通过特征消融与噪声注入，实现恶意软件检测的可证明鲁棒性。
Towards Certified Malware Detection: Provable Guarantees Against Evasion Attacks
- 基于特征消融和噪声注入的随机平滑方法
- 在PyMetaEngine生成的变体上保持高准确率且提供鲁棒性证明
- 适用于需要可信安全检测的工业级防护场景
基于机器学习的静态恶意软件检测器仍易受变形引擎变异等对抗性逃避攻击影响。为此，我们提出一种基于特征消融与目标噪声注入的随机平滑框架，实现可证明鲁棒的恶意软件检测。评估时，系统通过生成多个消融变体，利用平滑分类器进行分类，并基于多数投票确定最终标签。通过分析最高类别投票分布及威尔逊置信区间，推导出针对特征空间扰动的正式证书，保证在特定半径内的鲁棒性。我们在干净可执行文件及PyMetaEngine生成的消融变体上对比了基础分类器与平滑分类器性能。结果表明，所提平滑分类器无需修改底层架构，即可有效抵御变形攻击并提供可证明的鲁棒性。
原文摘要 · Abstract (English)
Machine learning-based static malware detectors remain vulnerable to adversarial evasion techniques, such as metamorphic engine mutations. To address this vulnerability, we propose a certifiably robust malware detection framework based on randomized smoothing through feature ablation and targeted noise injection. During evaluation, our system analyzes an executable by generating multiple ablated variants, classifies them by using a smoothed classifier, and identifies the final label based on the majority vote. By analyzing the top-class voting distribution and the Wilson score interval, we derive a formal certificate that guarantees robustness within a specific radius against feature-space perturbations. We evaluate our approach by comparing the performance of the base classifier and the smoothed classifier on both clean executables and ablated variants generated using PyMetaEngine. Our results demonstrate that the proposed smoothed classifier successfully provides certifiable robustness against metamorphic evasion attacks without requiring modifications to the underlying machine learning architecture.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。