Windows malware detectors based on machine learning are vulnerable to
adversarial examples, even if the attacker is only given black-box query access
to the model. The main drawback of these attacks is that: (i) they are
query-inefficient, as they rely on iteratively applying random transformations
to the input malware; and (ii) they may also require executing the adversarial
malware in a sandbox at each iteration of the optimization process, to ensure
that its intrusive functionality is preserved. In this paper, we overcome these
issues by presenting a novel family of black-box attacks that are both
query-efficient and functionality-preserving, as they rely on the injection of
benign content - which will never be executed - either at the end of the
malicious file, or within some newly-created sections. Our attacks are
formalized as a constrained minimization problem which also enables optimizing
the trade-off between the probability of evading detection and the size of the
injected payload. We empirically investigate this trade-off on two popular
static Windows malware detectors, and show that our black-box attacks can
bypass them with only few queries and small payloads, even when they only
return the predicted labels. We also evaluate whether our attacks transfer to
other commercial antivirus solutions, and surprisingly find that they can
evade, on average, more than 12 commercial antivirus engines. We conclude by
discussing the limitations of our approach, and its possible future extensions
to target malware classifiers based on dynamic analysis.

本文介绍了一种基于注入良性内容的黑盒攻击方法，通过优化注入负载与规避检测的概率之间的权衡，利用很少的查询和小的负载，我们的黑盒攻击可以绕过两个流行的静态 Windows 恶意软件检测器，并且可以在平均 12 个标准的商业杀软中规避检测。