Methods and apparatus to detect adversarial malware
Methods and apparatus to detect adversarial malware are disclosed. An example adversarial malware detector includes a machine learning engine to classify a first feature representation representing features of a program as benign or malware, a feature perturber to, when the first feature representation is classified as benign, remove a first one of the features to form a second feature representation, and a decider to classify the program as adversarial malware when the machine learning engine classifies the second feature representation as malware.
1. An apparatus comprising:
a non-transitory computer readable medium comprising instructions; and
at least one processor to execute the instructions to at least:
classify, using a machine learning engine, a first feature representation representing features of a program as benign or malware, the program to include at least three features;
utilize a plurality of attack methodologies in parallel to select features for removal;
when the first feature representation is classified as benign, remove a first one of the selected features to form a second feature representation; and
classify the program as adversarial malware when the machine learning engine classifies the second feature representation as malware.
2. The apparatus of claim 1 , wherein the processor is to execute the instructions to:
when the second feature representation is classified as benign, remove a second one of the selected features to form a third feature representation;
when the machine learning engine classifies the third feature representation as malware, classify the program as adversarial malware; and
when the machine learning engine classifies the third feature representation as benign, classify the program as benign.
3. The apparatus of claim 1 including to identify the first one of the selected features by determining a gradient associated with the first one of the features.
4. The apparatus of claim 3 wherein the processor is to execute the instructions to determine the gradient using a Jacobian Matrix.
5. The apparatus of claim 1 wherein the processor is to execute the instructions to identify the first one of the features using a Jacobian-based saliency map approach.
6. The apparatus of claim 1 , wherein the processor is to execute the instructions to identify the features of the program.
7. The apparatus of claim 6 , further including a sandbox to execute the program.
8. The apparatus of claim 1 , wherein the first feature representation is a feature vector, wherein an entry of the feature vector has a first value when the first one of the features is present, and has a second value when the first one of the features is not present.
9. The apparatus of claim 8 , wherein the processor is to execute the instructions to modify the first feature representation to remove the first one of the selected features by changing an entry of the feature vector corresponding to the first one of the selected features from the first value to the second value.
10. A method for detecting malware, comprising
loading a program into memory;
executing the program in a sandbox, the program including at least three features;
utilizing a plurality of attack methodologies in parallel to select features for removal;
classifying, using a machine learning engine, the program as benign or malware based on a first set of features of the program identified in the sandbox;
when the program is classified as benign, removing a first selected feature to identify a second set of features representing a first modification of the program; and
classifying the program as adversarial malware when the second set of features is classified as malware.
11. The method of claim 10 , further including, when the second feature representation is classified as benign:
removing a second selected feature to identify a third set of features representing a second modification of the program;
classifying the program as adversarial malware when the machine learning engine classifies the third feature representation as malware; and
classifying the program as benign when the machine learning engine classifies the third feature representation as benign.
12. The method of claim 10 , further including identifying the first modification of the program by determining a gradient associated with the first one of the features.
13. The method of claim 10 , further including identifying the first modification using a Jacobian-based saliency map approach.
14. The method of claim 10 , further including identifying the first set of features by observing the program execute in the sandbox.
15. The method of claim 10 , further including:
forming a feature vector having entries for a universe of features;
setting a first one of the entries to have a first value when a corresponding one of the first set of features is present;
setting the first one of the entries to have a second value when the corresponding one of the first set of the features is not present; and
inputting the feature vector to a machine learning engine to classify the program.
16. A non-transitory computer-readable storage medium comprising instructions for detecting adversarial malware that, when executed, cause a processor to at least:
load a program into memory, the program to include at least three features;
execute the program in a sandbox;
utilize a plurality of attack methodologies in parallel to select features for removal;
classify, using a machine learning engine, the program as benign or malware based on a first set of features of the program identified in the sandbox;
when the program is classified as benign, remove a first selected feature to identify a second set of features representing a first modification of the program; and
classify the program as adversarial malware when the second set of features is classified as malware.
17. The non-transitory computer-readable storage medium of claim 16 , wherein the instructions, when executed, cause the processor to, when the second feature representation is classified as benign:
remove a second selected feature to identify a third set of features representing a second modification of the program;
classify the program as adversarial malware when the machine learning engine classifies the third feature representation as malware; and
classify the program as benign when the machine learning engine classifies the third feature representation as benign.
18. The non-transitory computer-readable storage medium of claim 16 , wherein the instructions, when executed, cause the processor to identify the first modification of the program by determining a gradient associated with the first one of the features.
19. The non-transitory computer-readable storage medium of claim 16 , wherein the instructions, when executed, cause the processor to identify the first modification using a Jacobian-based saliency map approach.
20. The non-transitory computer-readable storage medium of claim 16 , wherein the instructions, when executed, cause the processor to identify the first set of features by observing the program execute in the sandbox.