Malware detection has long been a stage for an ongoing arms race between malware authors and anti-virus systems. Solutions that utilize machine learning (ML) gain traction as the scale of this arms race increases. This trend, however, makes performing attacks directly on ML an attractive prospect for adversaries. We study this arms race from both perspectives in the context of MalConv, a popular convolutional neural network-based malware classifier that operates on raw bytes of files. First, we show that MalConv is vulnerable to adversarial patch attacks: appending a byte-level patch to malware files bypasses detection 94.3% of the time. Moreover, we develop a universal adversarial patch (UAP) attack where a single patch can drop the detection rate in constant time of any malware file that contains it by 80%. These patches are effective even being relatively small with respect to the original file size -- between 2%-8%. As a countermeasure, we then perform window ablation that allows us to apply de-randomized smoothing, a modern certified defense to patch attacks in vision tasks, to raw files. The resulting `smoothed-MalConv' can detect over 80% of malware that contains the universal patch and provides certified robustness up to 66%, outlining a promising step towards robust malware detection. To our knowledge, we are the first to apply universal adversarial patch attack and certified defense using ablations on byte level in the malware field.

翻译：恶意软件检测长期以来一直是恶意软件作者与反病毒系统之间持续军备竞赛的舞台。随着这场军备竞赛规模的扩大，利用机器学习（ML）的解决方案逐渐受到青睐。然而，这一趋势使得直接攻击ML成为攻击者眼中的诱人目标。我们从攻击与防御两个视角，针对MalConv（一种基于卷积神经网络、直接处理文件原始字节的流行恶意软件分类器）展开研究。首先，我们证明MalConv易受对抗补丁攻击：向恶意软件文件追加字节级补丁后，有94.3%的概率可绕过检测。此外，我们开发了一种通用对抗补丁（UAP）攻击——单个补丁可在常数时间内使包含该补丁的任何恶意软件文件的检测率下降80%。即使补丁大小相对于原始文件仅为2%-8%，此类攻击依然有效。作为应对措施，我们采用窗口消融技术，将视觉任务中针对补丁攻击的现代认证防御方法——去随机化平滑——应用于原始文件。由此得到的“平滑MalConv”可检测超过80%包含通用补丁的恶意软件，并提供最高66%的认证鲁棒性，为迈向鲁棒的恶意软件检测迈出了有前景的一步。据我们所知，我们是首个在恶意软件领域将通用对抗补丁攻击与基于消融的认证防御方法应用于字节级层面的研究。