Adversarial Malware Generation in Linux ELF Binaries via Semantic-Preserving Transformations
TLDR
A new adversarial malware generator for Linux ELF binaries achieves 67.74% evasion against MalConv using semantic-preserving transformations.
Key contributions
- Developed a novel adversarial malware generator specifically for Linux ELF binaries.
- Achieved a 67.74% evasion rate against the MalConv detector, reducing its confidence by -0.50.
- Identified that using benign-like strings as data sources was the most effective modification.
- Showed that the target classifier (MalConv) is highly sensitive to string content anywhere in the executable.
Why it matters
This paper addresses a critical gap in adversarial machine learning research by focusing on Linux ELF malware, a less-explored area compared to Windows PE. It provides a practical tool and insights into vulnerabilities of ML-based malware detectors, highlighting string sensitivity. This work is crucial for developing more robust defense mechanisms.
Original Abstract
Malware development and detection have undergone significant changes in recent years as modern concepts, such as machine learning, have been used for both adversarial attacks and defense. Despite intensive research on Windows Portable Executable (PE) files, there is minimal work on Linux Executable and Linkable Format (ELF). In this work, we summarize the academic papers submitted in this field and develop a new adversarial malware generator for the ELF format. Using a variety of metrics, we thoroughly evaluated our generator and achieved an Evasion Rate of 67.74 % while changing the confidence of the malware detector by -0.50 in the mean case for the dataset used. In our approach, we chose MalConv as the target classifier. Using this classifier, we found that the most successful modifications used strings typical of benign files as a data source. We conducted a variety of experiments and concluded that the target classifier appears sensitive to strings at any location within the executable file.
📬 Weekly AI Paper Digest
Get the top 10 AI/ML arXiv papers from the week — summarized, scored, and delivered to your inbox every Monday.