DRSM: De-Randomized Smoothing on Malware Classifier Providing Certified Robustness
Authors: Shoumik Saha
Wenxiao Wang
Yigitcan Kaya
Soheil Feizi
Tudor Dumitras
Venue: ICLR 2024 poster (2024)
Keywords: machine learning
adversarial
malware
smoothing
robustness
defense
attack
Primary area: general machine learning (i.e., none of the above)
TL;DR: We proposed a framework to make the ML-based malware detection model more robust

Abstract: Machine Learning (ML) models have been utilized for malware detection for over two decades. Consequently, this ignited an ongoing arms race between malware authors and antivirus systems, compelling researchers to propose defenses for malware-detection models against evasion attacks. However, most if not all existing defenses against evasion attacks suffer from sizable performance degradation and/or can defend against only specific attacks, which makes them less practical in real-world settings. In this work, we develop a certified defense, DRSM (De-Randomized Smoothed MalConv), by redesigning the *de-randomized smoothing* technique for the domain of malware detection. Specifically, we propose a *window ablation* scheme to provably limit the impact of adversarial bytes while maximally preserving local structures of the executables. After showing how DRSM is theoretically robust against attacks with contiguous adversarial bytes, we verify its performance and certified robustness experimentally, where we observe only marginal accuracy drops as the cost of robustness. To our knowledge, we are the first to offer certified robustness in the realm of static detection of malware executables. More surprisingly, through evaluating DRSM against $9$ empirical attacks of different types, we observe that the proposed defense is empirically robust to some extent against a diverse set of attacks, some of which even fall out of the scope of its original threat model. In addition, we collected $15.5K$ recent benign raw executables from diverse sources, which will be made public as a dataset called PACE (Publicly Accessible Collection(s) of Executables) to alleviate the scarcity of publicly available benign datasets for studying malware detection and provide future research with more representative data of the time. Our code and dataset are available at - https://github.com/ShoumikSaha/DRSM

Published as a conference paper at ICLR 2024
DRSM: DE-RANDOMIZED SMOOTHING ON MALWARE CLASSIFIER PROVIDING CERTIFIED ROBUSTNESS
Shoumik Saha, Wenxiao Wang, Yigitean Kaya, Soheil Feizi & Tudor Dumitras (amksaha, wwx, cankaya, sfeizi, tudor @umd. edu Department of Computer Science University of Maryland- College Park
ABSTRACT
Machine Learning (ML) models have been utilized for malware detection for over decades. Consequently, this ignited ongoing arms between malware authors and antivirus systems, compelling researchers to propose defenses for malware-detection models against evasion attacks. However, most if not all exist- ing defenses against evasion attacks suffer from sizable performance degradation and/or can defend against only specific attacks, which makes them less practical in real-world settings. In this work, we develop a certified defense, DRSM (De- Randomized Smoothed MalConv), by redesigning the de- re-adonoizedd smoothing technique for the domain of malware detection. Specifically, dow ablation scheme to provably limit the impact of adversarial bytes while max- imally preserving local structures of the executables. After showing how DRSM is theoretically robust against attacks with contiguous adversarial bytes, we verify its performance and certified robustness experimentally, where observe only marginal accuracy drops as the cost robustness. To our knowledge, we are the first offer certified robustness in the realm of static detection of malware exe- cutables. More surprisingly, through evaluating DRSM against 9 empirical attacks of different types, we observe that the proposed defense empirically robust some extent against diverse set of attacks, some of which even fall out of the scope of its original threat model. In addition, we collected 15.5K recent be- nign raw executables from diverse sources, which will be made public dataset called PACE (Publicly Accessible Collection(s) of Executables) scarcity of publicly available benign datasets for studying malware detection and provide future research with more representative data of the time. Our code and dataset available at
propose win-
alleviate the
com Shoumi kSaha/DRSM
INTRODUCTION
Machine learning (ML) has started more and more adoption in static malware detection, also has in many other mission-critical applications. Traditionally, ML models that use static fea- tures (Anderson & Roth 2018) require feature engineering step due to the large size and complex nature of programs. More recently, however, researchers have proposed models like MalConv (Raff) binary executable eliminate this step.
let al. 2018) that can consume whole program simply As expected, there has been a rise in studies showing the adversarial vulnerability of these models resulting in an ongoing arms race.
in the last few years (Kreuk et al. 2018 Lucas al. 2021
Currently, existing defenses, such as non-negative monotonic classifier (Fleshman et al. 2018 Incer Romeo al. 2018) and adversarial training (Lucas et al. (002),, not only introduce sizable drops in standard accuracy but also provide robustness only to specific attacks while still being vulnerable to the rest.
While certified robustness has been studied by many (Cohen et al. 2019 Lecuyer al. 2019 Salman et al.) 2019: Levine & Feizi| 2020a b). it remains under-explored in the context of ma ware detection. To fill this gap, redesign the de-randomized smoothing scheme, certified defense originally developed for images (Levine & Feizi (220a), to detect malware from raw bytes. With DRSM Randomndddd Smoothed Mal- MalCony (Raff et al. 2018) the base classifier,

---

Published as a conference paper at ICLR 2024
MalConv
Benign
Malware V
Original
Adversarial
DRSM
Benige X
Malware
Malware
Malware
Maloure o
Adversarial Attack
Figure 1: Overview of prototypical adversarial attack on MalConv and DRSM model. MalConv misclassifies the adversarial malware file as 'benign'. Our DSRM creates ablated sequences of the file and makes predictions on each, among which, the majority (winning) class is still 'malware'.
Conv) to denote the resulting defense. To our knowledge, DRSM is the first defense offering certified robustness for malware executable detection.
It is challenging for malware domain utilize de-randomized smoothing scheme due the inherent difference between image and raw byte file structure. As a solution, we propose a window ablation scheme that generates set of ablated sequences by dividing the input sequence into non-overlapping windows. For each of these ablated sequences, we train a base classifier keeping the ground truth from original input. At inference, DRSM take the majority of predictions from these base classifiers Shours simplified toy example: An adversarial attack may success- fully evaded MalConv model with the presented small changes to the raw executables, but it would still be detected by DRSM if the perturbation could not manipulate sufficient votes.
as its final prediction. Figure I shows
We find that our DRSM (98. 18%) can achieve comparable standard accuracy to MalConv (98.61 61)), and outperforms prior defense MalConv(NonNeg) (88.36%) by a large margin. Besides the- oretical formulation for DRSM's certified robustness, we show that it can provide up to 53.97% certified accuracy depending the attacker's capability. We discuss the performance-robustees. trade-offs, and its adaptability upon demand. Moreover, we evaluate the empirical robustness of our DRSM model against 9 different attacks both white and black box settings, including attacks outside of the intended threat model of De- Re-dmnaddd Smoothing. Depending on the attack, even the least robust DRSM model can provide 87. 77.9%~26.5% better robustness than MalConv.
A practical difficulty in malware research is collecting benign raw executables, due copyrights and legal restrictions Anderson & Roth 2018).. Throughout this work, we collect 15.5K fairly recent and diverse benign executables from different sources, which be better representative of the real world. These will be made public as a new dataset, namely PACE (Publicly Accessible Collection(s) of Executables), to alleviate the accessibility issue of benign executables and facilitate future research.
Our major contributions include: (1) A new defense, DRSM -De-Randomized Smoothed MalConv), that pioneers certified robustness in the executable malware domain (Section 5)
(2) A thorough evaluation of DRSM regarding its performance and certified robustness, which sug- gests DRSM offers certified robustness with only mild performance degradation (Section 6 (3) A thorough evaluation of DRSM regarding its empirical robustness against 9 empirical attacks covering different settings and types, which suggests DRSM is empirically robust some extent against diverse attacks. (Section 7).
(4) collection of 15.5K benign binary executables from different sources, which will be made public part of our new dataset PACE. (Section 4).
RELATED WORK
ML in Statie Malware Detection. There have been several studies how malware executables can be classified using ML. As early as 2001 SSchultz et al. (2001) proposed data mining technique for malware detection using three different types of static features. Pioneered by Nataraj et al.) 2011), CNN-based techniques for malware detection became popular among security researchers,
2

