Evading API Call Sequence Based Malware Classifiers

摘要: In this paper, we present a mimicry attack to transform malware binary, which can evade detection by API call sequence based classifiers. While original was detectable classifiers, transformed malware, when run, with modified without compromising the payload of original, is effectively able avoid detection. Our model effective against large set classifiers includes linear models such as Random Forest (RF), Decision Tree (DT) and XGBoost fully connected NNs, CNNs RNNs its variants. implementation easy use (i.e., transformation only requires running couple commands) generic works for any requiring specific changes). We also show that adversarial retraining make robust evasion attacks.