From Blue-Sky to Practical Adversarial Learning

The state-of-the-art of adversarial machine learning on malware detection systems generally yield unexecutable samples. In this work, we make the case for understanding the robustness of visualization-based malware detection system against adversarial examples (AEs) that not only are able to fool models, but also maintain the executability of the original input. To motivate for our vision, we first investigate the application of existing off-the-shelf adversarial attack approaches on malware detection systems through which we found that those approaches do not necessarily maintain the functionality of the original inputs. Then, we discuss an approach for achieving a high misclassification rate and maintaining the executability and functionality of the original input. We use visualization-based malware detection as an example to highlight the gap between blue-sky research that focuses on aspect of the learning process, and call for more practical techniques that respect the semantics of the underlying applications.