This is a plugin for the SecML Python library. There is a pre-trained MalConv model trained by EndGame, included in this project for testing.
- Partial DOS Header manipulation, formulated by Demetrio et al.
- Padding attack, formulated by Kolosnjaji et al.
- GAMMA, formulated by Demetrio et al.
- FGSM padding + slack formulated by Kreuk et al. and Suciu et al.
- Content shifting and DOS header extension formulated by Demetrio et al.
Navigate to the folder where you want to clone the project.
I recommend creating a new environment (I use conda
):
conda create -n secml_malware_env python=3.8
conda activate secml_malware_env
pip install secml-malware
You also need to install pytorch
, find instructions here.
If you encouter problem due to libmagic, follow this instruction.
If, for some reason, the installation through pip does not work, install pytorch
as described before, then:
git clone https://github.com/zangobot/secml_malware.git
cd secml_malware
pip install -r requirements.txt
Activate your environment, and import the secml_malware
package inside your script:
import secml_malware
print(secml_malware.__version__)
The tests included in this project show how the library can be used for applying the manipulation to the input programs. There is also an example Jupyter notebook tutorial that shows how to build a apply a standard attack.
There is also a Dockerfile
that can be used to start a container and test the library without messing with virtual environments!
docker build --tag secml_malware:0.2 .
docker run --rm -it secml_malware:0.2 bash
The container is also shipped with ipython
, for a more interactive experience with this library.
Depending on the manipulations / formalization you are using, please cite our work:
Content shifting and DOS header extension manipulations or RAMEn formalization
@article{demetrio2020adversarial,
title={Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection},
author={Luca Demetrio and Scott E. Coull and Battista Biggio and Giovanni Lagorio and Alessandro Armando and Fabio Roli},
year={2020},
eprint={2008.07125},
archivePrefix={arXiv},
primaryClass={cs.CR}
}
GAMMA
@misc{demetrio2021functionalitypreserving,
title={Functionality-preserving Black-box Optimization of Adversarial Windows Malware},
author={Luca Demetrio and Battista Biggio and Giovanni Lagorio and Fabio Roli and Alessandro Armando},
year={2021},
eprint={2003.13526},
archivePrefix={arXiv},
primaryClass={cs.CR}
}
Partial DOS manipulation
@inproceedings{demetrio2019explaining,
title={Explaining Vulnerabilities of Deep Learning to Adversarial Malware Binaries},
author={Luca Demetrio and Battista Biggio and Giovanni Lagorio and Fabio Roli and Alessandro Alessandro},
booktitle={ITASEC19},
volume={2315},
year={2019}
}
If you encounter something strange, feel free to open an issue! I am working a lot, and bugs are present everywhere. Let me know, and I'll try to fix them as soon as possible.
I provide a small test suite for the attacks I have developed inside the plugin. If you want to run them, ADD GOODWARE/MALWARE samples! There are two distinct folders:
secml_malware/data/goodware_samples
secml_malware/data/malware_samples/test_folder
Please, add samples to both folders (if and only if you want to run the internal tests).