攻击者通过微小修改让恶意软件逃避检测，且难以被发现。
Gray-Box Poisoning of Continuous Malware Ingestion Pipelines
- 用IAT和段注入生成伪装恶意样本，隐蔽性强。
- 少量污染样本使检测召回率显著下降，攻击有效。
- 集成防御可过滤95.6%攻击样本，适合生产环境使用。
现代恶意软件检测系统依赖持续数据摄入与机器学习应对海量新型威胁。本文研究一种现实的灰盒投毒攻击模型，利用secml_malware框架，通过功能保持型修改生成对抗性二进制文件，具体为导入地址表（IAT）和节段注入。将这些污染样本引入轻量级梯度提升机（LightGBM）模型的训练集后，实验表明微小的IAT扰动即可产生高效、紧凑的投毒样本，显著降低检测召回率。结果揭示了在持续学习系统中实现低可见性但高有效性对抗扰动的内在挑战。进一步评估基于同质集成的防御机制，可在保留合法数据高比例的同时，成功识别并过滤高达95.6%的投毒尝试。研究强调了生产环境中进行强预摄入验证的重要性。
原文摘要 · Abstract (English)
Modern malware detection pipelines rely on continuous data ingestion and machine learning to counter the high volume of novel threats. This work investigates a realistic gray-box poisoning threat model targeting these pipelines. Using the secml_malware framework, we generate problem-space adversarial binaries through functionality-preserving manipulations, specifically Import Address Table (IAT) and section injections. We evaluate the impact of these poisoned samples when ingested into a defender's training set for a LightGBM malware detection model. Our empirical results demonstrate that subtle IAT-based perturbations enable compact poisoning samples that significantly degrade detection recall. These findings illustrate the inherent challenge of developing low-visibility adversarial perturbations that maintain high poisoning efficacy within continuous learning systems. We further evaluate a defense mechanism based on a homogeneous ensemble, which successfully identifies and filters up to 95.6% of poisoning attempts while maintaining a high retention rate for legitimate data. These findings emphasize the necessity of robust pre-ingestion validation in production pipelines.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。