Explaining Vulnerabilities of Deep Learning to Adversarial Malware Binaries

Recent work has shown that deep-learning algorithms for malware detection are\nalso susceptible to adversarial examples, i.e., carefully-crafted perturbations\nto input malware that enable misleading classification. Although this has\nquestioned their suitability for this task, it is not yet clear why such\nalgorithms are easily fooled also in this particular application domain. In\nthis work, we take a first step to tackle this issue by leveraging explainable\nmachine-learning algorithms developed to interpret the black-box decisions of\ndeep neural networks. In particular, we use an explainable technique known as\nfeature attribution to identify the most influential input features\ncontributing to each decision, and adapt it to provide meaningful explanations\nto the classification of malware binaries. In this case, we find that a\nrecently-proposed convolutional neural network does not learn any meaningful\ncharacteristic for malware detection from the data and text sections of\nexecutable files, but rather tends to learn to discriminate between benign and\nmalware samples based on the characteristics found in the file header. Based on\nthis finding, we propose a novel attack algorithm that generates adversarial\nmalware binaries by only changing few tens of bytes in the file header. With\nrespect to the other state-of-the-art attack algorithms, our attack does not\nrequire injecting any padding bytes at the end of the file, and it is much more\nefficient, as it requires manipulating much fewer bytes.\n