1 Introduction↩︎

We are amidst a meteoric rise in malware incidents worldwide. Malware is responsible for significant damages, both financial—in billions of dollars [1]—and human costs in loss of life [2]. According to statistics from Kaspersky Lab, at the end of 2020, there were an average of 360,000 pieces of malware detected per day [3]. The battle against such large incidents of malware remains an ongoing challenge and the need for automated and effective malware detection systems is a research imperative.

Advances in Machine Learning (ML) have led to state-of-the-art malware detectors [4]–[8]. But, ML-based models are known to be vulnerable to adversarial examples; here, seemingly benign inputs with small perturbations can successfully evade detectors. Although adversarial examples were shown initially in the computer vision domain [9]–[12], malware is no exception. Recent attacks have crafted adversarial examples in the malware domain—so-called adversarial malware; now, a carefully crafted malware sample with minimal changes to malware code but still able to preserve the realism and functionality of the malware is able to fool ML-based malware detectors to misclassify them as benign-ware. These attacks pose an emerging threat against ML-based malware detectors [13]–[18].

Problem. In general, adversarial learning [19] or training with adversarial examples is an effective method to build models robust against adversarial examples. However, generating adversarial malware samples for training, especially at the production scale necessary for deployable models, is non-trivial. Because:

• Generation of adversarial examples in the malware domain is confronted with the inverse feature-mapping problem where the function mapping from the problem space (the discrete space of software code binaries) to the feature space (vectorized features) is non-differentiable [20]–[22]. Hence, fast, gradient-driven methods to derive useful information to craft adversarial samples in the problem space are not suitable.

• The need to enforce malware domain constraints, realism, functionality, and maliciousness on generated perturbations in the problem space is a difficult proposition. Thus, arbitrary changes to the malware binaries are not possible because it could drastically alter the malware in a manner to break the malicious functionality of the binaries or even make it unloadable.

Although efforts to realize robust models on discrete spaces such as discrete image or graph data exist [23], [24], the problem space of malware classification is significantly more challenging due to the imposed constraints in the problem space; the realism and functionality as well as maliciousness of the malware must be maintained. Unfortunately, a method to scale up adversarial training with samples in the problem space to production scale datasets, especially in the case of neural networks, does not exist.

Further, despite extensive work on adversarial ML in general, very few studies have focused on the problem in the context of malware as recently highlighted by [17], and a comprehensive investigation of robust defense methods in the area remains to be conducted.

Research Questions. Hence, in this study, we seek to answer the following research questions (RQs):

• RQ1. How can we overcome the challenging problem of adversarial learning for malware at a production scale to realize robust malware detectors against adversarial malware samples?

• RQ2. How can we formulate an adversarial learning problem for building robust malware detectors and how can we explain the robustness and benefits?

• RQ3. How robust are adversarially trained malware detectors, especially against problem-space (functional, realistic and malicious) adversarial malware samples?

Our Approach. We argue that a defender is not confronted with the problems we mentioned. Because, we show that constraining the adversarial examples in the problem space to preserve malware realism, functionality and maliciousness can be turned to an advantage for defenders. The constraints make the perturbed malware in the problem space a subset of the adversarial examples in the feature space. Therefore, designing a robust method against feature-space adversarial examples will inherently be robust against constrained problem-space adversarial examples encapsulating the threats from adversarial malware.

To construct a formulation to improve the robustness against feature-space adversarial malware examples, and ultimately problem space malware, we propose a Bayesian formulation for adversarially training a neural network: i) with the capability to capture the distribution of models to improve robustness [25]–[30]; and ii) prove our proposed method of diversified Bayesian neural networks hardened with adversarial training bounds the difference between the adversarial risk and the conventional empirical risk to theoretically explain the improved robustness.

Moreover, just recently, security researchers with domain expertise placed significant effort into providing features¹ for malware samples at a production scale of more than 20 million samples [6], [8]–the SOREL-20M dataset. However, the robustness of networks built on these extracted features in the face of evasion attacks are yet to be understood. Therefore, our study to investigate production scale adversarial learning is timely and we focus our efforts to investigate methods using the SOREL-20M dataset.

Our Contributions.  To address the problem of building robust malware detectors, we make the following contributions:

1. We prove the projection of perturbed yet, valid malware, in the problem space (the discrete space of software code binaries) into the feature space will be a subset of feature-space adversarial examples. Thus, a robust network against feature-space attacks is inherently robust against problem-space attacks. Our work provides a theoretically justified basis for adversarially training malware detectors in the feature space. Further, to corroborate our proof, we empirically demonstrate networks trained on feature-space adversarials are robust against functional and realistic problem-space adversarial malware (RQ1).

2. Hence, to improve robustness in the problem space we propose performing adversarial learning in the feature space and formulate a Bayesian Neural Network (BNN) adversarial learning objective that captures the distribution of models for improved robustness. The algorithm is capable of learning from production scale feature-space datasets of up to 20 million samples (RQ1 and RQ2).

3. We also prove hardening BNNs with adversarial examples bounds the difference between the adversarial risk and the empirical risk to explain the improved robustness (RQ2).

4. We empirically demonstrate Bayesian Neural Networks capturing model diversity to improve the performance of malware classifiers and adversarially trained BNNs to generate more robust models against the threat of adversarial malware. Adversarially trained BNNs achieve new benchmarks for state-of-the-art robustness—especially against unseen, stronger, attack samples (RQ3).

Scope. Notably, in our study, we focus on Windows Portable Executable (PE) malware for two reasons: i) Windows is the most popular operating system for end-users worldwide, and PE-file malware is the earliest and most studied threat in the wild [31], making a robust method to detect adversarial PE files a significant contribution to security research; and ii) the intuition and methodology behind Windows PE malware can be applied and transferred to other file formats and operating systems, such as PDF malware or malware for Linux and Android systems (see the Appendix).

2 Background and Related Work↩︎

Machine Learning Methods in the Malware Domain. Malware detection is moving away from hand-crafted approaches relying on rules toward machine learning (ML) techniques [7], [31]–[33]. Recently, MalConv [7] adopted a Convolutional Neural Network (CNN) based architecture design with a learnable, but non-differentiable, embedding space for malware detection from raw byte sequences. The adoption of a CNN for malware detection was also proposed in [33]. However, training malware detectors on raw byte sequences (arbitrary number, often millions, of bytes) is computationally expensive and time-consuming. In addition, as we discussed earlier, it is non-trivial to craft realistic adversarial examples on raw byte sequences to realize a robust network on large-scale datasets. Consequently, recent work has employed problem space to feature space mapping functions together with feed-forward neural networks to build benchmark models for the large-scale SOREL-20M dataset [6].

