ML models are known to be vulnerable to adversarial query attacks. In these attacks, queries are iteratively perturbed towards a particular class without any knowledge of the target model besides its output. The prevalence of remotely-hosted ML classification models and Machine-Learning-as-a-Service platforms means that query attacks pose a real threat to the security of these systems. To deal with this, stateful defenses have been proposed to detect query attacks and prevent the generation of adversarial examples by monitoring and analyzing the sequence of queries received by the system. Several stateful defenses have been proposed in recent years. However, these defenses rely solely on similarity or out-of-distribution detection methods that may be effective in other domains. In the malware detection domain, the methods to generate adversarial examples are inherently different, and therefore we find that such detection mechanisms are significantly less effective. Hence, in this paper, we present MalProtect, which is a stateful defense against query attacks in the malware detection domain. MalProtect uses several threat indicators to detect attacks. Our results show that it reduces the evasion rate of adversarial query attacks by 80+\% in Android and Windows malware, across a range of attacker scenarios. In the first evaluation of its kind, we show that MalProtect outperforms prior stateful defenses, especially under the peak adversarial threat.

翻译：机器学习模型已知易受对抗性查询攻击影响。在此类攻击中，查询会针对特定类别进行迭代扰动，攻击者无需了解目标模型除输出外的任何信息。远程托管的机器学习分类模型及机器学习即服务平台（ML-as-a-Service）的普及，意味着查询攻击对这些系统的安全性构成实际威胁。为应对此问题，研究者提出了基于状态（stateful）的防御方法，通过监控和分析系统接收的查询序列来检测查询攻击并阻止对抗性样本的生成。近年来已提出多种状态防御方案，但这些方案仅依赖相似性或分布外检测方法，而这些方法在其他领域可能行之有效。在恶意软件检测领域，生成对抗性样本的方法本质上存在差异，因此我们发现此类检测机制效果显著降低。为此，本文提出MalProtect——一种针对恶意软件检测领域查询攻击的状态防御方法。MalProtect利用多项威胁指标检测攻击。实验结果表明，在Android和Windows恶意软件场景中，面对多种攻击者设定，该方法可将对抗性查询攻击的逃逸率降低80%以上。在同类首次评估中，我们展示了MalProtect优于以往的状态防御方案，尤其在对抗性威胁峰值条件下表现突出。