【作者】 吴睿；

【导师】 丁宇新；

【作者基本信息】 哈尔滨工业大学 ， 计算机技术（专业学位）， 2020， 硕士

【摘要】 随着人工智能在图像和自然语言处理领域的成功,研究人员逐步将机器学习技术应用于恶意代码检测领域,并取得了较好的成果。然而从2006年开始针对机器学习模型测试数据的“投毒”到2014年对抗样本的提出,越来越多的研究人员对机器学习模型的安全性产生了担忧。目前防御对抗样本较为有效的方式是通过多种对抗样本与原始样本组合对模型进行训练,这种防御方式被称为对抗训练,可以发现对抗样本不但可以作为攻击模型的一种手段,同时也能够成为提高模型鲁棒性的一种渠道。在利用深度学习技术检测恶意代码中,研究者们利用恶意代码尾部的空隙并结合损失最大化对原始样本进行扰动生成对抗样本,但是这种方法受到样本大小的限制,并且生成对抗样本所耗费的时间较长。如何减少恶意代码检测领域的对抗样本生成成本,以及如何选取合适的对抗样本,这对于模型防御攻击以及提高鲁棒性有着重要的意义。本文针对可执行文件特点,模型的可解释性以及现存的对抗样本生成算法的缺陷,提出了针对黑盒场景和白盒场景下的对抗样本生成算法。本文首先通过找到可执行文件的冗余空间,定位了新的干扰值添加位置,并通过对快速梯度符号方法中加入了一阶矩估计和二阶矩估计来解决单步攻击和迭代攻击存在的耦合问题。在白盒场景下本文通过计算模型对良性样本的判别特征作为扰动值,并对可执行文件添加新的区块作为扰动值添加的位置。本文还分析了加壳样本对模型的影响,使用压缩和加密两种不同的方法对样本进行加壳,发现两种加壳样本均在不同程度下降低了模型的精度。本文最后从L2范数和判别特征两个方面选了择合适的对抗样本,并结合加壳样本和鲁棒性特征样本,来提升模型的鲁棒性。本文在未加壳数据集上,对所提出的两种场景下的对抗样本生成算法进行了验证,主要从对抗样本生成的成功率、时间以及与对抗样本扰动值的L2范数展开,上述两种算法均不再受到样本大小的限制,并且在黑盒和白盒场景下的对抗样本生成算法都能够有效提高对抗样本攻击成功率。本文还在加壳数据集上,验证了模型的精度。最后对比了多种不同的对抗样本和加壳样本对目标模型对抗训练后,并实验观察目标模型精度和鲁棒性的变化,证明了本文针对目标模型的防御方法对提升目标模型鲁棒性的有效性。更多还原

【Abstract】 With the success of artificial intelligence in the field of image and n atural language processing,researchers have gradually applied machine learning technology to the field of malware detection and have achieved good results.However,from 2006 on the “intoxication” of machine learning model test data to the 2014 adversarial examples,more and more researchers have worried about the safety of machine learning models.The most effective defense against the adversarial examples is to train the model through a combination of multiple adversarial examples and the original sample.This type of defense is called adversarial training.It can be found that the adversarial examples can be used as a means of attacking the model,but also it can also be a channel to improve the robustness of the model against attack.In detecting malware using deep learning technology,the researchers used the gaps in the tail of the malicious code and combined the loss maximization to perturb the original examples to generate adversarial examples,but this method is limited by the size of the sample and takes a long time to generate.How to reduce the cost of adversarial examples generation in the field of malware detection,and how to generate more different kinds of adversarial examples is of great significance to the model to improve its robustness to defend attack.In view of the characteristics of the PE file,the interpretability of the model and the shortcomings of the existing adversarial example generation algorithms,this paper proposes the adversarial examples generation algorithm for the black-box scene and the white-box scene.This paper first locates the new interference value addition location by finding the redundant space of the executable file,and first-order moment estimation and second-order moment estimation are added to the fast gradient sign method to solve the coupling problem between single-step and iterative attacks.In the white-box scenario,the discriminative features of the benign examples are calculated by the model as the disturbance value,and a new block is added to the executable file as the position where the disturbance value is added.This paper also analyzes the influence of the packed examples on the model,and uses two different methods of compression and encryption to pack the examples.It is found that the two packed examples reduce the accuracy of the model to different degrees.In the end,this paper chooses the appropriate adversarial examples from the two aspects of L2 norm and discriminant features,and combines the packed examples and the robust feature examples to improve the model’s robustness to against attack.This paper validates the proposed adversarial example generation algorithms on two unpacked datasets,mainly from the success rate,time,and L 2 norm of the perturbation values of the adversarial examples.These algorithms are no longer limited by the example size,and the adversarial example generation algorithms in both black and white box scenarios can effectively improve the success rate of adversarial example attacks.This paper also validates the accuracy of the model on the packed data set.Finally,after comparing a variety of different adversarial samples and packed samples against the target model,and experimentally observed the changes in the accuracy and robustness of the target model.It proves the effectiveness of this paper’s defense method against the target model to improve the robustness of the target model.更多还原