---

Published as a conference paper at ICLR 2024
e.g., Kasash et al. (2018); Yan et (2018). Eventually, RRaf et al. (2018) proposed static classifier, named MalCony, taking raw byte sequences to detect malware using a convolutional neural network. We will use it the base classifier in this work. It is still considered state-of-the t--thee-rttt art for detection from raw byte inputs, and its popularity led to a follow up model MalConv 2 (Raff et al. 2021).
Adversarial Attacks and Defenses in Malware Detection. Along with the detection research, there has been plenty of research on adversarial attacks on these models. These attacks fall into different categories. For example, attacks proposed by Kolosnjaji al. (2018); Kreuk et al. (2018); Suciu et al. 2019) appended and/or injected adversarial bytes in the malware computed by gradient. Demetrio et al. (2019, b021b); Nisi al.] (202I) motivated attacks that modify or extend DOS and Header fields. Demetrio et al. (2021a) extracted payloads from benign files to be appended and in- jected into malware files. Recent work by Lucas al. (202)) used two types of code transformation to generate adversarial samples. For defenses,
et al. (2018) proposed defense, MalConv (NonNeg), by constraining weights in the last layer of MalConv to be non-negative. However, this model achieves low accuracy of 88.3 88.36%. and has been shown to be as vulnerable MalConv in some cases (Wang et al. 2023] 2022; Ceschin et al., 2019). Another defense strategy, adversarial training cannot guarantee defense against attacks other than the used during training, which limits its usage: Lucas et al. (202)) showed training it on Kreuk-0.01 degraded the true positive rates to 84.4%
90.1%. Notably, where variants of randomized smoothing schemes have been proposed for vision domains (Cohen et al. 2019 Lecuyer et al. 2019 [Salman et al.] 2019) Levine & Feizi 2020a b) (more details in the Appendix A.2), they remain under-explored in the context of malware detection. Although there is a concurrent work (Huang et al. (2023) that proposes certified robustness in malware domain, they differ from us in terms of the employed smoothing scheme and
threat model.
Limited Accessibility to Benign Executables. Though there has been large amount of work on malware detection, most of the work was done using private or enterprise dataset with restrictive access. Prior works (Anderson & Roth 2018, Yang et al., 2021a; Downing et al. 202T) explain the copyright issue and only published the feature vector of benign files (see Table 5 This impose many constraints to the advancement of malware detection techniques, especially to have a complete model that requires raw executables as inputs.
3 BACKGROUND AND NOTATIONS
We denote the set of all bytes of a file as X (0, 1,, NN 1111. where N = 256. A binary file is a sequence of bytes x = (I1, 22, Ø3, .).)), where I; E X for all S < k. Note that the length k varies for different files, thus k is not fixed. However, the input vector fed into the network has to be of a fixed dimension. So, the common approach is to - pad zeros the end of if k < D, or extract the first D bytes from I, to fix the input length to D.
3.1 BASE CLASSIFIER
In this work, we will be using the state-of-the-arr static malware detection model to this date, named MalConv (Raff et al. 2018), as our base classifier. While there are other models like Ember, GBDT (Anderson & Roth 2018) for malware detection, note that these models work on a specified feature format that needs extra feature extraction step, whereas our model can directly take the raw binary executables. Let us represent the MalCony model (see Figure 7 as Fo X + [0. 1] with a set of parameters 0 that it learns through training. If the output of Fg (X) is greater than 0.5 then the prediction is considered as 1 or malicious, and vice versa. We set the input length as 2MB following the original paper.
takes in each byte x; from file X and then passes it to an embedding layer with an embed- ding matrix Z e Dx8 which generates an embedding vector 2; = 6(x;) of elements. This vector is then passed through two convolution layers, using ReLU and sigmoid activation functions. These activation outputs are combined through a gating which performs an element-wise multiplication to mitigate the vanishing gradient problem. The output is then fed into a temporal max pooling layer, followed by a fully connected layer. Finally, a softmax layer calculates the probability.
MalCony
3.2 THREAT MODEL.
We assume that the attacker has the full knowledge of the base-classifier, including architectures and model parameters. This is typically referred to as the white-box setting. The white-box setting considers potentially strong attackers, which is desired when assessing defenses.
3

---

Published as a conference paper at ICLR 2024
In the primary threat model that we consider when developing our defense, the attacker can modify any existing bytes or add (append or insert) extra bytes bounded in a contiguous portion of the input sample in test time to evade the model. So, the goal of the attacker is to generate an aforementioned perturbation 5 that can be applied on malware to generate adversarial malware x' for which Fo(x') < 0.5, i.e., the classifier predicts it as a benign file. Here, the attacker knows the classifier model F and its parameters 6, and can modify the original malware file x. However, finding the perturbation ó in binary file is more challenging than vision due its inherited file structures. For any arbitrary change in malware file, the file can lose its semantics, i.c. malicious functionality, in the worst case, the file can get corrupted.
Even after such challenges in binary modification, prior attacks have been successful by adding contiguous adversarial bytes at the end (Kreuk et al., 2018) or other locations (Suciu et al. 2019 Demetrio et al.) a b). or modifying bytes at specific locations(Demetrio et al., 2019 Nisi et al. 2021]. to evade a model. Though the attacks that are bounded one contiguous portion falls within our primary threat model, for empirical robustness evaluation,
include attacks that can have im- pacts at multiple different parts in the file. In addition, we also consider recent, more sophisticated attacks (Lucas et al., 2021 2023) where the attacker has the power disassemble malware and ap- ply different code transformations at any place in the file. For coherence, we defer the details about these attacks to Section
7 where we evaluate the empirical robustness of our defenses against them.
A NEW PUBLICLY AVAILABLE DATASET- PACE
Like other domains, malware detection suffers from concept drift too. Previously, Yang et al. (2021)) Jordaney et al. (2017); Barbero et al. 2022) demonstrated how concept drift can have a disastrous impact on MLsba malware detection. Therefore, we used 3 datasets from different times in this work (Table [. However, in the malware domain, having a large dataset to train a machine learning (ML) model may not be enough as maintaining diversity and recency is also cru- cial (Cao et al. 2020; Downing et al. [202]). We found that models trained without diverse benign samples can have very high false positive rate (see details in Appendix AA.1.)).
Despite the importance of diverse benign samples, unfortunately, most prior works (Anderson & Roth (0018;: Downing et al. (202T) could not publish raw executables of benign files due to copy- right and legal restrictions. For this work, we crawled popular free websites, e.g., SourceForge, CNET, Net, Softonic, etc., to collect diverse benign dataset of size 15.5K (Table(2). naming PACE (Publicly Accessible Collection(s) of Executables). We collected the malware from VirusShare at the same time (August 2022) as benign files. Following the common practice and guidelines, we publishing the URLs along with the MD5 hash for each raw benign file in dataset (see Ap- pendix [ for more details). We hope this will help researchers to recreate the dataset easily and experiment with a better representative of real-world settings in the future [
Table 2: PACE (Benign) Dataset
Table I: Datasets used in this work with collection time, size, and public availability of raw executables
Source
Number of Binaries
SourceForge
7.865
CNET
3.661
Dataset
Collection
Number of Binaries
Public Availability
Name
Time
Malware
Benign
Total
Net
2,534
Ember
2017
400K
400K
800K
X
Softonic
1,152
DikeDataset
1,082
VTFeed
2020
139K
139K
278K
X
Netwindows
185
PACE (Our)
2022
15.5K
15.5K
31K
Manually Obtained
Total
554.5K
554.5K
1.IM
from Windows OS
89
Total
15,568
We used MalCony model pre-trained on Ember (Anderson & Roth 2018) dataset provided by the /Endgame Inc.] Then we used this model to re-train the MalConv, MalConv (NonNeg), and our DRSM models on both VTFeed and PACE (our) dataset?] We split our dataset into 70:15:15 ratios for train, validation, and test sets, respectively. During evaluation, we made sure that test samples came from the latest dataset (PACE) only. For model implementation details, see Appendix A.3
PACC malware samples will also he provided upon request.
Thhe authors of [Lucas et al. 2021] assisted in training models on VTFeed, which we could not have done by ourselves since VTFeed not publicly accessible
4

