Applying diffusion models in adversarial purification and adversarial sample generation in cybersecurity
Methods and systems for applying a diffusion model to adversarial purification and generating adversarial samples in malware detection are disclosed. According to an example, a malware file is inputted to a diffusion model to obtain an adversarial sample by altering content of the malware file. The adversarial sample is further tested by a malware detector. In some examples, the content of an input file may be encoded prior to be processed by the diffusion model. If the malware detector can identify the adversarial sample as a malware file, the diffusion model is updated to further alter the content until the adversarial sample successfully deceives the malware detector. According to another example, an executable file is purified using a diffusion model prior to be inputted to a malware detector. The diffusion model may remove potential malware content from the executable file, thus improving the performance of the malware detector.
1 . A computer-implemented method comprising:
receiving an executable file from a network;
obtaining content from the executable file;
generating, based at least in part on the content and using a first machine learning model, a variant of the executable file including an altered content; and
determining, based at least in part on inputting the variant of the executable file to a second machine learning model, a confidence level that the executable file is associated with a malware; and
in response to the confidence level, performing a dispositive operation with respect to the executable file.
2 . The computer-implemented method of claim 1 ,
wherein the dispositive operation includes at least one of:
quarantining a computing device that originates the executable file,
operating an anti-malware software to inspect files stored on the computing device, or
deleting one or more files containing the malware from the computing device.
3 . The computer-implemented method of claim 1 , wherein the second machine learning model includes a classifier trained to classify an input to a category of malware.
4 . The computer-implemented method of claim 1 , wherein
the first machine learning model includes a diffusion model, and the computer-implemented method further comprises:
operating the diffusion model to perform a reverse process to remove one or more items from the content to obtain the altered content.
5 . The computer-implemented method of claim 4 , wherein the content includes programming codes and the one or more items include at least one of an annotation, a parameter, a function, or a command of the programming codes.
6 . The computer-implemented method of claim 5 , further comprising:
representing the content of the executable file as a first set of data in a first feature space;
encoding the first set of data to a second set of data in a second feature space, wherein a dimension of the second feature space is lower than a dimension of the first feature space;
inputting the second set of data to the diffusion model; and
operating the diffusion model to generate the altered content of the executable file based at least in part on the second set of data.
7 . The computer-implemented method of claim 6 , further comprising:
decoding the altered content to a third set of data in the first feature space;
inputting the third set of data to the second machine learning model; and
operating the second machine learning model to generate the confidence level that the executable file is associated with the malware based at least in part on the third set of data.
8 . A computer-implemented method comprising:
obtaining an executable file from a network, the executable file being associated with a malware;
retrieving content from the executable file;
generating, based at least in part on the content and using a diffusion model, a variant of the executable file including an altered content;
determining, based at least in part on inputting the variant of the executable file to a malware detecting model, a confidence level that the variant of the executable file is associated with the malware;
in response to the confidence level is less than a threshold, generating an adversarial sample of the executable file based at least in part on the altered content, and saving the adversarial sample in a datastore connected to the network; and
in response to the confidence level is equal to or greater than the threshold, iteratively performing actions, including updating the diffusion model according to the confidence level, until the confidence level is less than the threshold.
9 . The computer-implemented method of claim 8 ,
wherein the actions further include:
generating, using the updated diffusion model, a second variant of the executable file including a second altered content, and
re-generating, using the malware detecting model, the confidence level based at least in part on the second variant of the executable file.
10 . The computer-implemented method of claim 8 , further comprising:
operating the diffusion model to perform a forward process and a reverse process to generate the variant of the executable file without breaking functionality of the executable file.
11 . The computer-implemented method of claim 10 , wherein
the forward process is configured to add one or more first items to the content of the executable file, and
the reverse process is configured to delete one or more second items from the content of the executable file.
12 . The computer-implemented method of claim 11 , wherein the content includes programming codes and the one or more first items or the one or more second items include at least one of an annotation, a parameter, a function, or a command of the programming codes.
13 . The computer-implemented method of claim 8 , further comprising:
including the adversarial sample to a training data set; and
training the malware detecting model using the training data set.
14 . A system comprising:
a processor,
a network interface, and
a memory storing instructions executed by the processor to perform actions including:
receiving an executable file from a network;
obtaining content from the executable file;
generating, based at least in part on the content and using a first machine learning model, a variant of the executable file including an altered content; and
determining, based at least in part on inputting the variant of the executable file to a second machine learning model, a confidence level that the executable file is associated with a malware; and
in response to the confidence level, performing a dispositive operation with respect to the executable file.
15 . The system of claim 14 , wherein the
dispositive operation includes at least one of:
quarantining a computing device that originates the file,
operating an anti-malware software to inspect files stored on the computing device, or
deleting one or more files containing the malware from the computing device.
16 . The system of claim 14 , wherein the second machine learning model includes a classifier trained to classify an input to a category of malware.
17 . The system of claim 14 , wherein the first machine learning model includes a diffusion model, and the computer-implemented method further comprises:
operating the diffusion model to perform a reverse process to remove one or more items from the content to obtain the altered content.
18 . The system of claim 17 , wherein the content includes programming codes and the one or more items include an annotation, a parameter, a function, or a command of the programming codes.
19 . The system of claim 18 , wherein the actions further comprise:
representing the content of the executable file as a first set of data in a first feature space;
encoding the first set of data to a second set of data in a second feature space, wherein a dimension of the second feature space is lower than a dimension of the first feature space;
inputting the second set of data to the diffusion model; and
operating the diffusion model to generate the altered content of the executable file based at least in part on the second set of data.
20 . The system of claim 19 , wherein the actions further comprise:
decoding the altered content to a third set of data in the first feature space;
inputting the third set of data to the second machine learning model; and
operating the second machine learning model to generate the confidence level that the executable file is associated with the malware based at least in part on the third set of data.