Package: secml-malware
SecML MalwarePython library for creating adversarial attacks against Windows Malware detectors.
Built on top ofSecML, SecML Malware includes most of the attack proposed in the state of the art.
We include apre-trained MalConvmodel trained by EndGame, used for testing.Included AttacksPartial DOS Header manipulation, formulated byDemetrio et al.Padding attack, formulated byKolosnjaji et al.GAMMA, formulated byDemetrio et al.FGSM padding + slackformulated byKreuk et al.andSuciu et al.Content shifting and DOS header extensionformulated byDemetrio et al.Header Fieldsinspired byNisi et al.InstallationNavigate to the folder where you want to clone the project.
I recommend creating a new environment (I useconda):condacreate-nsecml_malware_envpython=3.9
condaactivatesecml_malware_env
pipinstallsecml-malwareYou also need to installpytorch,find instructions here.
Also, you might neet to installlibmagic as well.Follow these instructionsto install properly libmagic.If you are an Apple Silicon user, please installlightgbmfrom conda:condainstall-cconda-forgelightgbmHow to useActivate your environment, and import thesecml_malwarepackage inside your script:importsecml_malwareprint(secml_malware.__version__)The tests included in this project show how the library can be used for applying the manipulation to the input programs.
There is also anexample Jupyter notebook tutorialthat shows how to build a apply a standard attack.DockerThere is also aDockerfilethat can be used to start a container and test the library without messing with virtual environments!dockerbuild--tagsecml_malware:0.2.5.
dockerrun--rm-itsecml_malware:0.2.5bashThe container is also shipped withipython, for a more interactive experience with this library.CiteIf you use our library, please cite us!@misc{demetrio2021secmlmalware,title={secml-malware: A Python Library for Adversarial Robustness Evaluation of Windows Malware Classifiers},author={Luca Demetrio and Battista Biggio},year={2021},eprint={2104.12848},archivePrefix={arXiv},primaryClass={cs.CR}}Also, depending on the manipulations / formalization you are using, please cite our work:Content shifting and DOS header extension  manipulationsorRAMEn formalization@article{demetrio2021adversarial,title={Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection},author={Luca Demetrio and Scott E. Coull and Battista Biggio and Giovanni Lagorio and Alessandro Armando and Fabio Roli},journal={ACM Transactions on Privacy and Security},year={2021},publisher={ACM}}GAMMA@article{demetrio2021functionality,title={Functionality-preserving black-box optimization of adversarial windows malware},author={Demetrio, Luca and Biggio, Battista and Lagorio, Giovanni and Roli, Fabio and Armando, Alessandro},journal={IEEE Transactions on Information Forensics and Security},year={2021},publisher={IEEE}}Partial DOS manipulation@inproceedings{demetrio2019explaining,title={Explaining Vulnerabilities of Deep Learning to Adversarial Malware Binaries},author={Luca Demetrio and Battista Biggio and Giovanni Lagorio and Fabio Roli and Alessandro Alessandro},booktitle={ITASEC19},volume={2315},year={2019}}Bug reportsIf you encounter something strange, feel free to open an issue! I am working a lot, and bugs are present everywhere.
Let me know, and I'll try to fix them as soon as possible.TestingI provide a small test suite for the attacks I have developed inside the plugin.
If you want to run them,ADD GOODWARE/MALWARE samples!There are two distinct folders:secml_malware/data/goodware_samples
secml_malware/data/malware_samples/test_folderPlease, add samples to both folders (if and only ifyou want to run the internal tests).