---

Published as a conference paper at ICLR 2024
5 DRSM: DE-RANDOMIZED SMOOTHING ON MALWARE CLASSIFIER
Since the malware detection problem cannot be directly mapped to typical vision problems, we had redesign the de-randomizzd smoothing" scheme to make it compatible. Unlike images, our input samples are me-dimensional sequences of bytes, which makes the common vision-oriented ablation techniques, e.g., adding noise, masking pixels, block ablations, etc., infeasible. Additionally, even random byte change in file may cause a behavior change prevent the sample from executing.
MalConv
winning
class
MalCony
Certify winning margin
Input File
Window
MalCony
Count Class
Ablation
Prediction
Ablated
Base
Soquences
Classifler
Figure DRSM (De-Randomized Smoothed MalConv) model framework. Here, the red small block in 'Window Ablation' represents the perturbation by attacker, and hence, the base classifier gives a wrong prediction for that (shown with red cross).
So, we introduce the 'window ablation' strategy which involves segmenting the input sample into multiple contiguous sequences of equal size. If the input length of the base classifier is I., and the size of the ablated window w, then there will be [=] ablated sequences of length resulting in the ablated sequence set S(x). So, even if an attacker generates byte perturbation of size p, it can modify at most A = _ + ablated sequences (+1 when a perturbation overlaps 2 windows). Since perturbation change the decision of the smosthed-classifier model which was our prior motivation to integrate this technique. A visual representation of strategy provided in Figure
only influence limited number of ablated sequences, it cannot directly
The goal of the defender is to using Fo as the base classifier, find a de-randomized smoothed model Gg that can detect any adversarial malware r generated using a perturbation 8. Go takes in each sequence from the ablated sequence set S(z), and returns the most frequent predicted class. Specifically, for an input file ablated sequence set S(x). and base classifier Fg. the de- randommieed smoothed model Go can be defined as:
Gø(x) arg max (I(
where,
ne(2)
Σ T{Fo(x')=0) =
ES())
denotes the number of ablated sequences that were predicted as class c. The percentage of files that are correctly classified by the de-randomized smoothed model Go the 'standard accuracy'.
We the classifier Go certifiably robust on ablated sequence set if the number of predictions for the correct class exceeds the incorrect one by a 'large margin' (dictated by byte size of perturbation). This 'large margin' puts lower bound attacker's success in altering predictions of the classifier Gg since a perturbation 5 of size p can, at most, impact = [ + ablated sequences.
Mathematically, the de-randomized smoothed model Go is 'certifiably robust' input for pre- dicting class e
(=( > max maxecfe' n2 (x) 2A
Since our problem is a binary classification problem, this can rewritten as:
Tem (x) n1(2)) + 2A
if true labella)) malware if true-label(z)) bervign
(I)
Ts(I)) > Rm (I) + 2A

---

Published as a conference paper at ICLR 2024
where, (2) and nz(2) the number of ablated sequences predicted as malware and benign by the de-randomized smoothed model Ga, respectively. The percentage of file that holds the inequality T for Gg is the 'certified accuracy'.
For simplicity, we will use DRSM-n to denote DRSM with the number of ablated sequences [S(z) = n, e.g. DRSM-4 means ablated sequences on input will be generated for DRSM.
CERTIFIED ROBUSTNESS EVALUATION
6.1 STANDARD ACCURACY
For evaluation, we compare our DRSM models with MalConv et al. 2018) which is still one of the tf-te- models for static malware detection. Moreover, we consider the non-negative weight constraint variant of MalConv which was proposed as defense against adversarial attack in prior work (Fleshman et al. 2018). We train and evaluate these models on the same train and test set (Section
Table 3: Standard and Certified Accuracy of Models. MalConv and MalConv(NonNeg) cannot provide certified accuracy
Standard Accuracy (in %) f
Certified Accuracy [A = 2] (in %) f
Model
Train-set
Validation-set
Test-set
Train-set
Validation-set
Test-set
MalCony
99. 73
98.87
98.61
MalCony(NonNer)
88.56
87.56
88.36
DRSM-4
99.49
98.12
98.18
14.74
7.84
12.2
DRSM-8
99.67
97.88
97.79
52.74
43.9
40.85
DRSM-12
96.07
95.58
95.88
45.77
44.43
46.21
DRSM-16
94.29
93.00
93.3
59.1
50.52
49.17
DRSM-20
91.17
91.05
91.15
51.64
51.92
52.68
DRSM-24
90.22
89.80
90.24
54.19
54.88
53.97
For DRSM-n, we choose n = (4, 8, 12, 16,20, 24} for our experiments and show the standard ac- ex
curacy the left side of the Table 3 Recall that for DRSM-n, file is correctly classified if the winning class from majority voting matches the true label for that file (Section 5). For ties, we consider 'malware' the winning class. From the Table 3
see that DRSM-4 (98. 18%) and DRSM-8 (97. (97.79% can achieve comparable accuracy to the MalConv model (98. 61)). How- ever, increasing the has a negative impact on the standard accuracy. For example, DSRM-20 and DSRM-24 achieve 95. and 90.24% standard accuracy, respectively. We investigate and find that with more ablations (smaller window), the probability of one window containing enough mali- cious features to make stable prediction becomes less. On the other hand, the MalConv (NonNeg) model has a lower accuracy, which is consistent with the results by Fleshman et al. 20188)
6.2 CERTIFIED ACCURACY
Besides standard accuracy, we also evaluate the certified accuracy for DRSM-n models. Recall that 'certified accuracy' is the percentage of files for which the inequality [ holds true for DRSM-n models. In short, it denotes the lower bound of model performance even when the attacker can perturb bytes in A number ablated windows and alter predictions for all of them. So. we run experiments on DRSM-n models by varying the A in equation [ i.c., perturbation budget for the attacker. To maintain consistency between standard and certified accuracy, we take 'malware' as the winning class for ties by tweaking the first inequality in l to (z) 2 nz(2)) + 24.
Notably, A E (2,3 ...,,... } The range starts from 2, because any perturbation smaller than the window size overlap with most 2 ablated sequences, and goes up to a because the inequality Twill not hold beyond this point. The right side of
the certified accuracy of DRSM-n models for A 2. In Figure 3 we show the result of certified accuracy on the test set for each perturbation budget for the attacker (x-axis) (Figure IO shows in terms of A). See Tables Maalessaan a 6 A.4 for more details. We emphasize that even with small perturb up to 255K bytes for DRSM-8, and yet the model maintains 40. 40.85% certified accuracy.
255K 1 + 1), an attacker can 2(= 256K
By analyzing Table we can see that n has a positive and negative correlation with certified and standard accuracy, respectively. While DRSM-24 provides the highest certified accuracy (53.97%)

