Research On Malware Adversarial Examples Based On GAN

The popularization of the Internet and smart phones has brought great convenience to people's lives and access to information.However,the threat of malware has been increasing year by year,which greatly increases the probability of the public being attacked by malware without perceiving them.In recent years,researchers at home and abroad have applied machine learning to the malware detection.They can use classifiers to detect malware,intelligently identify attack characteristics,and discover potential security threats to the system.But research shows that machine learning based malware detectors are extremely vulnerable to adversarial attacks.The attacker constructs an adversarial example by changing the behavior pattern and the application programming interface of the malware to implement an adversarial attack on the malware detection algorithm,which enables the target model to give the expected output.This thesis conducts research on malware adversarial examples,explores the application of adversarial examples generated by Generative Adversarial Network(GAN)in the field of malware,and studies the role of these adversarial examples in the malware detection model from two aspects: adversarial attack and defense.The main works of this thesis are as follows:(1)We propose a GAN-based malware adversarial example generation method.Based on Least Squares Generative Adversarial Networks(LSGAN)and Deep Convolutional Generative Adversarial Networks(DCGAN),the method builds the adversarial attack model Mal-LSGAN to generate adversarial examples that can bypass malware detectors based on machine learning.This model can solve the problems of instability of original GAN training and low quality of generated examples.Experimental results showed that for malware detection models based on API calls sequences,the adversarial examples generated by the Mal-LSGAN model could successfully bypass the malware detector,the accuracy of its MLP classifier was reduced from 97.97% to 0.98%,and it had good transfer ability to classifiers such as RF,LR,DT,SVM,Ada Boost,etc..(2)We design a hierarchical malware adversarial defense system.Under the GAN-based adversarial attack network,this thesis builds a hierarchical malware adversarial defense system.This defense system consists of an adversarial example detector and a malware detector,and conducts adversarial defense training on the system by deploying a joint training network based on LSGAN.The example to be detected passes through two detectors in turn,and the adversarial example detector can distinguish whether the example is an adversarial example or an original example.The malware detector conducts adversarial training under the joint training network based on LSGAN,which makes the malware detector more robust.Experiments showed that the hierarchical malware adversarial defense system had good performance on malware detection tasks,and had a certain defense capability under the GAN-based confrontation attack network.It can capture more than 65% of the adversarial examples generated by the attack network,which also effectively improved the robustness of the system.