LUNA [34] proposed a simple linear Bayesian model for an Android malware detector, which preserves the concept of uncertainty, and shows that it helps to reduce incorrect decisions as well as improve the accuracy of classification. The benefit of a Bayesian classifier is to handle ML tasks from a stochastic perspective, where all weight values of the network are probability distributions. More recently, [35] investigated the application of uncertainty and Bayesian treatment to improve the performance of malware detectors on neural networks.

Adversarial Malware (Adversarial Examples in the Malware Domain). ML-based classifiers are shown to suffer from evasion attacks, via adversarial examples [10]. Recently, adversarial examples were demonstrated in the problem space [13]–[16], [36]–[38]. In particular, [14] proposed a method to append bytes to the end of the binary PE file, while [15] exploited the regions within the executable which are not mapped to memory to construct adversarial malware. These methods intend to make modifications that do not affect the intended behavior of the executable. Suciu et al. [16] adopted FGSM [10] to show the generalization properties and effectiveness of adversarial examples against a CNN-based malware detector, MalConv, trained with small-scale datasets. [16] highlighted the threat from adversarial examples as an alternative to evasion techniques such as runtime packing, but showed that models trained on small-scale datasets did not generalize to robust models; hence, emphasizing the importance of training networks on production-scale datasets.

Improving Model Robustness. Among methods for improving the robustness of models [11], [39], [40], adversarial training [11] and its variants are shown to be one of the most effective and popular methods to defend against adversarial examples [19]. The goal of adversarial training is to incorporate the adversarial search within the training process and, thus, realize robustness against adversarial examples at test time. In particular, recently, Bayesian adversarial learning has been investigated and adopted in the computer vision domain to propose to improve the robustness of models against adversarial examples [25]–[30].

Adversarial learning was explored in the malware domain in [41] to generate a robust detector for binary encoded malware. However, the computational cost to realize realistic, adversarial raw byte representations is prohibitively expensive [16], [17] for adversarial learning.

Summary. We recognize that: i) a method capable of scaling up the adversarial training of neural networks in the problem space to production scale datasets does not exist; ii) a Bayesian adversarial learning objective that captures the distribution of models could provide improved robustness; however iii) such a formulation requires overcoming the challenging problem of generating problem-space adversarial examples at production scales.

In what follows, we begin with a problem definition, a theoretical basis for employing feature-space adversarial learning as an alternative to problem-space, followed by the formulation of a Bayesian adversarial learning objective and experimental results validating our claims and demonstrating state-of-the-art performance and robustness.

3 Problem Definition↩︎

Threat model. We assume an attacker with perfect knowledge (white-box attacker) [21], in which the attacker knows all parameters including feature set, learning algorithm, loss function, model parameters/hyperparameters, and training data. The reason for considering the strongest, perfect-knowledge adversary is because, even if access to the model is not possible, or the model is not publicly available, an adversary can employ a reverse engineering approach such as [42]–[44] to extract the model. And, defending against such attacks is challenging. The attacker’s objective is to evade detection. Their capability is to modify the features at test time. Problem-Space Attacks. We consider the problem space \(\mathcal{Z}\) which refers to the input space of real objects of a considered domain such as software code binaries. First \(\mathcal{Z}\) must be transformed into a compatible format such as numerical vector data [6], [8] for ML to process. Then, a feature mapping is a function \(\Phi: \mathcal{Z} \rightarrow \mathcal{X} \subseteq \mathbb{R}^n\) that maps a given problem-space software code binary \(\boldsymbol{z}\in \mathcal{Z}\) to an n-dimensional feature vector \(\boldsymbol{x}\in \mathcal{X}\) in the feature space such that \(\Phi(\boldsymbol{z}) = \boldsymbol{x}\).

Normally, attackers have to apply a transformation on \(\boldsymbol{z}\) to generate \(\boldsymbol{z}'\) such that \(\Phi(\boldsymbol{z}')\) is very close to \(\boldsymbol{x}'\) in the feature space. Formally, given a problem-space object \(\boldsymbol{z}\in \mathcal{Z}\) with label \(y \in \mathcal{Y}\), the goal of the adversary is to find the transformation \(\mathbf{T}: \mathcal{Z}\rightarrow \mathcal{Z}\) (e.g. addition, removal, modification) such that \(\boldsymbol{z}' = \mathbf{T}(\boldsymbol{z})\) is classified as a class \(t \neq y\). In the malware domain, the adversary has to search in the problem space that approximately follows the gradient in the feature space. However, this is a major challenge that complicates the application of gradient-driven methods to the problem-space attacks— so-called inverse feature-mapping problem [17], [20], [22] where the function \(\Phi\) in the software domain—our focus—is typically not invertible and not differentiable, i.e. there is no one-to-one mapping from the adversarial examples in the feature space \(\boldsymbol{x}+ \boldsymbol{\delta}\) to the corresponding adversarial problem-space object \(\boldsymbol{z}'\). In addition, the generated object \(\mathbf{T}(\boldsymbol{z})\) must be realistic and valid [16]. Thus, the search for adversarial examples in the problem space (software) cannot be a purely gradient-based method, hindering the adoption of well-known adversarial attacks in other domains such as computer vision. To achieve a realistic adversarial objective, the search for adversarial examples in the problem space has to be constrained in problem-space constraints denoted by \(\Omega\). We remark that the constraints on the problem space are well defined and can be found in [12], [17], [22], [37], we mentioned here, for completeness, that there are at least four main types of problem-space constraints including Preserved semantics, Plausibility, Robustness to Processing and Available Transformation explained in detail by [17].

Feature-Space Attacks. To alleviate the problems with problem space attacks, we propose an alternative that uses feature space. We note that all definitions of feature-space attacks are well defined and consolidated in related work [12], [13], [45]. In this paper, we use a popular feature mapping function provided in the EMBER dataset [8] to map raw bytes of software to a vector of \(n=2381\) features. A feature-space attack is then to modify a feature-space object \(\boldsymbol{x}\in \mathcal{X}\) to become another object \(\boldsymbol{x}' = \boldsymbol{x}+ \boldsymbol{\delta}\) where \(\boldsymbol{\delta}\) is the added perturbation crafted with an attack objective function to miclassify \(\boldsymbol{x}'\) into another class \(t \neq y\) where \(y \in \mathcal{Y}\) is the ground-truth label of \(\boldsymbol{x}\). We note that in the malware domain (a binary classification task), the intuition of the attackers is to make the malware be recognized as benign ware. These modifications has to follow feature-space constraints. We denote the constraints on feature-space modifications by \(\Upsilon\). Given a sample \(\boldsymbol{x}\in \mathcal{X}\), the feature-space modification, or perturbation \(\boldsymbol{\delta}\) must satisfy \(\Upsilon\). This constraint \(\Upsilon\) reflects the realistic requirements of problem-space objects. In the malware domain, feature perturbations \(\boldsymbol{\delta}\) can be constrained \(\boldsymbol{\delta}_{lb} \leq \boldsymbol{\delta}\leq \boldsymbol{\delta}_{ub}\) [17].

4 Theoretical Basis For Feature-Space Adversarial Learning↩︎

We highlight that the realistic assumption of problem-space attacks makes the constraints imposed by \(\Omega\) stricter or equal to those imposed by \(\Upsilon\) (illustrated in Figure 1). Following the necessary condition for problem-space adversarial examples as stated in [17], we have:

Lemma 1. If there exists an adversarial example in the problem space (\(\boldsymbol{z}'\)) that satisfies the constraints \(\Omega\), then there will be a corresponding adversarial example in the feature space (\(\boldsymbol{x}'\)) under the constraints \(\Upsilon\). More formally, by abusing notation from model theory to use \(\models\) to indicate an instance “satisfies” constraints, and write \(\boldsymbol{z}' \models \Omega\) and \(\boldsymbol{x}' \models \Upsilon\), we have: \[\begin{align} \exists \boldsymbol{z}': \boldsymbol{z}' \models \Omega, \quad p\big(y \mid \Phi(\boldsymbol{z}'), \boldsymbol{\theta}\big) = p(y\mid\Phi(\mathbf{T}(\boldsymbol{z})), \boldsymbol{\theta}), \\ \quad \quad p(y\mid\Phi(\mathbf{T}(\boldsymbol{z})), \boldsymbol{\theta}) < 0.5 \\ \Rightarrow \exists \boldsymbol{x}'= \boldsymbol{x}+ \boldsymbol{\delta}: \boldsymbol{x}' \models \Upsilon, \quad p(y\mid \boldsymbol{x}',\boldsymbol{\theta}) < 0.5 \end{align}\] where \(\mathbf{T}\) is the transformation in the problem space to craft adversarial examples, \(p(y\mid \boldsymbol{x}, \boldsymbol{\theta})=\text{sigmoid}(f(\boldsymbol{x};\boldsymbol{\theta}))\) is the output of a sigmoid function applied to the output of the neural networks \(f\) parameterized by \(\boldsymbol{\theta}\), \(p(y\mid \boldsymbol{x}, \boldsymbol{\theta})=0.5\) is the threshold for malware detection where the predicting \(p(y\mid \boldsymbol{x}, \boldsymbol{\theta})=0\) is recognized as benign whilst \(p(y\mid \boldsymbol{x}, \boldsymbol{\theta})=1\) indicates a malware, \(\Omega, \Upsilon\) are, respectively, the problem-space and feature-space constraints, and \(\Phi(\cdot)\) is the function that maps the problem space to feature space.

The proof of Lemma 1 is in Appendix 9.1. From Lemma 1, if there exists an attack in the problem space, then there exists a corresponding attack in the feature space. By contraposition, if there does not exist an attack in the feature space, there does not exist an attack in the problem space. However, we know that the opposite is not true: if there does not exist an attack in the problem space (e.g. due to functionality), there still exists an attack in the feature space. Thus, we can derive:

Corollary 1. The adversarial examples generated from constrained problem-space adversarial examples (imposed by \(\Omega\)) are in a subset of feature-space adversarial examples (imposed by \(\Upsilon\)).

Corollary 2. Detectors robust against feature-space adversarial examples (imposed by \(\Upsilon\)) are robust against constrained problem-space adversarial examples (imposed by \(\Omega\)).

Built upon these Corollaries, we propose to find a learning method robust against feature-space adversarial malware. On the one hand, adversarial training [11] and its variants are shown to be one of the most effective and popular methods to defend against adversarial examples [19]. On the other hand, Bayesian neural networks [46]–[48] with distributions placed over their weights and biases enabling the principled quantification of the uncertainty of their predictions are shown to be a robust method against adversarial examples. Thus, in this paper, demonstrating that robustness against feature-space adversarial examples is inherently robust against problem-space real malware. We propose to incorporate adversarial training with Bayesian neural networks to seek the first principled method of Bayesian adversarial learning to realize a robust malware detector without the difficulties of inverse feature-mapping and preserving semantics and functionalities of real malware samples. We name our method Adv-MalBayes, and the method is efficient enough to be scaled up to a large production scale of adversarial training data of 20 million adversarial samples with the pre-extracted feature set of SOREL-20M dataset [6].

5 Bayesian Formulation for Adversarial Learning↩︎

The goal of Bayesian adversarial learning is to find the posterior distribution using Bayes theorem: \[p(\boldsymbol{\theta}\mid\mathcal{D}_{\text{adv}})={\prod_{(\boldsymbol{x}_{\text{adv}},y)\sim\mathcal{D}_{\text{adv}}}p(y\mid\boldsymbol{x}_{\text{adv}},\boldsymbol{\theta})p(\boldsymbol{\theta})}/{Z}\] where \(Z\) is the normalizer, \(\mathcal{D}_{\text{adv}}\) is the adversarial dataset obtained by generating adversarial examples from the benign dataset \(D\) using adversarial generation such as Eq. 1 .

We consider \(p(y\mid\boldsymbol{x}_{\text{adv}},\boldsymbol{\theta})=\text{sigmoid}(f(\boldsymbol{x}_{\text{adv}};\boldsymbol{\theta}))\) to produce a binary prediction in malware detection. Notably, Eq. 1 is the Expectation-over-Transformation (EoT) PGD attack [49], [50], which is slightly different from the usual PGD attack [11]. As has been highlighted in [50], the EoT attack is better able to estimate the gradient of the stochastic Bayesian models: \[\begin{align} \label{eq:a95pgd} \scalebox{0.95}{\displaystyle \boldsymbol{x}^{t+1}=\Pi_{\varepsilon_{\max}}\left\{\boldsymbol{x}^{t}+\alpha \cdot \operatorname{sign}\left({\mathbb{E}_{\boldsymbol{\theta}}}\left[\nabla_{\boldsymbol{x}} \ell\left(f\left(\boldsymbol{x}^{t} ; \boldsymbol{\theta}\right), y_{o}\right)\right]\right)\right\}.} \end{align}\tag{1}\] where \(\varepsilon_{\max}\) is the maximum attack budget, \(\Pi_{\varepsilon_{\max}}\) is the projection to the set \(\left\{\boldsymbol{x}\mid\left\|\boldsymbol{x}-\boldsymbol{x}_{o}\right\|_{\infty} \leq \varepsilon_{\max}\right\}\), \(\ell\) is the loss function (typically cross-entropy), \(f\) is the neural network, \(\mathbf{x}\) is the input, \(\boldsymbol{\theta}\) is the network parameter, and \(y\) is the ground-truth label. In this attack, an attacker starts from \(\boldsymbol{x}^0=\boldsymbol{x}_{o}\) and conducts projected gradient descent iteratively to update the adversarial example.