---

Published as a conference paper at ICLR 2024
Malcom
DRSM-
MalCow (Norkog))
DRaMe
DRSM-12
Cartifed Accuunoyy (5)
DRSM-20
60
DRSM124
40
20
200K
400K
603K
80CK
Perturbation in bylos)
Figure 3: Certified Accuracy (%) of DRSM-n models for different perturbation budgets (Test-set). While MalCony and MalConv (NonNeg) not certifiably robust, their standard accuracy is high- lighted for references.
has the lowest standard accuracy (90.24%) among all DRSM-n models. contrast, DRSM-4 pro- vides the highest standard accuracy 19%) with 12.2% certified accuracy. This observation may suggest a performance trade-off. It is worth highlighting that models like DRSM-8 and DRSM-16 strike a balance, delivering robust certified performance alongside commendable standard accuracy, while prior defense MalConv (NonNeg) achieves lower standard accuracy 88. 88.36%. We also want to sizeable modification
emphasize that perturbing 200KB in 2MB file (= 10%) is considered to a malware file, and yet our DRSM-n models can provide 37%~64% certified accuracy for such perturbation (from Figure 3 Remember that this accuracy reports the theoretical lower bound and in practice, our DRSM-n models provide even higher robustness (shown in Section 7)
7 EMPIRICAL ROBUSTNESS EVALUATION
Beyond theoretical robustness, also evaluate the empirical robustness of our DRSM-n models. Recall from Section that - in our threat model (any de-randomized smoothing scheme), attackers can add, or modify bytes in a contiguous portion of malware file, get it misclassified as a benign one. However, in real-life settings, attackers can be more capable and can deploy complex attacks where they can find multiple contiguous blocks perturb.
In this work, we consider 9 different attacks in both white and black box settings and categorize them into 3 types based on their alignment with our threat model. Fully Aligned: if an attack perturbs bytes in one contiguous block; Partially Aligned: if an attack perturbs bytes in multiple different contiguous blocks; Not Aligned: if an attack applies code transformation and changes bytes all over the file (not limited to any contiguous block). Table ssoos the list of attacks that have been considered this work along with their type, settings, and short description. For more details about individual attacks and their implementation, see Appendix A.5
To evaluate the attacks against MalCony, MalConv (NonNeg) and DRSM-n models, we randomly sampled 200 malware from the test-set of our dataset that are correctly classified by the model before attack. Let us call this subset of malware the 'attack set'. We call an attack 'successful' if the attack can generate a functional adversarial malware that can change the model's prediction from 'malware" to 'henign'. Even though the majority voting in DRSM-n not differentiable, it can still be attacked by targeting its base classifiers. Correspondingly, whenever necessary, generate adversarial malware from the 'attack set' by differentiating through the base classifier. determined based the attacker's 's knowledge about the base
Attack settings (white/black-bon classifier.
Figure 4 shows the attack success rate (ASR) for different attacks in the white-box setting. We find that - most attacks have less ASR on DRSM-n models than MalConv by large margin. For example, FGSM append attack has 82.50% ASR on MalConv whereas 10.0% and 7.0% on DRSM-4 and DRSM-8, respectively. Moreover, for n 2 16 in DRSM-n models, the ASR for all white-bon box attacks is (1%~5%). We got the highest ASRs MalConv model for DOS Extension (0%) and Disp (89.5%%) attack, while the ASRs on DSRM-n models were in range of (1%~72%) and (1%~42%), respectively.
7

---

Published as a conference paper at ICLR 2024
Table Attacks evaluated. O Fully Aligned, Partially Aligned and
Not Aligned describe
the alignment of the attacks to our primary threat model (see Section
Threat Model
Settings
Short Description
Attack
White- box Black-box
FGSM Append
Appends random bytes the end of the file generated by FGSM
Kreuk al.
2018
Slack Append
Injects non-functional bytes in slack re- gions generated by FGSM
Suciu et a 2019)
DOS Extension
Extends the DOS header and injects adver- sarial noise
Demetrio et al. 202
DOS Modification (Partial)
Puts adversarial noise in between of MZ and offset 0x3c in the DOS header
Demetrio et al. 2019
DOS Modification (Full)
Modifies every byte
DOS header without comruptngg file
Demetrio et al.) 2021b]
Header Field Modification Nisi ct al. 2021
Modifies fields in PE header
Disp
Displaces code instructions using jmp and semantic nop
Lucas et al. 202
IRR
Replaces instructions in multiple ways (equiv. replace, register reassign, reorder, etc.) without altering functionalities
Lucas et al. 202
GAMMA
Extracts payloads from benign programs and injects them in malware
Demetrio et al. 202 a
DRSM4
DRBM-8 DRSM-12
DRSM DRSM-24
Atlack Success Rate (%)
60
40
20
FGSM Append
Slack Append
DOS Extension
Header Field Modification
Attack Success Rale (%)
80
60
40
20
DOS Modification (Partial)
DOS Modification (Full)
Disp
IPR
Figure 4: Attack Succes Rate (ASR) % for white-box attacks on all models
Though Disp and IPR attacks fall outside of our threat model, surprisingly, DRSM-n can still provide good robustness against them (Figure 4 Here a potential explanation: transformed bytes by Disp and IPR at different places get divided into multiple ablated sequences and thus, they become less impactful in altering multiple predictions compared to one prediction. An interesting observation that the attacks that modify the header fields have marginally higher ASR DRSM-8 than
8

---

Published as a conference paper at ICLR 2024
(Norhheg)
Attack Success Rato (%)
80
60
40
20
0
Gamma
Header Field Modification
DOS Modification (Partial)
DOS Modification (Full)
Figure 5: Attack Succes Rate (ASR) black-box attacks on different models
DRSM-4: Potentially, this is because for DRSM-8 the perturbed positions in header fields happen to cover more windows than other cases. Higher ASR of DOS extension attack is discussed in Appnedix(A.4.. [.4.1
We also evaluated the models against black-box attacks using genetic optimizers. For example, GAMMA attack extracts payload from benign programs and injects them into malware by querying the model. From Figure 5 GAMMA has 24% ASR on MalCony whereas (4~1)% on DRSM-n models. While it is true that these black-box attacks have less ASR on MalConv compared to the white-box ones, still DRSM-n models outperform. Interestingly, we found that MalConv(NonNegg suffers in query-based black-box attacks, which is consistent with some recent works, e.g., Dropper attack by Waang al. (2022). MPass, GAMMA attack by Wang et al. (2023), Goodware string append by Ceschin et al. (2019).
LIMITATIONS
Though the DRSM framework can strike a good balance between standard accuracy and robustness, it has some limitations too. Because of the majority voting, its final classification is naive by nature. In a malware file, some fields or sections might have higher importance than other sections. For example, the header fields in general have higher importance in classification than the data section (Demetrio et al. 2019). But due to the majority voting, both of them might get same importance in DRSM. Another limitation no section information is considered. But to solve this, one will have to disassemble the file first, which would add up some computational cost. Moreover, since the padding at the end of the file does not contain any useful information, and the model randomly classify such paddings in the most cases, DRSM framework does not take them into consideration.
the 'window ablation' scheme solely depends the size of the file;
In this work, we did not take an 'adaptive" attacker into the consideration, who can try to perturb every window the file to evade DRSM. However, the attacker needs to know the size of ablations, and has find perturb-able bytes in each window, which might be challenging but not infeasible. Since the 'de-randomized smoothing' is directly non-differentiable, and no state-of-the-art gradient based attack has been defined for far, had to attack through its base classifier in this work.
CONCLUSION
In this work, we tried to find solution for the 'accuracy vs. robustness' double-edged sword in the malware field. We showed that certified defense is also possible in the executable malware domain, hoping that it will open up new paradigm of research. Besides theory, we equally emphasized the empirical robustness of our proposed DRSM. We would like to conclude by highlighting some areas and future directions our work identifies. Firstly, there is room for improving the standard accuracy of DRSM by introducing fundamental non -on-difeerentialee nature the smoothing scheme. Secondly, recent defenses from vision, besides de-randomized smoothing, hold promise for future exploration. Malware detection inherently an arms race and we hope our work can facilitate future research in developing more practical defenses with our defense and dataset.
additional classification layer, albeit at the expense of challenging the

