The widespread adoption of machine and deep learning techniques for Android malware detection has driven attackers to develop sophisticated evasion strategies, particularly using Generative Adversarial Networks (GANs). This study evaluates the robustness of popular ML-based classifiers against adversarial Android malware samples generated by a GAN. The experiments are conducted under two configurations—overlapped vs. isolated datasets—to analyze the impact of shared versus separate training data between the classifiers and the GAN. Results indicate that classifiers experience a significant decline in performance when adversarial samples are introduced without explicit exposure during training, with misclassification rates reaching 100% on test sets. However, retraining the classifiers with a mix of adversarial samples and a subset of unmodified malware significantly improves resilience, consistently achieving over 95% accuracy for both original and adversarial malware. Additionally, implementing a multi-class classification approach (benign vs. original vs. adversarial) enables models to effectively detect manipulated samples, resulting in high adversarial sample detection rates.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Behind Enemy Lines: Strengthening Android Malware Detection with Adversarial Training

  • Sonia Laudanna,
  • Mattia Marino,
  • Andrea Di Sorbo,
  • P. Vinod,
  • Corrado Aaron Visaggio,
  • Gerardo Canfora

摘要

The widespread adoption of machine and deep learning techniques for Android malware detection has driven attackers to develop sophisticated evasion strategies, particularly using Generative Adversarial Networks (GANs). This study evaluates the robustness of popular ML-based classifiers against adversarial Android malware samples generated by a GAN. The experiments are conducted under two configurations—overlapped vs. isolated datasets—to analyze the impact of shared versus separate training data between the classifiers and the GAN. Results indicate that classifiers experience a significant decline in performance when adversarial samples are introduced without explicit exposure during training, with misclassification rates reaching 100% on test sets. However, retraining the classifiers with a mix of adversarial samples and a subset of unmodified malware significantly improves resilience, consistently achieving over 95% accuracy for both original and adversarial malware. Additionally, implementing a multi-class classification approach (benign vs. original vs. adversarial) enables models to effectively detect manipulated samples, resulting in high adversarial sample detection rates.