Machine learning-based static malware detectors remain vulnerable to adversarial evasion techniques, such as metamorphic engine mutations. To address this vulnerability, we propose a certifiably robust malware detection framework based on randomized smoothing through feature ablation and targeted noise injection. During evaluation, our system analyzes an executable by generating multiple ablated variants, classifies them by using a smoothed classifier, and identifies the final label based on the majority vote. By analyzing the top-class voting distribution and the Wilson score interval, we derive a formal certificate that guarantees robustness within a specific radius against feature-space perturbations. We evaluate our approach by comparing the performance of the base classifier and the smoothed classifier on both clean executables and ablated variants generated using PyMetaEngine. Our results demonstrate that the proposed smoothed classifier successfully provides certifiable robustness against metamorphic evasion attacks without requiring modifications to the underlying machine learning architecture.

翻译：基于机器学习的静态恶意软件检测器仍然容易受到对抗性逃逸技术（例如变形引擎突变）的影响。为解决这一漏洞，我们提出一种通过特征消融和定向噪声注入实现随机平滑的可证明鲁棒的恶意软件检测框架。在评估过程中，我们的系统通过生成多个消融变体来解析可执行文件，利用平滑分类器对其进行分类，并基于多数投票确定最终标签。通过分析顶级类别投票分布和威尔逊得分区间，我们推导出形式化证书，该证书可在特定半径内保证对特征空间扰动的鲁棒性。我们通过比较基础分类器和平滑分类器在干净可执行文件及使用PyMetaEngine生成的消融变体上的性能来评估本方法。实验结果表明，所提出的平滑分类器成功为对抗变形逃逸攻击提供了可认证的鲁棒性，且无需修改底层机器学习架构。