---

Published as a conference paper at ICLR 2024
ACKNOWLEDGMENTS
We are immensely grateful to Keane Lucas for providing the VTFeed dataset, and the private imple- mentation of Disp, IPR attack (guided) to evaluate in this paper.
This project was supported in part by a grant from an NSF CAREER AWARD 1942230, ONR YIP award N00014-22-1-221 12-2277,, ARO's Early Career Program Award 310902-00001, HR001 12090132 (DARPA/RED), HR001 1 19S0026 (DARPA/GARD), Army Grant No. W91 INF2 I 20076, the NSF award CCF2212458, NSF Award No. 2229885 (NSF Institute for Trustworthy AI in Law and Soci- cty, TRAILS), an Amazon Research Award, and an award from Capital One.
This research was also partially supported by Amazon Research Award and by the Defense Ad- vanced Research Projects Agency (DARPA) under Agreement No. HR001 12190093. Approved for public release; distribution unlimited.
REFERENCES
Hyrum S Anderson and Phil Roth. Ember: open dataset for training static pe malware machine learning models. arXiv preprint arXiv: 04037, 2018.
Federico Barbero, Feargus Pendlebury, Fabio Pierazzi, and Lorenzo Cavallaro. Transcending tran- scend: Revisiting malware classification in the presence of concept drift. In 2022 IEEE Sympo- sium on Security and Privacy (SP), pp. 805-88 823. IEEE, 2022.
Michael Cao, Sahar Badihi, Khaled Ahmed, Peiyu Xiong, and Julia Rubin. On benign features in malware detection. In Proceedings the 35th IEEF/ACM International Conference on Automated Software Engineering, pp. 1234 1238, 2020.
Fabrício Ceschin, Mareus Botacin, Heitor Murilo Gomes, Luiz S Oliveira, and André Grégio. Shal- low security: On the creation of adversarial variants to evade machine learning-based malware detectors. Proceedings of the 3rd Reversing and Offensive-oriented Trends Symposium, pp- 1-9, 2019.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In international conference on machine learning, pp. 1310-1320. PMLR, 2019.
Luca Demetrio, Battista Biggio, Giovanni Lagorio, Fabio Roli, and Alessandro Armando. Ex- plaining vulnerabilities of deep learning to adversarial malware binaries. arXiv preprint arXiv:1901.03583. 2019.
Luca Demetrio, Battista Biggio, Giovanni Lagorio, Fabio Roli, and Alessandro Armando. Functionality-
black-box optimization of adversarial windows malware. IEEE Trans- actions on Information Forensics and Security, 16:3469-3478, 2021a.
Luca Demetrio, Scott E Coull, Battista Biggio, Giovanni Lagorio, Alessandro Armando, and Fabio Roli. Adversarial exemples: A survey and experimental evaluation of practical attacks machine learning for windows malware detection. ACM Transactions on Privacy and Security (TOPS), 24 (4):1-31, 202
Evan Downing, Yisroel Mirsky, Kyuhong Park, and Wenke Lee. (DeepReflect): Discovering mali- cious functionality through binary reconstruction. In 30th USENIX Security Symposium (USENIX Security 2/), pp. 3469-3486, 2021.
William Fleshman, Edward Raff, Jared Sylvester, Steven Forsyth, and Mark McLean. Non-negative networks against adversarial attacks. arXiv preprint arXiv:1806. 06008 2018.
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA. USA, May 7-9, 2015, Conference Track Proceed- ings, 2015. URL
/11e//11122 22. 6572
Zhuoqun Huang. Neil G. Marchant, Keane Lucas, Lujo Bauer, Olga Ohrimenko, and Benjamin I. P. Rubinstein. Rs-del: Edit distance robustness certificates for sequence classifiers via randomized deletion, 2023.
10

---

Published as a conference paper at ICLR 2024
fñigo Incer Romeo, Michael Theodorides, Sadia Afroz, and David Wagner. Adversarially robust malware detection using monotonic classification. In Proceedings of the Fourth ACM Interna- tional Workshop on Security and Privacy Analytics, IWSPA '1., pp. 54-63, New York, NY, USA, 2018. Association for Computing Machinery. ISBN 9781450356343. 3180449. URL httpt::ttttt.oorreeerroorr
doi: 10.1145/3180444
Roberto Jordaney, Kumar Sharad, Santanu K Dash, Zhi Wang. Davide Papini, Ilia Nouretdinov, and Lorenzo Cavallaro. Transcend: Detecting concept drift in malware classification models. In 26th USENIX security symposium (USENIX security 17), pp. 625-642, 2017.
Mahmoud Kalash, Mrigank Rochan, Noman Mohammed, Neil D. B. Bruce, Yang Wang, and Farkhund lqbal. Malware classification with deep convolutional neural networks. In 9th IFIP International Conference on New Technologies, Mobility and Security, NTMS 2018, Paris, France, February 26-28, 2018, pp. 1-5. IEEE, 2018 doi: 20010//TM
URL
https://doi. http///oiorrg//////// 10. 1.0...100 1109 /NTMS. 201 8328749
Bojan Kolosnjaji, Ambra Demontis, Battista Biggio, Davide Maiorca, Giorgio Giacinto, Claudia Eckert, and Fabio Roli. Adversarial malware binaries: Evading deep learning for malware de- tection in executables. In 26th European Signal Processing Conference. EUSIPCO 2018, Roma, Italy, September 3-7, 2018 pp. 533 537. IEEE, 2018. doi: 10.23919/EUSICC02201. 200.000.0018..532214....... URL httpt::://///tt //o:://dooioo .rrg 10. 2391 EUSTPCOO 201 8 8553214
Felix Kreuk, Assi Barak, Shir Aviv-Reuven, Moran Baruch, Benny Pinkas, and Joseph Keshet. Deceiving end-to-end deep learning malware detectors using adversarial examples. CoRR, abs/1 802.0402, 2018. URL http:tt::///xxi.rrrggg wwtp://wwwrg////////o//oo 0etpe/11002000228888
Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE symposium on security and privacy (SP). pp. 656-672. IEEE, 2019.
Alexander Levine and Soheil Feizi. (de)randomized smoothing for certifiable defense against patch attacks. In Hugo Larochelle, Mare' Aurelio Ranzato, Raia Hadsell, Maria-Florina Bal- can, and Hsuan-Tien Lin (eds.), Advances in Neural Information Processing Systems 33: An- nual Conference on Neural Information Processing Systems 2020, NeurlPS 2020, December 6- 12, 2020, virtual, 2020a. URL httt::::::/poccccpii/t///o////et nwwrgss........p...e..... cc/ htcc//pppr/2222777 hash/ 0tssl///oco33752222222acccc (5115550022222223333333 -at.s9/eeee.033-ttttatt..... html]
Alexander Levine and Soheil Feizi. Robustness certificates for sparse adversarial attacks by randomized ablation. In The Thirty-Foure AAAI Conference on Artificial Intelligence. AAAI 2020, The Thirty-Secone Innovative Applications of Artificial Intelligence Conference, IAAI 2020, The Tenth AAAI Symposium on Educational Advances in Artificial Intelligence, FAAI 2020, New York, NY, USA, February 7-12, 2020, pp. 4585-4593. AAAI Press, 2020b. URL bttpps://jjs aaai. org/ index.i.x.. whw. wwtp///A//artttteaaaaaaaapppapae http///////aaieeeeeee//e////////
Keane Lucas, Mahmood Sharif, Lujo Bauer, Michael K Reiter, and Saurabh Shintre. Malware makeover: Breaking ml-based static analysis by modifying executable bytes. In Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security, pp. 744-758, 2021.
Keane Lucas, Samruddhi Pai, Weiran Lin, Lujo Bauer, Michael K Reiter, and Mahmood Sharif. Adversarial training for (Raw-Binan Naw-Binary] malware classifiers. 32nd USENIX Security Symposium (USENIX Security 23), pp. 1163-1 1180, 2023.
L. Nataraj, S. Karthikeyan, G. Jacob, and B. S. Manjunath. Malware images: Visualization and automatic classification. In Proceedings of the 8th International Symposium Visualization for Cyber Security, VizSec '11, New York, NY, USA, 2011. Association for Computing Machin- ery. ISBN 9781450306799. doi: (0.11452216604.2016990 2145/2066044 2016908
htth:ttp:: http:::://doi.ooooo/ orq/10.
Dario Nisi, Mariano Graziano, Yanick Fratantonio, and Davide Balzarotti. Lost in the loader: The many faces of the windows pe file format. In Proceedings of the 24th International Symposium Research in Attacks, Intrusions and Defenses, pp- 177-192, 2021.
11

