An adversary who aims to steal a black-box model repeatedly queries the model
via a prediction API to learn a function that approximates its decision
boundary. Adversarial approximation is non-trivial because of the enormous
combinations of model architectures, parameters, and features to explore. In
this context, the adversary resorts to a best-effort strategy that yields the
closest approximation. This paper explores best-effort adversarial
approximation of a black-box malware classifier in the most challenging
setting, where the adversary's knowledge is limited to a prediction label for a
given input. Beginning with a limited input set for the black-box classifier,
we leverage feature representation mapping and cross-domain transferability to
approximate a black-box malware classifier by locally training a substitute.
Our approach approximates the target model with different feature types for the
target and the substitute model while also using non-overlapping data for
training the target, training the substitute, and the comparison of the two. We
evaluate the effectiveness of our approach against two black-box classifiers
trained on Windows Portable Executables (PEs). Against a Convolutional Neural
Network (CNN) trained on raw byte sequences of PEs, our approach achieves a 92%
accurate substitute (trained on pixel representations of PEs), and nearly 90%
prediction agreement between the target and the substitute model. Against a
97.8% accurate gradient boosted decision tree trained on static PE features,
our 91% accurate substitute agrees with the black-box on 90% of predictions,
suggesting the strength of our purely black-box approximation.

本文提出了一种在黑盒恶意软件分类器上近似模型的最佳努力对抗逼近策略，使用特征表示映射和跨领域可转移性，通过局部训练替代模型，使用不同特征类型进行目标模型的逼近，本方法对两种黑盒分类器进行了评估。

黑盒恶意软件分类器的最佳努力对抗逼近

Best-Effort Adversarial Approximation of Black-Box Malware Classifiers

Regularized autoencoders learn the latent codes, a structure with the
regularization under the distribution, which enables them the capability to
infer the latent codes given observations and generate new samples given the
codes. However, they are sometimes ambiguous as they tend to produce
reconstructions that are not necessarily faithful reproduction of the inputs.
The main reason is to enforce the learned latent code distribution to match a
prior distribution while the true distribution remains unknown. To improve the
reconstruction quality and learn the latent space a manifold structure, this
work present a novel approach using the adversarially approximated autoencoder
(AAAE) to investigate the latent codes with adversarial approximation. Instead
of regularizing the latent codes by penalizing on the distance between the
distributions of the model and the target, AAAE learns the autoencoder flexibly
and approximates the latent space with a simpler generator. The ratio is
estimated using generative adversarial network (GAN) to enforce the similarity
of the distributions. Additionally, the image space is regularized with an
additional adversarial regularizer. The proposed approach unifies two deep
generative models for both latent space inference and diverse generation. The
learning scheme is realized without regularization on the latent codes, which
also encourages faithful reconstruction. Extensive validation experiments on
four real-world datasets demonstrate the superior performance of AAAE. In
comparison to the state-of-the-art approaches, AAAE generates samples with
better quality and shares the properties of regularized autoencoder with a nice
latent manifold structure.

本文提出了一种新方法，即采用对抗逼近自动编码器（AAAE）来研究具有对抗逼近的潜在代码，从而提高重建质量并学习具有流形结构的潜在空间，同时不需要对潜在代码进行正则化。