However, as highlighted in [48], the posterior over a Bayesian neural network is extremely high-dimensional, non-convex and intractable. Thus, we need to resort to approximations to find the posterior distribution. In this work, we propose using Stein Variational Gradient Descent (SVGD) [25] for two reasons. First, this approach learns multiple network parameter particles in parallel for faster convergence. Second, there is a repulsive factor in the method to encourage the diversity of parameter particles that helps to prevent mode collapse — a challenge of posterior approximation. To further demonstrate the robustness of our chosen Bayesian method, we compare Adv-MalBayes with previous BNNs [26] in the Appendix Table 5.

We consider \(n\) samples from the posterior (i.e. parameter particles). The variational bound is minimized when gradient descent is modified as: \[\begin{gather} \label{eq:grad95update} \boldsymbol{\theta}_i = \boldsymbol{\theta}_i - \epsilon_i \hat{\boldsymbol{\phi}}{}^*(\boldsymbol{\theta}_i) \\ \text{\quad with} \quad \hat{\boldsymbol{\phi}}{}^*(\boldsymbol{\theta}) = \sum_{j=1}^n\big[ k(\boldsymbol{\theta}_j, \boldsymbol{\theta}) \nabla_{\boldsymbol{\theta}_j} \ell(f(\boldsymbol{x}_{\text{adv}};\boldsymbol{\theta}_j),y) \,\,\,\\ -\frac{\gamma}{n}\nabla_{\boldsymbol{\theta}_j} k(\boldsymbol{\theta}_j, \boldsymbol{\theta})\big]\,. \end{gather}\tag{2}\] Here, \(\boldsymbol{\theta}_i\) is the \(i\)th particle, \(k(\cdot, \cdot)\) is a kernel function that measures the similarity between particles and \(\gamma\) is a hyper-parameter. The parameter particles are encouraged to be dissimilar to capture more diverse samples from the posterior thanks to the kernel function. This is controlled by a hyper-parameter \(\gamma\) to manage the trade-off between diversity and loss minimization. Following [25], we use the RBF kernel \(\scalebox{.9}{\displaystyle k(\boldsymbol{\theta}, \boldsymbol{\theta}')=\exp \left(-{\left\|\boldsymbol{\theta}-\boldsymbol{\theta}^{\prime}\right\|^{2}}/{2 h^{2}}\right)}\) and take the bandwidth \(h\) to be the median of the pairwise distances of the set of parameter particles at each training iteration.

At the inference stage, given the test data point \(\boldsymbol{x}^*\), we can get the prediction by approximating the posterior using the Monte Carlo samples as: \[\begin{align} p ( y^* \mid & \mathbf{x}^*, \mathcal{D}_{\text{adv}}) = \int p(y^* \mid \mathbf{x}^*, \boldsymbol{\theta}) p(\boldsymbol{\theta} \mid \mathcal{D}_{\text{adv}}) d \boldsymbol{\theta} \\ & \approx \frac{1}{n} \sum_{i=1}^{n} p(y^* \mid \mathbf{x}, \boldsymbol{\theta}_{i}), \quad \boldsymbol{\theta}_{i} \sim p(\boldsymbol{\theta} \mid \mathcal{D}_{\text{adv}})\,, \end{align}\] where \(\boldsymbol{\theta}_i\) is an individual parameter particle. Notably, we acknowledge that it is critical to have diverse parameter particles. Averaging over diverse and uncorrelated predictors was shown to improve network performance [51]–[53]. In the adversarial setting, when integrating out the parameters in our Bayesian formulation, we implicitly remove the vulnerabilities arising from a single choice of parameter existing in traditional neural networks, and hence improve the robustness.

5.1 Adversarial Risk is Bounded with the Bayesian Formulation↩︎

In this section, to explain the robustness of the Bayesian adversarial learning method that we propose, we prove that training the network with the Bayesian adversarial learning method bounds the difference between the adversarial risk and the empirical risk. This is important, because, now the risk of misclassification on adversarial examples is as the same as that of benign ones; hence eliminating the vulnerability of adversarial examples and reduce the risk of misclassification of adversarial examples to the generalization ability of the classifier. Notably, improving the generalization ability of the classifier is not our focus.

In this context, we make no specific assumption on the distribution of either the adversarial examples or the perturbations, to provide a generic defense approach. The only assumption we make is that the distribution of the data and the corresponding adversarial examples are sufficiently close. This is a mild and reasonable assumption because the idea of adversarial learning is that the added perturbation does not change the perceived samples or the distribution of the samples. Thus, we consider the bound of \(\left|R_{\text{adv}}-R\right|\) where the empirical risk \(R=\mathbb{E}_{\boldsymbol{\theta}}\left[\mathbb{E}_{(\boldsymbol{x},y)\sim\mathcal{D}}\left[ \mathbb{E}_{y'\sim p(y\mid\boldsymbol{x},\boldsymbol{\theta})}\left[\mathbb{I}(y=y')\right]\right]\right]\) and the adversarial risk \(R_{\text{adv}}=\mathbb{E}_{\boldsymbol{\theta}}\left[\mathbb{E}_{(\boldsymbol{x}_{\text{adv}},y)\sim\mathcal{D}_{\text{adv}}}\left[ \mathbb{E}_{y'\sim p(y\mid\boldsymbol{x}_{\text{adv}},\boldsymbol{\theta})}\left[\mathbb{I}(y=y')\right]\right]\right]\)

We can see that the difference between the empirical risk and the adversarial risk is minimized when the upper bound is minimized. Notably, as we know that \(1-\exp(-z)\) is a monotonically increasing function, and \(1-\exp(-z)\leq z\), to avoid computational instabilities and gradient saturation, we consider minimizing the upper bound without the exponential function. Thus, to minimize the upper bound, our main learning objective (in Algorithm 3 in the Appendix) is to:

• Minimize cross entropy for the adversarial examples. This corresponds to matching the prediction from the adversarial data to that of the observations. Since \((\boldsymbol{x},y)\) is given in the training, we simply minimize the entropy of the adversarials.

Sketch of the Proof. We simplify the difference between the risks by considering that the difference between individual mistakes is smaller than their product, i.e.\[\begin{align} \mathbb{E}_{y_1\sim p(y\mid\boldsymbol{x},\boldsymbol{\theta})}\left[\mathbb{E}_{y_2\sim p(y\mid\boldsymbol{x}_{\text{adv}},\boldsymbol{\theta})}\left[\mathbb{I}[y\neq y_1]-\mathbb{I}[y\neq y_2]\right]\right] \\ \leq \mathbb{E}_{y'\sim p(y\mid\boldsymbol{x}_{\text{adv}},\boldsymbol{\theta})}\left[\mathbb{E}_{y'\sim p(y\mid\boldsymbol{x}_{\text{adv}},\boldsymbol{\theta})}\left[\mathbb{I}[y_1\neq y_2]\right]\right]\\ \leq 1-\sum_{c=1}^K p(y=c\mid\boldsymbol{x},\boldsymbol{\theta})p(y=c\mid\boldsymbol{x}_{\text{adv}},\boldsymbol{\theta})\,. \end{align}\] We then use Jensen’s inequality when using \(\exp(\log(\cdot))\) to obtain the upper bound. The complete proof is provided in Appendix 9.2. We empirically evaluate this difference of risk and illustrate the results in Figure 5 in the Appendix.