---

Published as a conference paper at ICLR 2024
Edward Raff, Jon Barker, Jared Sylvester, Robert Brandon, Bryan Catanzaro, and Charles K. Nicholas. Malware detection by eating whole EXE. The Workshops of the The Thirty- Second AAAI Conference Artificial Intelligence, New Orleans, Louisiana, USA, February 2-7, 2018, volume WS-18 of AAAI Technical Report, pp. 268-276. AAAI Press, 2018. URL 16422
https: /ttps://aaaa...o org/ ocs index. php/ WS/ AAATWI httpg//////AAA11aaaaaa///////e. wtwppp/pwppeee////e/eap
Edward Raff, William Fleshman, Richard Zak, Hyrum Anderson. Bobby Filar, and Mark McLean. Classifying sequences of extreme length with constant memory applied to malware detection. Proceedings of the AAAI Conference on Artificial Intelligence, wwa..aaa........................ .araaiorrg.... ndex. php/
9394,
May 2021. doi: 10. 1e2116609aaai355555 1,1111, WtRLhttts:////.
AAAI/a
Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers, Ad- vances in Neural Information Processing Systems, 32, 2019.
Matthew G. Schultz, Eleazar Eskin, Erez Zadok, and Salvatore J. Stolfo. Data mining methods for
detection of new malicious executables. In 2001 IEEE Symposium on Security and Privacy, Oak- land, Califormia, USA May 14-16, 2001, pp. 38 49. IEEE Computer Society, 2001. doi: 10.1 109/ BCCPRI.2001.922886 URL https:tppt...m //ooi org/10..000 111311.11111111PP1111 2001 924286
Octavian Suciu, Scott E. Coull, and Jeffrey Johns. Exploring adversarial examples in malware de- tection. In 2019 IEEE Security and Privacy Workshops, SP Workshops 2019, San Francisco, CA, USA, May 19-23, 2019, pp. 8-14. IREE, 2019. doi: 10.1109/SPW.2019.000 bittps://dos .r..rrg/ggo /10. 09 SPW. 201 999999000 00015
URL
Jialai Wang, Wenjie Qu, Yi Rong. Han Qiu, Qi Zongpeng Li, and Chao Zhang. Mpass: Bypassing learning-based static malware detectors. In 2023 60th ACM/IEEE Design Automation Conference (DAC), pp. 1-6. IEEE, 2023.
Shaohua Wang, Yong Fang, Yijia Xu, and Yaxian Wang. Black-box adversarial windows malware generation via united puppet- based dropper and genetic algorithm. In 2022 IEEE 24th Int Conf on High Performance Computing & Communications; 8th Int Conf on Data Science & Systems; 20th Int Conf on Smart City; 8th Int Conf on Dependability in Sensor, Cloud & Big Data Systems & Application (HFCCIISS/SaarCiiy//eeenndl
pp. 653-662. IEEE, 2022.
Jinpei Yan, Yong Qi, and Qifan Rao. Detecting malware with an ensemble method based on deep neural network. Secur: Commun. Networks, 2018:727709551172777755 2018. doi: 10.1155/ 2018/7247095. URL http:////..oooco/1.0...111/////2
Limin Yang, Arridhana Ciptadi, Ihar Laziuk, Ali Ahmadzadeh, and Gang Wang. Bodmas: An open dataset for learning based temporal analysis of pe malware. 2021 IEEE Security and Privacy Workshops (SPW), pp. 78-84. IEEE, 2021a.
Limin Yang, Wenbo Guo, Qingying Hao, Arridhana Ciptadi, Ali Ahmadzadeh, Xinyu Xing, and Gang Wang. [CADB}: Detecting and explaining concept drift samples for security applications. In 30th USENIX Security Symposium (USENIX Security 2/), pp. 2327-2344, 2021b.
12

---

Published as a conference paper at ICLR 2024
A APPENDIX
A.1 OUR PUBLISHED DATASET: PACE
A.1.1 DATASET DETAILS
Our diverse benign dataset contains benign raw executables from 7 different sources (Table 2
Figure 6 shows the cumulative distribution function (CDF) of the file sizes of our benign files.
CDF
0.9
% of distribbttion
0.7
0.6
0.5
0.4
1000
1250 1500
1750
2000
File size in KB
Figure 6: CDF plot of file sizes for our published benign dataset
Data Format. For each benign raw executables, we are going to publish the URL link to download it from with its MD5 hash for the response (See 'dataset' folder in supplementary material). For example, one line from our csv file
URL
MD5 hash
http://soweeeoooreeeeeennntttppp HissPPFFChaao/////Craatrr221777 PDFCreator-SSttup-0 O.exe/download
A. A.1
OTHER DATASETS
Table 5: Other Benign Datasets and their public availability
Benign Datasets
Public Availability
PACE (Our)
Raw Binary Executable only Feature Vector
Ember
VTFeed
X
DeepRefiect
only Feature Vector
BODMAS
only Feature Vector
A.1.3 PERFORMANCE DEGRADATION ON OUR PACE (BENIGN) DATASET
While there have been works about concept drift on mal malware YYang et al. 20216 Jordaney et al., 2017 Barbero et al. 2022) and they demonstrated how malwares evolved over the time, there have been very less work on concept drift of benign files. The probable reason can be the common belief that benign files do not evolve or change, i.e., the distribution remains same for them. However, we evaluated version of MalCony model on our PACE (benign) dataset that was trained on (Ember + VTFeed) dataset. Surprisingly, this MalConv version was misclassifying 12.22% benign files from PACE dataset while it was still having 98.91% test accuracy VTFeed dataset. Recall that our PACE dataset is the most recent one among these (2022). It is obvious that these benign datasets have different distributions due to the variation in collection time. It might be the that with time, different companies release (or update) their softwares for newer version of Windows, and as result, it causes shift in benign file distribution too. So, would suggest researchers report
13

---

Published as a conference paper at ICLR 2024
their model performance recent datasets in future, especially when it is about security-critic domain like malware detection.
A.2 DE-RANDOMIZED SMOOTHING
De-Randomized Smoothing (Levine & Feizi 2020a) is a certified defense against patch attacks in image classifications. It proposes two structured ablation methods to adapt Randomized Ablation (Levine & Feizi 2020b), a certifiably robust image classficiation scheme against Lo adversarial attacks, for the purpose of defending against patch attacks.
Given an input image, Randomized Ablation uses a base classifier to provide predictions on large number of randomly ablated version of the input image, where each ablated version retains exactly randomly selected pixels the original input (k is a prpee-paraeeter of Randomized Ablation). This ensures that for any p pixels attacked, the probability that the attack affect single ablated version will be
(
Pr(at least one attacked pixel is retained]
(Tarr
where h, w denotes the height and width of the input image. Thus if one aggregates the predictions made for ablated versions, only bounded portion of them will be affected by the Lo adversarial attacks and therefore certified robustness can be offered.
Building on Randomized Ablation, De-Randomized Smoothing proposes two structured ablation methods, block smoothing and band smoothing, to reduce the probability that at least one attacked pixel is retained in an ablated version for the context of patch attacks. For block smoothing, a single X square block of pixels will be retained per ablated version of the input image, thus for any adversarial patch of size m x m, the probability that the attack affect single ablated version will be
Pr(at least one attacked pixel is retained] (m + 1)²
hw
For band smoothing, single band (column row) of pixels of width s will be retained per ablated version of the input image, thus for any adversarial patch of size m the probability that the attack affect a single ablated version will be
m
for column smoothing
Pr(at least one attacked pixel is retained]
m-+-
for row smoothing
Notably, for both Block Smoothing and Band Smoothing, the number of all possible ablated ver- sions is much smaller (i.e. hw, w. h for block smoothing, column smoothing and smoothing. respectively) compared to Randomized Ablation, making it possible to iterate through all of them at inference and make the defenses deterministic.
A.3 MODEL. IMPLEMENTATION
(Integers)
gdia
Convelictionl layar
Embeddiing
Tamporal pooling
Fully connected
/G) 0.5
EXE
banign
Padding (zoroz)
Convolutional
Figure 7: MalConv model architecture
For MalCony and MalCony (NonNeg) implementation, we used input size of 2MB. For our opti- mizer, we used-
Optimizer: SGD
learning-rate: 0.01
14

---

Published as a conference paper at ICLR 2024
momentum: 0.9
nesterov: True
weight-decay: le 3
used the same setting for every model - MalConv, MalConv (NonNeg), and DRSM-n. For training on VTFeed and our dataset, the batch size was 16 and 32, respectively. All the models were re-trained for 10 epochs. We trained the models using multiple gpus at different times. But mostly used gpus were 4 NVIDIA RTX A4000 and RTX A5000.
A.4
MORE RESULTS
MalConv
DRSM-4
MalConv (NonNeg)
DRSM-8
DRSM-12
80
Ceritifed Accuracy (%)
DRSM-16
DRSM-20
60
DRSM-24
40
20
Perturbation Size in Attacks (in bytes)
Figure 8: Certified Accuracy (%) of DRSM-n models for different perturbation budgets (Train-set)
100
DRSM-4
MalConv (NonNeg)
DRSM-8
80
DRSM-12
Coritifed Accuracy (%)
DRSM-16
DRSM-20
DRSM-24
40
20
Perturbation Size in Attacks (in bytes)
Figure 9: Certified Accuracy (%) of DRSM-n models for different perturbation budgets (Validation- set)
A.4.1 DOS EXTENSION ATTACK ON DRSM
Comparatively, the DOS Extension attack has higher ASRs than other attacks DRSM-n models, and the reason might be the extended bytes in the DOS header shift the bytes in later windows and have an implicit impact them. A future mitigation training different base classifiers on each of them. Thus, attacks DOS extension will not be able to impact other (or later windows).
be extracting sections from the file and
15

