针对Linux ELF恶意软件，提出语义保持的对抗生成方法。
Adversarial Malware Generation in Linux ELF Binaries via Semantic-Preserving Transformations
- 基于语义不变变换生成对抗性ELF恶意代码
- 在目标检测器上实现67.74%逃逸率，置信度下降0.50
- 发现字符串位置敏感，良性文件字符串最有效
近年来，随着机器学习在攻防两端的应用，恶意软件开发与检测发生了显著变化。尽管对Windows PE文件的研究已较深入，但针对Linux可执行链接格式（ELF）的研究仍较少。本文综述该领域相关论文，并提出一种新型对抗性恶意软件生成器。通过多种指标评估，该生成器在所用数据集上实现了67.74%的逃逸率，同时使恶意检测器平均置信度下降0.50。实验以MalConv为目标分类器，发现最有效的修改是使用典型良性文件中的字符串作为数据源。进一步实验表明，目标分类器对可执行文件中任意位置的字符串均表现出敏感性。
原文摘要 · Abstract (English)
Malware development and detection have undergone significant changes in recent years as modern concepts, such as machine learning, have been used for both adversarial attacks and defense. Despite intensive research on Windows Portable Executable (PE) files, there is minimal work on Linux Executable and Linkable Format (ELF). In this work, we summarize the academic papers submitted in this field and develop a new adversarial malware generator for the ELF format. Using a variety of metrics, we thoroughly evaluated our generator and achieved an Evasion Rate of 67.74 % while changing the confidence of the malware detector by -0.50 in the mean case for the dataset used. In our approach, we chose MalConv as the target classifier. Using this classifier, we found that the most successful modifications used strings typical of benign files as a data source. We conducted a variety of experiments and concluded that the target classifier appears sensitive to strings at any location within the executable file.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。