6 Experiments and Results↩︎

Classifiers. To validate our proposed method Adv-MalBayes, we conduct experiments on different neural networks. We employ the Feed Forward Neural Network (FFNN) classifier provided in the SOREL-20M dataset [6]. This network architecture is also used for the experiments on the EMBER dataset [8]. Our network implementation uses the default configuration provided in [6]. We also adopt the architecture of FFNN to design the Bayesian Neural Network (BNN). The details of the network architecture are in Appendix. Then, we harden the FFNN and BNN with adversarial examples to generate the Adv-FFNN model and Adv-MalBayes. In addition, we also employ baseline networks including LightGBM [8] and MalConv [7] for comparison. We compare their performance on malware datasets (no attacks) and its adversarial counterparts (adversarial malware designed to evade detectors) to evaluate the detector performance and robustness. The values of the attack budgets used for training and testing are detailed in Table ¿tbl:table:hyperparameters? in the Appendix.

Datasets. In this paper, we use the two largest publicly available corpora for malware detection, namely:

• The production scale dataset Sophos AI SOREL-20M [6] containing 20 million pre-extracted samples.

• EMBER [8] dataset designed to be more challenging for ML-based classifiers.

We detail these datasets in Appendix 9.3.

Results. We present our results by reporting: i) performance of the given classifiers on malware detection tasks (no attacks setting) using ROC (receiver operating characteristic curve); and ii) robustness (under evasion attacks with adversarial malware). We detail these metrics in the Appendix. Performance (no attacks). Performance of the classifiers in the absence of attacks are shown in Figure 2 with additional details reported in Table 4 in the Appendix. The ROC curves in Figure 2 report the True Positive Rate (i.e. the percentage of correctly-classified malware samples) as a function of the False Positive Rate (FPR, i.e. the percentage of misclassified benign samples) for each classifier. From the figure, we can see that Bayesian neural networks of the same network architecture as FFNNs achieve better performance (compare BNN vs. FFNN and Adv-MalBayes vs. Adv-FFNN). Notably, the BNNs outperformed the FFNN counterparts with a large margin in the detection rate (of up to 20%) under low-FPR regimes. Notably, in Table 4 in the Appendix, we also show that BNNs built on feature-space samples achieve better performance compared with the popular ML-based malware detector built on problem-space samples (MalConv) [7] and its recently updated version in AAAI-21 (MalConv w/ GCG) [54].

Robustness (against Feature-Space Adversarial Examples). To evaluate the robustness of the investigated classifiers, we apply the PGD attack from Equation 1 on malware samples with increasing attack budgets. Results for the robustness of given classifiers under different attack budgets are reported in Table 1. Notably, Adv-MalBayes outperforms the adversarially trained FFNN on both the production scale (SOREL-20M) and challenging (EMBER) datasets, especially under increasing attack budgets. This is significant because the problem with malware is that they are evolving extremely fast e.g. there are hundreds of thousands of new malware samples every day [3]. Further, results in Figure 4 in the Appendix illustrate, as expected and in line with the findings in the literature [10], [11], [45], the adversarially trained networks are significantly more robust than non-adversarially trained counterparts.

Robustness (against Problem-Space Adversarial Malware). In this section, we evaluate the robustness of different networks against functional, malicious and real adversarial malware in the problem space. We employ two evaluation sets. Set A includes real malware collected from a previous study [55] and includes 7137 virus samples. We generate the real adversarial malware samples by utilizing the constant padding attack method proposed by [56] used to win the machine learning static evasion competition [57]. In particular, 100,000 constant bytes valued 0xA9 were added to a new section of PE files to ensure the malicious functionality is not altered. The results in Table ¿tbl:tab:ps-ae? show that this attack can significantly degrade the performance of the popular ML-based malware detector MalConv [7], however the LightGBM [8] model is still robust against this attack (confirming the previous result obtained by [56]). Set B consists of the recent release by [58]. This includes 1001 real adversarial malware samples generated using the Greedy Attack method shown to be stronger than the constant padding attack [56]. The results reported in Table ¿tbl:tab:ps-ae? show that the Greedy Attack successfully fools the LightGBM model and downgrades its robustness to 11.2%. Notably, evaluations under both sets show the adversarially trained networks on feature-space adversarial samples (i.e. Adv-FFNN and Adv-MalBayes) maintained their robustness. Importantly, Adv-MalBayes achieved very high robustness under both attack datasets and is a clear demonstration of the effectiveness of our approach and the validity of the theoretical basis for training with feature-space adversarial samples.

The Impact of Number of Parameter Particles.  We investigate the contribution of the number of parameter particles to the robustness of the networks and report the results in Table 3 in the Appendix. The robustness of the BNNs is improved when more particles capable of modeling the multi-modal posterior are employed. Thus, increasing the number of parameter particles may further improve the network’s robustness.

Transferability of Robustness. We also evaluate the robustness of the BNN trained on PGD \(L_\infty\), and its transferability to other attacks, such as FGSM [10]. Table 2 shows that the network trained with PGD \(L_\infty\) is robust to other attacks, in line with [11], where PGD \(L_\infty\) is considered as the ‘universal’ attack. Consequently, we can expect our method to improve robustness against a wide range of other adversarial example generation methods [14]–[16] adopting the FGSM method to attempt to generate problem space malware samples.

7 Conclusion↩︎

We proved and demonstrated that training a robust malware detector on feature-space adversarial examples inherently generates robustness against problem-space malware samples. Subsequently, we proposed a Bayesian adversarial learning objective in the feature space to realize a robust malware detector in the problem space. Additionally, we explain the improved performance by proving that our proposed method bounds the difference between adversarial risk versus empirical risk to improve robustness and show the benefits of a BNN as a defense method (see Appendix). Our empirical results, including a production scale dataset, demonstrates new state-of-the-art performance and robustness benchmarks.

8 Acknowledgments↩︎

This research was supported by the Next Generation Technologies Fund from the Defence Science and Technology Group, Australia. We also thank Dr. Sharif Abuadbba for supporting us in collecting malware samples for the project.