---

Published as a conference paper at ICLR 2024
DRSM-4
DRSM-8
DRSM-12 12
Cerilife Accuracy (%)
DRSM-16
DRSM-20
DRSM-24
30
20
10
12
Perturbation Budget in Attacks (in delta)
(a) Test-set
DRSM-4
DRSM-8
DRSM-12
Cerlifed Accuracy (%)
DRSM-16
DRSM-20
DRSM-24
30
4
10
Perturbation Budget in Attacks (in delta)
(h) Validation-set
60
DRSM-4
DRSM-8
DRSM-12 12
DRSM-16
Cerilife Acouracy
40
DRSM-20
DRSM-24
30
20
0
2
4
10
12
Perturbation Budget in Atlacks delta)
(c) Train-set
Figure 10: Certified Accuracy (%) of DRSM-n models in terms of A for each set
16

---

Published as a conference paper at ICLR 2024
Table 6: Certified Accuracy (in %) shown range for different A
Certified Accuracy (in %) t
Model
Train-set
Validation-se
Test-set
MalConv
MalNon)(NonNeg)
DRSM-4
14.74
7.84
12.2
DRSM-8
52.74 ~ 8.99
43.9 ~ 3.14
40.85 ~ 3.7
DRSM-12
45.77 4.04
46.21 4.25
DRSM-16
59.1 ~ 3.96
~.44
49.17 ~ 2.59
DRSM-20
51.64 2.97
2.99
52.68 1.85
DRSM-24
54.19 ~ 2.86
54.88 ~ 3.14
53.97 ~ 2.03
Table Certified Accuracy (in %) for different perturbation budget for models
Perturbation Budget (in bytes)
Certified Accuracy (in %) f
Model
Train-set
Validation-set
Test-set
MalConv
MalCony (NonNeg)
DRSM-4
200K
14.74
7.84
12.2
250K
52.74
43.9
40.85
DRSM-8
500K
30.01
22.3
18.85
750K
8.99
3.14
3.7
170K
45.77
44.43
46.21
340K
31.23
30.31
32.9
DRSM-12
510K
23.76
23.0
24.21
680K
15.19
12.89
14.05
850K
4.04
2.79
4.25
120K
59.1
50.52
49.17
240K
40.37
32.4
31.79
360K
34.62
26.31
23.11
DRSM-16
480K
29.74
22.82
17.01
600K
23.12
17.07
11.46
720K
17.17
12.54
8.32
840K
3.96
2.44
2.59
100K
51.64
51.92
52.58
200K
47.41
47.04
47.13
300K
37.2
38.15
38.82
400K
26.66
25.61
28.47
DRSM-20
500K
21.71
20.91
21.81
600K
18.35
17.07
18.48
700K
14.39
12.2
13.12
800K
9.18
8.89
6.65
900K
2.97
2.96
1.85
80K
54.19
54.88
53.97
160K
50.5
50.17
49.91
240K
43.12
43.21
45.1
320K
33.74
33.8
34.75
400K
26.54
25.26
26.8
DRSM-24
480K
22.12
20.03
21.26
560K
19.76
17.94
17.38
650K
16.45
13.76
13.68
720K
12.19
9.58
8.5
800K
7.81
7.67
5.36
880K
2.86
3.14
2.03
17

---

Published as a conference paper at ICLR 2024
Table 8: Attack Success Rate (ASR) % of different evasion attacks in White-box setting
Atlack Success Raie (%) 1
Attack (White-box)
Models
MalConv
MalConv(NonNeg))
DRSM-4
DRSM-8
DRSM-12
DRSM-16
DRSM-20
DRSM-24
FGSM Appead
82.50
23.5
10.00
7.00
1.00
1.00
1.00
1.00
Slack Append
79.50
17.0
22.50
25.50
1.00
1.00
1.00
1.00
Extension
Header Field Mudilication
26.50
58.5
10.00
17.00
1.00
1.00
1.00
1.00
Moditication (Partial)
16.50
7.50
DOS Modification (Full)
49.50
58.00
41.50
41.50
5.00
1.00
1.00
1.00
$9.50
67.5
42.00
35.50
12.50
5.50
1.00
1.00
IPR
18.00
8.00
9.50
5.00
2.50
1.00
1.00
1.00
Table 9: Attack Success Rate (ASR) % of different evasion attacks in Black-box setting
Success Rate (%)
Attack (Black-hux)
Models
MalCony
MalConn(NonNeg)
DRSM-4
DRSM-8
DRSM-12
DRSM-16
DRSM-20
DRSM-24
GAMMA
21.00
45.50
1.00
1.50
1.00
1.00
1.00
1.00
Header Field Modification
55.50
0.00
4.50
0.00
0.00
0.00
0.00
DOS Modification (Partial)
6.00
54.00
0.00
3.00
0.00
0.00
0.00
0.00
DOS Modification (Full)
10.00
55.50
0.00
0.00
0.00
0.00
0.00
0.00
18

---

Published as a conference paper at ICLR 2024
A.5 ATTACKS
DOS
priffen
Mlavstion
puodiin
Extend
Header
DOS Header
PC
Heeder Fields
COFF Optional Header
COFF Optional Header
Partial
COFF Optional
Padding
API Injection
First secion
First section
Slack Space
First
Section Injection
Ledt section
Lost section
Lest section
Injected section
* baseed maniguaal
Figure 11: Graphical Representation of the locations perturbed by different attacks with adversarial payloads
A.5.1 IMPLEMENTATION SOURCES
For FGSM append, Slack append, DOS extension, DOS modification, and Header field modification attacks, we used the code implementaiont of and easily reproducible. We collected the guided-varsioe implementation of Disp and IPR attacks from the auhtor Lueas et al. (202T). Since their implementation was private, we cannot release the code for these two attacks, and they are not reproducible from our provided code.
[python library which public
A.5.2 FGSM APPEND ATTACK
Append attack in adversarial malware was first proposed by Kolosnjaji al. (2018). In this attack, authors added some noise at the end of malware file computes by gradient of the model. However, the first proposed method was computationally heavy. Later, was improved by Kreuk et al. (2018) using Fast Gradient Signed Method (FGSM) motivated by [Goodfellow et al. (2015). In Figure 'Padding' label (purple) depicts the FGSM Padding (or Append) attack.
In experiment, kept padding budget of 10KB (= 0.5% of the input file size) and the attack for 10 iterations. We noticed that, for some malwares the model prediction was 1.0 for which the attack failed.
A.5.3 SLACK APPEND ATTACK
This attack was an incremental work on Kreuk et al. (0018) by Suciu et al. (2019) Unlike the previous one, the attacker inject the payload in between of sections. The find the gaps between consecutive sections (called 'slack spaces') ) in a binary by RawSize gap to inject gradient-generrted adversarial bytes. Since these slack spaces be multiple places, this attack is partially inside our threat model. In Figure TT the 'Slack Space' label (grey) indicates this attack.
V'rtualSiiz, and use that
In our experiment, we followed the same parameter the previous one, and ran it for 10 iterations by keeping the padding budget 10KB. We want to mention that though this attack seems more evasive than the previous one, for larger perturbation budget FGSM Append is more successful than this one. This was found in original paper, and our result is consistent with this finding too.
A.5.4 DOS EXTENSION ATTACK
This attack creates new space by extending the DOS header. Attacker increases the offset to PE header and modify the file structure accordingly. these extended spaces, attacker can put
Figure is taken from Demetrio et al. 20021b). http:///ggtuuuu.oo/aaaaaaaaceoe malware
19

