemble detector. The experimental setup utilized a six-class dataset comprising binary Win32 API import vectors. This dataset was extracted from 3,799 Windows executables, consisting of five distinct benign software categories and one malware class.
Findings
- Against a detector that initially achieved an 87.5% malware recall, adding just 20 API imports reduced the malware recall to 30%.
- At an injection size of k=20 API imports, 99% of the samples that successfully evaded detection were classified as their intended target benign category.
- The CVAE-based framework demonstrated superior performance compared to both a frequency-based baseline and a random selection method across all tested injection sizes, specifically k = 5 to 50.
- Validation performed on real PE files submitted to VirusTotal indicated that the attack was transferable to commercial static detection engines. This transfer resulted in an average reduction of 54.5% in the number of flagging engines.
Why This Matters
These findings expose a concrete vulnerability within API-based malware classifiers. The research demonstrates the achievability of targeted evasion into a chosen benign category via minimal, functionality-preserving modifications to malware samples. This highlights a potential avenue for adversaries to circumvent existing static detection mechanisms.