Enhancing robustness of deep learning-based malware detection against adversarial attacks

An advanced framework for malware detection using adversarial learning

Co-evolving Adversaries for Online Robust Malware Detection

Adversarial robustness remains a significant challenge in machine-learning malware detection. We propose a co-evolutionary adversarial training framework that integrates gradient-based adversarial attacks with evolutionary controllers to improve robustness. A hybrid Convolutional Neural Network (CNN-MLP) processes spatial and vector-based features, while evolved controllers adaptively guide Projected Gradient Descent (PGD) using gradient statistics, optimizing adversarial effectiveness while respecting feature constraints. This online, co-evolutionary process exposes the classifier to increasingly adaptive attacks. Experimental results demonstrate that the proposed approach enhances adversarial robustness relative to standard training while maintaining clean accuracy, exemplifying a co-evolutionary arms-race framework for realistic, feature-constrained malware detection.

A Survey on Adversarial Deep Learning in Computer Vision

This paper advocates for a forward-thinking approach that balances technical sophistication with human-centric principles, ensuring that adversarial deep learning evolves into a discipline not just of technical defense, but also of trust, transparency, and accountability.

Adversarial Malware Can Be Both Evasive and Deceiving: a Gradient-based Attack Against Prediction and Explainability in Windows PE Malware Detection

In the last years, several gradient-based attacks have been developed to disclose vulnerabilities of deep neural models and strengthen evasion and transferability abilities of adversarial examples created in various domains. In Windows PE malware detection, various gradient-based methods have been recently tested to optimize the editing or injection of adversarial bytes in unused file sections, and create adversarial malicious PE files to evade deep neural models developed for malware detection. On the other hand, gradient information is commonly used in eXplainable AI (XAI) to obtain explanations for opaque decision-making processes of deep neural black-boxes, while Adversarial XAI has recently emerged as an Adversarial Learning field to investigate the security landscape of XAI. In this study, we describe a holistic, gradient-based attack method, named GAME4EXE, formulated to optimize editing of adversarial bytes in the DOS Header and DOS Stub sections of Windows PE malware. The optimization is driven by the dual adversary purpose of generating adversarial malware that evades a target deep neural model, and aligning the explanation of the evading decisions with that of a goodware-like explanation. A preliminary evaluation shows that a gradient-based attack can be effectively formulated in the Windows PE malware domain, to equip the evasion of a deep neural model with the capability to coherently deceive its decision process explainer and harden attack detection.

AdvAttack: Adversarial attack against machine learning-based Android malware detection models

AdvAttack is a novel black-box adversarial attack framework, which specifically targets static feature-based Android malware detection models and introduces a precise perturbation set construction process based on the relationships between sensitive API calls, which ensures high success rates in evading detection while maintaining malware functionality.

Enhanced Robustness in Neural Network Models against Adversarial Attacks and their Performance Analysis

Machine learning models, particularly deep learning architectures, achieve high performance in prediction tasks but remain susceptible to adversarial attacks. This study aims to enhance the robustness of Convolutional Neural Networks (CNNs), Deep Neural Networks (DNNs), and Recurrent Neural Networks (RNNs), thereby improving the security of machine learning systems. A three-step approach is adopted. First, benign sample classification is performed using the MNIST benchmark dataset. Second, adversarial attacks, namely Projected Gradient Descent (PGD), DeepFool (DF), and the Fast Gradient Sign Method (FGSM), are launched on the trained models, resulting in significant performance degradation. Based on the biased outputs induced by adversarial perturbations, an adversarial detection model is subsequently established. Third, to counteract these attacks, various defense strategies, including adversarial training, defensive distillation, autoencoder-based denoising, ensemble methods, and feature squeezing are employed and evaluated using standard performance metrics and graphical analyses. The results indicate that, in the absence of defense mechanisms, PGD attacks lead to accuracy drops of approximately 27% in CNNs, 83% in DNNs, and 90% in RNNs, demonstrating severe model vulnerabilities. However, when defense strategies are applied, all models recover to an accuracy of at least 98.9%, with adversarial training improving performance under attack by up to 90%. Among the evaluated models, CNNs exhibit the highest baseline robustness, whereas DNNs and RNNs rely more heavily on defense mechanisms to maintain performance. These findings provide valuable insights into the development of secure and resilient machine learning systems capable of mitigating adversarial threats.