9 Appendix↩︎

9.1 Proof of Lemma 1↩︎

We consider the problem-space example \(\boldsymbol{z}\in \mathcal{Z}\) with the feature in the feature space \(\boldsymbol{x}\in \mathcal{X}\). Initially, we assume that there is no solution to the feature-space attack (\(\boldsymbol{x}'\)) under constraints \(\Upsilon\) given an existing problem-space adversarial attack (\(\boldsymbol{z}'\)) under constraints \(\Omega\). Specifically, we assume that there is no \(\boldsymbol{\delta}\) that satisfies \(p(y\mid\boldsymbol{x}+ \boldsymbol{\delta}, \boldsymbol{\theta}) < 0.5\), \(\boldsymbol{\delta}\models \Upsilon\). However, because there exists an adversarial attack in the problem-space, \[\exists \boldsymbol{z}': \boldsymbol{z}' \models \Omega, \quad p\big(y \mid \Phi(\boldsymbol{z}'), \boldsymbol{\theta}\big) = p(y\mid\Phi(\mathbf{T}(\boldsymbol{z})), \boldsymbol{\theta}), \quad p(y\mid\Phi(\mathbf{T}(\boldsymbol{z})), \boldsymbol{\theta}) < 0.5\]

Thus, \[\label{NeurIPS95eq:T} \exists \mathbf{T}^* : p(y\mid\Phi(\boldsymbol{z}'),\boldsymbol{\theta}) = p(y\mid\Phi(\mathbf{T}^*(\boldsymbol{z})),\boldsymbol{\theta}), p(y\mid\Phi(\mathbf{T}^*(\boldsymbol{z})),\boldsymbol{\theta}) < 0.5, \quad \boldsymbol{z}, \boldsymbol{z}' \models \Omega\tag{3}\] For any transformation \(\mathbf{T}\) in the input space, there exists a value \(\boldsymbol{\delta}^*\) for which we have: \[\exists \mathbf{T}^* : p(y\mid\Phi(\mathbf{T}^*(\boldsymbol{z})),\boldsymbol{\theta}) = p(y\mid\boldsymbol{x}+ \boldsymbol{\delta}^*,\boldsymbol{\theta}), \quad p(y\mid\boldsymbol{x}+ \boldsymbol{\delta}^*,\boldsymbol{\theta}) < 0.5, \quad \boldsymbol{z}, \boldsymbol{z}' \models \Omega\]

We recall that feature-space constraints are determined by problem-space constraints, that is, the search space allowed by \(\Omega\) is stricter or equal to that allowed by \(\Upsilon\). Thus, \(\boldsymbol{\delta}^*\) must be a solution to feature-space constraints \(\Upsilon\). However, this is not possible because we begin with the assumption that there is no \(\boldsymbol{\delta}\) that satisfies \(f(\boldsymbol{x}+ \boldsymbol{\delta}) < 0.5, \boldsymbol{\delta}\models \Upsilon\). This contradiction proves that: \[\begin{align} &\exists \boldsymbol{z}': \boldsymbol{z}' \models \Omega, \quad p(y\mid\Phi(\boldsymbol{z}'),\boldsymbol{\theta}) = p(y\mid\Phi(\mathbf{T}(\boldsymbol{z})),\boldsymbol{\theta}), \quad p(y\mid\Phi(\mathbf{T}(\boldsymbol{z})),\boldsymbol{\theta}) < 0.5 \\ &\Rightarrow \exists \boldsymbol{x}'= \boldsymbol{x}+ \boldsymbol{\delta}: \boldsymbol{x}' \models \Upsilon, p(y\mid\boldsymbol{x}',\boldsymbol{\theta}) < 0.5 \end{align}\]

9.2 Proof of the Objective (Proposition 1)↩︎

We have \[\begin{align} \left|R_{\text{adv}}-R\right| & =\left|\mathbb{E}_{(\boldsymbol{x},y)\sim\mathcal{D}}\Bigg[\mathbb{E}_{\boldsymbol{\theta}}\Bigg[\underset{}{\sup}\,\,\mathbb{E}_{y_{1}\sim p(y|\boldsymbol{x}_{\text{adv}})}\left[\mathbb{I}\left(y_{1}\neq y\right)\right]-\mathbb{E}_{y_{2}\sim p(y|\boldsymbol{x})}\left[\mathbb{I}\left(y_{2}\neq y\right)\right]\Bigg]\Bigg]\right|\,,\\ & =\left|\mathbb{E}_{(\boldsymbol{x},y)\sim\mathcal{D}}\Bigg[\mathbb{E}_{\boldsymbol{\theta}}\Bigg[\sup\,\,\mathbb{E}_{y_{1}\sim p(y|\boldsymbol{x}_{\text{adv}}),y_{2}\sim p(y|\boldsymbol{x})}\left[\mathbb{I}\left(y_{1}\neq y\right)-\mathbb{I}\left(y_{2}\neq y\right)\right]\Bigg]\Bigg]\right|\,,\\ & \quad\left.\leq\mathbb{E}_{(\boldsymbol{x},y)\sim\mathcal{D}}\Bigg[\mathbb{E}_{\boldsymbol{\theta}}\Bigg[\sup\,\,\mathbb{E}_{y_{1}\sim p(y|\boldsymbol{x}_{\text{adv}}),y_{2}\sim p(y|\boldsymbol{x})}\left[|\mathbb{I}\left(y_{1}\neq y\right)-\mathbb{I}\left(y_{2}\neq y\right)|\right]\Bigg]\right]\,,\\ & \quad\leq\mathbb{E}_{(\boldsymbol{x},y)\sim\mathcal{D}}\Bigg[\mathbb{E}_{\boldsymbol{\theta}}\Bigg[\sup\,\,\mathbb{E}_{y_{1}\sim p(y|\boldsymbol{x}_{\text{adv}}),y_{2}\sim p(y|\boldsymbol{x})}\left[\mathbb{I}\left(y_{1}\neq y_{2}\right)\right]\Bigg]\Bigg]\,. \end{align}\] where we can upper bound the expected misclassification to have:

