信息网络安全 ›› 2024, Vol. 24 ›› Issue (4): 640-649.doi: 10.3969/j.issn.1671-1122.2024.04.013

• 技术研究 • 上一篇    下一篇

基于特征恶意度排序的恶意软件对抗防御模型

徐子荣, 郭焱平, 闫巧()   

  1. 深圳大学计算机与软件学院,深圳 518060
  • 收稿日期:2023-11-14 出版日期:2024-04-10 发布日期:2024-05-16
  • 通讯作者: 闫巧 yanq@szu.edu.cn
  • 作者简介:徐子荣(1999—),男,广东,硕士研究生,主要研究方向为对抗样本攻击|郭焱平(1996—),男,湖南,硕士研究生,主要研究方向为入侵检测|闫巧(1972—),女,广西,教授,博士,CCF会员,主要研究方向为网络安全和人工智能
  • 基金资助:
    国家自然科学基金(61976142);深圳市科技计划(JCYJ20210324093609025)

Malicious Software Adversarial Defense Model Based on Feature Severity Ranking

XU Zirong, GUO Yanping, YAN Qiao()   

  1. College of Computer Science and Software Engineering, Shenzhen University, Shenzhen 518060, China
  • Received:2023-11-14 Online:2024-04-10 Published:2024-05-16

摘要:

深度学习模型应用于安卓恶意软件检测可以使检测的准确率不断提升,但对抗样本可以轻易规避深度学习模型的检测,导致深度学习模型的检测能力受到质疑。对于安卓恶意软件的对抗攻击,现阶段多采用对抗训练方法进行防御,文章针对对抗训练在面对多类型对抗样本时表现较差的问题,提出特征恶意度的概念。特征恶意度通过计算特征的恶意程度对特征进行排序,利用排序后的特征构建一个具有对抗防御能力的恶意软件对抗防御模型FMP(Feature Maliciousness Processing),该模型可以提取待检测软件的高恶意度特征进行检测,避免出现对抗扰动导致的模型错误分类问题。在开源数据集DefenceDroid上,相比于对抗训练方法和其他特征选择方法,FMP模型所采用的特征选择方法有效提高了对各类对抗样本的检测率,在多种对抗样本的攻击下具有较好的鲁棒性。

关键词: 安卓恶意软件, 对抗样本, 特征选择, 深度学习

Abstract:

The application of deep learning models in the detection of Android malware can continuously improved the accuracy of detection. However, with the proposal of adversarial examples, these examples can easily evade detection by deep learning models, leading to questions about the detection capabilities of deep learning models. To counteract adversarial attacks on Android malicious software, current approaches often employ adversarial training for defense. This paper addressed the limitation of adversarial training in dealing with various types of adversarial examples and proposed the concept of feature maliciousness. Feature maliciousness involved ranking features based on their malicious nature, and this ranked feature set was utilized to construct a malicious software adversarial defense model with adversarial defense capabilities, termed the feature maliciousness processing (FMP) detector. This model extracted high-maliciousness features from the software under consideration, mitigating the problem of model misclassification caused by adversarial perturbations. On the open-source dataset DefenceDroid, the feature selection method employed by the FMP detector significantly enhances the detection rates for various types of adversarial examples compared to adversarial training and other feature selection methods. Under multiple adversarial example attacks, the FMP detector demonstrats the highest level of robust performance.

Key words: Android malicious software, adversarial example, feature selection, deep learning

中图分类号: