Skip to main content

Framework for Adversarial Malware Evaluation

Project description

Welcome to the FAMEwork for Adversarial Malware Evaluation

FAME has been designed to evaluate ML-based malware classifiers against adversarial examples. It aims to provide understanding on how byte-level transformations can be injected into Windows Portable Executable (PE) files and compromise models. Moreover, it supports integrity verification to ensure that the adversarial examples remain valid after manipulation. This work implements the action space proposed on the OpenAI gym malware environment. It has been implemented and tested using Fedora 30 and Ubuntu 16 with Python3. Library versions are defined in the requirements.txt file.

The framework consists of the following modules: ARMED, AIMED / AIMED-RL & GAME-UP.

GAME-UP: Generating Adversarial Malware Examples with Universal Perturbations

This module intends to analyze how Universal Adversarial Perturbations (UAPs) can be useful to create efficient adversarial examples compared to input-specific attacks. It explores how real malware examples in the problem-space affect the feature-space of classifiers to identify systematic weaknesses. Also, it implements a variant of adversarial training to improve the resilience of static ML-based malware classifiers for Windows PE binaries.

AIMED: Automatic Intelligent Modifications to Evade Detection

This approach focus on understanding how sensitive static malware classifiers are to adversarial examples. It uses different techniques including Genetic Programming (GP) and Reinforcement Learning (RL) to inject perturbations to Windows PE malware without compromising its functionality, keeping the frehsly generated adversarial example valid.

ARMED: Automatic Random Modifications to Evade Detection

With this option sequences of transformations are chosen randomly to identify weakspots in the classifier. This module implements a pipeline that is able to automatically generate realizable adversarial examples in the malware context.

How to run FAME

Install FAME:

$ pip install famework

Run FAME with any module (e.g., AIMED):

$ fame aimed

Here we describe how to run FAME by installing directly the package. For more detail about running from source and manual configuration of parameters refer to the install instructions.

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

FAMEwork-0.1.5.tar.gz (2.1 MB view hashes)

Uploaded source

Built Distribution

FAMEwork-0.1.5-py3-none-any.whl (2.1 MB view hashes)

Uploaded py3

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page