\[\begin{align} &\mathbb{E}_{(\boldsymbol{x},y)\sim\mathcal{D}}\Bigg[\mathbb{E}_{\boldsymbol{\theta}}\bigg[1-\sum_{c=1}^{K}p(y=c\mid\boldsymbol{x},\boldsymbol{\theta})p(y=c\mid\boldsymbol{x}_{\text{adv}},\boldsymbol{\theta})\bigg]\Bigg]\,. \end{align}\] Subsequently, we use Jensen’s inequality and the fact that \(\boldsymbol{x}=\exp(\log(\boldsymbol{x}))\) to have: \[\begin{align} &\mathbb{E}_{(\boldsymbol{x},y)\sim\mathcal{D}}\Bigg[\mathbb{E}_{\boldsymbol{\theta}}\bigg[1-\exp(\underbrace{\log(\sum_{c=1}^{K}p(y=c\mid\boldsymbol{x},\boldsymbol{\theta})p(y=c\mid\boldsymbol{x}_{\text{adv}},\boldsymbol{\theta}))}_{\geq \sum_{c}^{K}p(y=c\mid\boldsymbol{x},\boldsymbol{\theta})\log(p(y=c\mid\boldsymbol{x}_{\text{adv}},\boldsymbol{\theta})})\bigg]\Bigg]\,, \end{align}\] and since \(1-\exp(z)\) is monotonically decreasing, we have \[\begin{align} &\mathbb{E}_{(\boldsymbol{x},y)\sim\mathcal{D}}\Bigg[\mathbb{E}_{\boldsymbol{\theta}}\bigg[1-\exp({\log(\sum_{c=1}^{K}p(y=c\mid\boldsymbol{x},\boldsymbol{\theta})p(y=c\mid\boldsymbol{x}_{\text{adv}},\boldsymbol{\theta}))})\bigg]\Bigg]\\ & \leq \mathbb{E}_{(\boldsymbol{x},y)\sim\mathcal{D}}\Bigg[\mathbb{E}_{\boldsymbol{\theta}}\bigg[1-\exp\big(\sum_{c}^{K}p(y=c\mid\boldsymbol{x},\boldsymbol{\theta})\log(p(y=c\mid\boldsymbol{x}_{\text{adv}},\boldsymbol{\theta}))\big)\bigg]\Bigg]\\ & \quad\quad= 1-\mathbb{E}_{(\boldsymbol{x},y)\sim\mathcal{D}}\Bigg[\mathbb{E}_{\boldsymbol{\theta}}\bigg[\exp\big(\sum_{c}^{K}p(y=c\mid\boldsymbol{x},\boldsymbol{\theta})\log(p(y=c\mid\boldsymbol{x}_{\text{adv}},\boldsymbol{\theta}))\big)\bigg]\Bigg]\,.\\ & \qquad\quad \end{align}\]

Thus we have the following bound: \[\begin{align} \label{eq:bound} \left|R_{\text{adv}}-R\right|\leq1-\mathbb{E}_{(\boldsymbol{x},y)\sim\mathcal{D}}\Bigg[\exp\Bigg(\mathbb{E}_{\boldsymbol{\theta}}\bigg[\underbrace{\sum_{c}^{K}p(y=c\mid\boldsymbol{x},\boldsymbol{\theta})\log(p(y=c\mid\boldsymbol{x}_{\text{adv}},\boldsymbol{\theta}))}_{r_{\boldsymbol{\theta}}(\boldsymbol{x},\boldsymbol{x}_{\text{adv}},y)}\bigg]\Bigg)\Bigg]\,. \end{align}\tag{4}\] This result demonstrates that the difference between the risks is bounded by the negative cross entropy of the predictions. While informative, this bound expresses the relation between the predictions only and not how the model perform on each set (i.e. given dataset versus its corresponding adversarial).

Then the difference between the empirical risk and the adversarial risk is minimized when the upper bound is minimized. Hence, the main learning objective is to:

• Maximize \(\mathbb{E}_{\boldsymbol{\theta}}[\sum_{c}^{K}p(y=c\mid\boldsymbol{x},\boldsymbol{\theta})\log(p(y=c\mid\boldsymbol{x}_{\text{adv}},\boldsymbol{\theta}))]\) or minimize \(\mathbb{E}_{\boldsymbol{\theta}}[\text{KL}(p(y=c\mid\boldsymbol{x},\boldsymbol{\theta})\|p(y=c\mid\boldsymbol{x}_{\text{adv}},\boldsymbol{\theta}))\): this corresponds to matching the prediction from the adversarial data to that of the observations. Since \((\boldsymbol{x},y)\) is given in training, for minimizing this KL-divergence we simply minimize the entropy of the adversarial examples instead;

Notably, since we know \(1-\exp(-z)\leq z\), to avoid computational instabilities and gradient saturation, we consider minimizing the upper bound without the exponential function in our implementation.

9.3 Datasets↩︎

Below is the detailed information regarding the datasets used in the paper:

• The EMBER dataset contains portable executable files (PE files) scanned by VirusTotal on or before 2018. It includes 600,000 training samples and 200,000 testing samples, equally distributed between benign programs and malicious programs, where the malware is labeled by the malware family using AVClass [59]. This dataset also includes the vectorized features which encode a great amount of information regarding the PE files, such as general file information, import/export functions, header information, and string information. This EMBER dataset (2018) was designed to be more challenging for ML-based classifiers compared with the older version — the EMBER2017 dataset. Thus, using this dataset is of interest to evaluate our ML-based malware classifier.

• The SOREL-20M dataset is a recent industrial-scale dataset from Sophos AI [6]. It contains 20 million samples with their pre-extracted features and metadata and high-quality labels. Particularly, the dataset includes 12,699,013 training samples, 2,495,822 validation samples, and 4,195,042 testing samples. The dataset also provides 10 million disarmed malware samples for feature exploration. With a significant amount of high-quality samples, this dataset aims to provide the new default benchmark for malware detection.

Note that both datasets follow a strict temporal split policy where test samples were observed strictly later than training samples.

9.4 Feature Computations↩︎

The paper explores the use of pre-extracted features rather than raw bytes. While the process of manually extracting these features may require significant effort from domain experts, recent developments in the field [6], [8] have automated this process and developed techniques to extract raw bytes information, which now takes only an average of 160 ms on our hardware using an NVIDIA RTX A6000 GPU to convert binary malware to its corresponding vectorized feature. This advancement makes it possible to employ feature-based methods such as adversarial learning in large-scale datasets.

9.5 Hyper-Parameters and Network Architecture↩︎

In this section, we provide detailed information about the hyper-parameters and network architecture utilized in our experiments. Table ¿tbl:table:hyperparameters? presents the specific parameters employed in PGD to generate adversarial examples, such as \(\alpha\) and \(\varepsilon_{\max}\), as well as the weight \(\gamma\) used to regulate the repulsive force in SVGD.

Regarding the network architecture, we employ the feed-forward neural network (FFNN) architecture provided in SOREL-20M [6] as the baseline for our Bayesian neural network versions. This architecture consists of four fully-connected (FC) layers. It is worth noting that there are no baseline deep neural networks available in the EMBER dataset [8]. Therefore, we utilize the same baseline network architecture presented in Table ¿tbl:tab:sorel95arch? for the EMBER dataset.

width=0.8, center

width=.5, center

9.6 Metrics↩︎

Here, we introduce the metrics commonly used to evaluate malware detectors in the literature in order to quantify experimental results.

• True Positive (TP) indicates the number of predictions where the network correctly predicts the malware samples as malware.

• True Negative (TN) indicates the number of predictions where the network correctly predicts the benign ware as benign ware.

• False Positive (FP) indicates the number of predictions where the network incorrectly predicts the benign ware samples as malware.

