标题： 评估生产恶意软件检测系统对可迁移对抗攻击的鲁棒性 显示英文标题

标题： Evaluating the Robustness of a Production Malware Detection System to Transferable Adversarial Attacks

摘要： 随着深度学习模型被广泛部署为更大生产系统中的组件，它们的个别缺陷可能会造成具有现实影响的系统级漏洞。 本文研究了针对机器学习组件的对抗性攻击如何降级或绕过整个生产级别的恶意软件检测系统，并对Gmail的处理流程进行了案例分析，其中文件类型识别依赖于一个机器学习模型。 Gmail当前使用的恶意软件检测流程包含一个机器学习模型，该模型将每个潜在的恶意软件样本路由到专门的恶意软件分类器以提高准确性和性能。 该模型称为Magika，已经开源。 通过设计可以欺骗Magika的对抗性示例，我们可以导致生产环境中的恶意软件服务将恶意软件错误地路由到不合适的恶意软件检测器，从而增加我们逃避检测的机会。 具体而言，通过仅更改恶意软件样本中的13个字节，我们可以在90%的情况下成功逃避Magika，从而使我们能够通过Gmail发送恶意软件文件。 随后，我们将注意力转向防御措施，并开发了一种方法来减轻此类攻击的严重性。 对于经过防御的生产模型，一个资源丰富的攻击者需要50个字节才能实现仅20%的攻击成功率。 我们实现了这种防御，并且由于与Google工程师的合作，它已经部署在Gmail分类器的生产环境中。 显示英文摘要

摘要： As deep learning models become widely deployed as components within larger production systems, their individual shortcomings can create system-level vulnerabilities with real-world impact. This paper studies how adversarial attacks targeting an ML component can degrade or bypass an entire production-grade malware detection system, performing a case study analysis of Gmail's pipeline where file-type identification relies on a ML model. The malware detection pipeline in use by Gmail contains a machine learning model that routes each potential malware sample to a specialized malware classifier to improve accuracy and performance. This model, called Magika, has been open sourced. By designing adversarial examples that fool Magika, we can cause the production malware service to incorrectly route malware to an unsuitable malware detector thereby increasing our chance of evading detection. Specifically, by changing just 13 bytes of a malware sample, we can successfully evade Magika in 90% of cases and thereby allow us to send malware files over Gmail. We then turn our attention to defenses, and develop an approach to mitigate the severity of these types of attacks. For our defended production model, a highly resourced adversary requires 50 bytes to achieve just a 20% attack success rate. We implement this defense, and, thanks to a collaboration with Google engineers, it has already been deployed in production for the Gmail classifier.