Adversarial Training is a proven defense strategy against adversarial
malware. However, generating adversarial malware samples for this type of
training presents a challenge because the resulting adversarial malware needs
to remain evasive and functional. This work proposes an attack framework, EGAN,
to address this limitation. EGAN leverages an Evolution Strategy and Generative
Adversarial Network to select a sequence of attack actions that can mutate a
Ransomware file while preserving its original functionality. We tested this
framework on popular AI-powered commercial antivirus systems listed on
VirusTotal and demonstrated that our framework is capable of bypassing the
majority of these systems. Moreover, we evaluated whether the EGAN attack
framework can evade other commercial non-AI antivirus solutions. Our results
indicate that the adversarial ransomware generated can increase the probability
of evading some of them.

提出了一种名为 EGAN 的攻击框架，该框架利用进化策略和生成对抗网络选择攻击动作序列，以改变勒索软件文件的行为，从而绕过大部分 AI 型商业杀毒系统，并增加了绕过其他商业非 AI 型杀毒解决方案的概率。

EGAN: 恶意软件免疫进化型 GAN

EGAN: Evolutional GAN for Ransomware Evasion

We consider the problem of generating adversarial malware by a cyber-attacker
where the attacker's task is to strategically modify certain bytes within
existing binary malware files, so that the modified files are able to evade a
malware detector such as machine learning-based malware classifier. We have
evaluated three recent adversarial malware generation techniques using binary
malware samples drawn from a single, publicly available malware data set and
compared their performances for evading a machine-learning based malware
classifier called MalConv. Our results show that among the compared techniques,
the most effective technique is the one that strategically modifies bytes in a
binary's header. We conclude by discussing the lessons learned and future
research directions on the topic of adversarial malware generation.

研究如何生成具有对抗性的恶意软件，通过改变二进制恶意软件文件中的特定字节，使修改后的文件能够逃避基于机器学习的恶意软件分类器的检测，其中通过修改二进制文件头的字节是最有效的技术。

生成对抗性恶意二进制文件的先进技术比较

A Comparison of State-of-the-Art Techniques for Generating Adversarial  Malware Binaries

Machine-learning methods have already been exploited as useful tools for
detecting malicious executable files. They leverage data retrieved from malware
samples, such as header fields, instruction sequences, or even raw bytes, to
learn models that discriminate between benign and malicious software. However,
it has also been shown that machine learning and deep neural networks can be
fooled by evasion attacks (also referred to as adversarial examples), i.e.,
small changes to the input data that cause misclassification at test time. In
this work, we investigate the vulnerability of malware detection methods that
use deep networks to learn from raw bytes. We propose a gradient-based attack
that is capable of evading a recently-proposed deep network suited to this
purpose by only changing few specific bytes at the end of each malware sample,
while preserving its intrusive functionality. Promising results show that our
adversarial malware binaries evade the targeted network with high probability,
even though less than 1% of their bytes are modified.

本文通过对恶意软件检测方法的深度学习进行的攻击实验证明，机器学习以及深度神经网络存在易受攻击的漏洞，并提出基于梯度的攻击方法，可以使恶意软件逃脱检测而不影响其入侵功能。