• False Negative (FN) indicates the number of predictions where the network incorrectly predicts the malware samples as benign ware.

Accuracy. We compute the overall accuracy of the model, denoted by \(\text{Acc}\), to quantify the proportion of samples that were correctly classified by the classifier: \[\mathrm{Acc} =\frac{\mathrm{TP}+\mathrm{TN}}{\mathrm{TP}+\mathrm{TN}+\mathrm{FP}+\mathrm{FN}}\]

Robustness. This metric, denoted by \(Robustness\), quantifies the accuracy of the model under the threat of adversarial attacks according to the following equation:

\[\mathrm{Robustness} = \mathrm{Acc}(\boldsymbol{x}_{\text{adv}}), \quad \boldsymbol{x}_{\text{adv}}\sim \mathcal{D}_{\text{adv}}\]

Attack success rate. This metric, denoted by \(\text{ASR}\), quantifies the proportion of samples that were incorrectly classified by the classifier according to the following equation: \[\mathrm{ASR}=\frac{\mathrm{FP}+\mathrm{FN}}{\mathrm{TP}+\mathrm{TN}+\mathrm{FP}+\mathrm{FN}}\]

True positive rate (TPR). This metric, also known as Recall or Sensitivity, quantifies the fraction of all malware samples that the classifier correctly predicted as malware according to the following equation:

\[\mathrm{TPR}=\frac{\mathrm{TP}}{(\mathrm{TP}+\mathrm{FN})}\]

False positive rate (FPR). This metric, equivalent to (1-Specificity), where Specificity is the TPR, quantifies the fraction of all benign ware samples that the classifier correctly predicted as benign ware according to the following equation:

\[\label{eq:FPR} \mathrm{FPR}=\frac{\mathrm{FP}}{(\mathrm{FP}+\mathrm{TN})}\tag{5}\]

Receiver Operating Characteristics (ROC) and Area Under the Curve (AUC). All possible combinations of TPR and FPR compose a Receiver Operating Characteristics space, denoted by ROC, with each point in ROC space determined by a pair (TPR, FPR), showing the trade-off between Sensitivity and Specificity. Based on this ROC curve, we can calculate Area Under the Curve (AUC) to evaluate the performance of the detector.

9.7 Adversarial Bayesian Learning Algorithm for Adv-MalBayes↩︎

9.8 The Impact of the Number of Parameter Particles for Capturing the Posterior Distribution↩︎

Here, we investigate the contribution of the number of parameter particles to the robustness of the networks. As shown in Table 3, the robustness of the BNNs is improved when we increase the number of particles from 5 to 10. This is intuitive because increasing the number of parameter particles will help to capture the multi-modal posterior better. Thus, enlarging the number of parameter particles may further improve the network’s robustness.

9.9 Additional Experimental Results↩︎

In this section, we provide additional results to support the statements in the main paper further.

Performance Comparison with MalConv [7].  We remark that training on raw byte sequences (MalConv) is computationally expensive; hence, there is no available MalConv on the large production scale dataset (SOREL-20M) for comparison. In this experiment, we want to highlight that the FFNN and BNN networks that were used in our experiments, whilst being more efficient in scaling up to a large production scale, outperform MalConv. In addition, we also notice that MalConv did not perform well on the adversarial malware as shown in the main paper under Section Robustness (against Problem-Space Adversarial Malware).

We provide, in more detail, the performance comparison of networks on the EMBER test set under no attacks in Table 4. Here, we compared FFNN and BNN networks trained on pre-extracted features with the popular ML-based malware detector built on problem-space samples (MalConv). In particular, we show that a Bayesian neural network built on the feature-space samples achieves better performance compared with MalConv and its recently upgraded version in AAAI’21 (MalConv w/ GCG) [54].

Comparison with [26] Learning Objective for Adversarially Training a BNN. We also compare ours with a previous method for adversarially training a Bayesian neural network [26] and report the results in Table 5 where we show the significantly better performance achieved with our training method.

Comparing Performance of Training Methods under Adversarial Attacks. We also conduct experiments to show the performance of FFNN, BNN, Adv-FFNN, and Adv-MalBayes under feature-space adversarial attacks with increasing attack budgets. The results in Figure 4 shows that, as expected, the adversarial training methods yield improved robustness.

Empirically Demonstrating the Impact of BNN formulation to Bound the Difference Between Adversarial Risk and Empirical Risk.  We conduct the empirical experiment to show the difference between adversarial risk and empirical risk, illustrated in Figure 5. Here, we measure the empirical risk and its adversarial counterpart on the test set of EMBER dataset. We can observe the benefit of hardening a BNN with adversarial examples, which helps to tighten the gap between the adversarial and empirical risks and improve robustness compared with the non-Bayesian method (Adv-FFNN) demonstrating the theoretical bound mentioned in Eq. 4 .

Generalization to Another Software Domain (Android) To demonstrate the generalizability of our approach, we assess the robustness of our proposed method in another software domain, specifically Android malware. We adopt the same methodology and train the corresponding FFNN, BNN, Adv-FFNN, and Adv-MalBayes networks on a widely used Android DREBIN dataset [4]. Given that the feature space of the DREBIN dataset is binary, we utilize the FGSM attack to conduct adversarial learning. The results presented in Table 6 yield a similar observation to that obtained in the Windows PE domain. Our proposed Adv-MalBayes outperforms Adv-FFNN, while other models, such as FFNN, are entirely defeated by adversarial malware examples. Thus, our approach demonstrates generalization across various software domains.

Transferability of Robustneess Against PGD \(L_2\) Attack. In Section Transferability of Robustness in the main paper, we have evaluated the robustness of our proposed method to FGSM attack [10] because most existing attacks [16] adopt from it. This section will further evaluate the transferability of our method on PGD \(L_2\) attacks. Using the based model Adv-MalBayes trained on PGD \(L_\infty\), we conduct PGD \(L_2\) attacks on 10,000 random malware samples, and Table 7 shows that Adv-MalBayes is highly robust and still maintains its robustness against PGD \(L_2\) attacks in the most challenging attack budget we consider.

Robustness Against Partial DOS Header Attack.  In this section, we compare the performance of our proposed Adv-MalBayes approach against another problem-space attack technique, specifically Partial DOS Header Manipulation [60]. We utilize the implementation provided in SecML-malware [61] with a configuration of 200 iterations. To demonstrate the robustness of our approach against this attack, we evaluate it on 1,000 randomly selected real-world malware samples. The results indicate that our proposed method remains completely robust (i.e., unaffected by the problem-space attack), while the robustness of MalConv degrades to only 65%. This finding further confirms the effectiveness of our approach in dealing with actual, functional malicious software.

References↩︎

---

1. Notably, a negligible computation time of 160 ms, on average, is required to derive vectorized features as described in the Appendix.↩︎