---

Published as a conference paper at ICLR 2024
adversarial bytes to evade model (Demetrio et al. 2021b). Since the extension is contiguous portion (header) of the file and can have an impact on other windows in DRSM-n, it partially falls under our threat model. In Figure II] the 'Extend' label (green) refers to this attack. We ran this attack on our "attack set' for 10 iterations with 10-3 penalty regularizer.
A.5.5 DOS MODIFICATION ATTACK
There are 2 versions of this attack Partial et al. 2019), and Fuel(Demttrio et al., 202 In DOS header, two important bytes are magic number and real offset 0x3c. The former attack modifies bytes in between of these two bytes while the latter one modified every bytes in the DOS header except those two. So, the 'full' modification version is more evasive than the 'partial' one. This attack is shown in blue and yellow color in Figure II We ran this attack models for 10 iterations.
A.5.6 HEADER FIELD MODIFICATION ATTACK
This attack was implemented getting the motivation from Nisi et al. (2021). They analyzed the discrepancies among tools and PE file formats. Thus, they found set of bytes (or modifications) that can potentially evade malware classifier. Since this attack modifies bytes at multiple different places but they are constrained only in the PE header, it partially inside our threat model. In Figure I1 the 'Header Fields' label (black) shows how this attack changes header fields in PE header. We ran this attack for iterations.
A.5.7 DISP (CODE DISPLACEMENT) ATTACK In this attack, the attacker has to use to disassemble a malware first. Then the attacker displace consecutive instructions in a basic block. Such displacements are usually done jmp and nop structions. [ucas et al. (2021) proposed this attack for the first time. Figure [2 an example of such attack.
#x4587:
ax,
(6683-010) (6683e019)
Bx/5BD:
sub Dx, 6x10 cnp ax, Dx
RX-18F:
(663968)
(a) Original code
0x4587:
0x4888
(8974828908)
0x458c:
(6689c9)
0x45KF:
cap
(662908)
0x1890:
add 0x10
(6683.618)
8x488c:
sub bx. 0x10
(6683cl:18)
0x4888:
(90)
0x4895:
pushfd
(9c)
0x4896:
(53)
0x4807:
ebx,
(83C316)
8x488a:
pop
(5b)
8x488b:
popfd
(9d)
0x48ed:
9x458:
(e97afdrr()
(b) After Disp
Figure 12: An example of Disp attack
We collected the private implementation of the guided version of this attack from the authors. We ran Disp-1 (the perturbation budget is 1% of the binary size) for 100 iterations.
A.5.8 IPR (IN-PLACE RANDOMIZATION) ATTACK
Like the previous attack, attacker has to disassemble the malware here. Then attacker can apply four types of transformations - replacing instructions with equivalent ones, ii) reassigning registers, iii) reordering instructions using dependency graph, and iv) altering register's push and pop order. These transformations do not necessarily change the file size but modifies the code at many different places. So, this attack falls outside of our threat model. Figure 13 shows the transformation types with an example. We collected the private implementation for this attack from authors of Lucas et al. 2021
20

---

Published as a conference paper at ICLR 2024
e0p
Puth
puah etp
(35
(3beb))
D0V
(8te2)
(Btken3
(ush etn
(53)
2038 6bx
(b3)
9353 6bx
(36)
9uth 6bx
(33)
peah odx
(33)
[dlo4]]
(865884)
sbx. [olp-4]
(865
BGV [dlpu4]
(86558))
<bo. [dopud]
(815886)
Letpod
(R05080)
055 63x, Dx38
(83c310)
abs.
(83ebe0)
810
(8Gmst8))
4x39
(815596)
RaV edo..
Letppet)
(885000)
80y
[e0X] obx
(1ME8)
(89.00
ROV
[abxc]
edx
(B913)
[stx]
(B913)
Lybn
100
sap
(56)
pop
200
p4p abp
(S4
dbp
(54)
ptp <hp
(54)
<bp
(1d)
(50
Original
Equivalent instrnctions
Register weasiggment
(4) Instruction reardering
(6) Register prsservation
Figure 13: An illustration of IPR attack
A.5.9 GAMMA ATTACK
This attack was first proposed by Demetrio et al. (2021a). Though it was common belief that goodware (or benign) payload (or string) can be added to a malware to evade a model, they are the first to propose a query-based black-box method for this. In this attack, the attacker generates payload from some benign programs, then inject them into malware and return the best subset of generations by querying the model. Figure [4 shows the overview of the attack.
Return mimimize function evaluatod
llaration mimimum llorotoos
Input malware
achversarisl malwars
benign cections
adversorial malwaree
1
objectivo ciann
injoction
evaluation
payload goneration (1y-gy... %g)
pentily lerm
Figure 14: Overview of GAMMA attack
In our experiment, we ran the hard-label version of GAMMA attack with section injection. We set the population size as 200, and ran it for 20 iterations. For payload extraction, we used the data section of benign files.
For Disp and IPR attacks, we used IDo disassembler.
Figure 12 and 13 are taken from Lucas al 2021)
Figure taken from Demetrio
21


Reviews:
[{"review_id": "D2lYVfEnyr", "reviewer": "Reviewer_4y7b", "summary": "This work introduces a certified defense called DRSM (De-Randomized Smoothed MalConv) through a redesign of the de-randomized smoothing technique in the context of malware detection.\nMore specifically, they introduce a window ablation scheme that creates a series of ablated sequences by partitioning the input sequence into non-overlapping windows.\nExtensive experimentation involving 9 distinct empirical attacks of various types reveals that the proposed defense demonstrates empirical robustness when faced with a diverse range of attacks.", "questions": "* If the winning class of Fig. 2 is \"benign\"?\n\n* Does a smaller window size lead to improved certified robustness?", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "* The authors have gathered 15.5K recent benign raw executables from a variety of sources. These files will be released to the public as a dataset named PACE (Publicly Accessible Collection(s) of Executables). This dataset aims to address the shortage of publicly available benign datasets for research in malware detection and to provide future studies with more representative contemporary data.", "weaknesses": "* Insufficient theoretical analysis of certified robustness when facing multiple malicious ablated sequences. Specifically, the authors assume that an attacker generates a byte perturbation of size $p$ and can modify a maximum of $\\lceil \\frac{p}{w} \\rceil + 1$ ablated sequences. However, if the attacker simultaneously inserts multiple adversarial code segments at different locations, how will this impact the certified robustness? The authors should offer a more in-depth theoretical analysis of this scenario. Furthermore, the authors should establish the relationship between the window size ($w$) and the resulting certified robustness. For example, does a smaller window size lead to improved certified robustness?\n\n* In my view, there appears to be a contradiction between Figures 1 and 2. As discussed in Section 5, malicious ablated sequences are expected to influence their respective base classifiers, and the predicted winning class should be \"benign.\" However, in Figure 1, the predicted winning class is labeled as \"malware,\". It confuses me. If this work indeed presents a more robust framework that prevents attackers from generating adversarial examples, then the winning class should ideally be \"benign.\" However, if the winning class is consistently benign, it suggests that the proposed framework might miss detecting certain malware instances, creating a contradiction.\n\n* The absence of comparisons with a broader range of real-world antivirus engines accessible via VirusTotal is notable. It would be beneficial, for instance, to determine how many antivirus engines effectively identify the malware and test cases as malicious.\n\n* Another deficiency is the absence of specific details regarding the process of compromising executable files. The authors should provide a more comprehensive explanation of how to generate adversarial examples within the problem-space[Ref-1], which encompasses defining a comprehensive set of constraints on available transformations, preserving semantics, ensuring robustness to preprocessing, and maintaining plausibility.\n\n* The rationale behind the design choice is unclear. Why have the authors chosen MalConv as the baseline classifier? There are numerous alternative models that can serve as the baseline classifier, such as LGBM, RF, and SVM. The authors should consider evaluating their framework with these alternative baseline classifiers.\n\n\nPierazzi, Fabio, et al. \"Intriguing properties of adversarial ml attacks in the problem space.\" 2020 IEEE symposium on security and privacy (SP). IEEE, 2020.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Cz8XGzFkKA", "reviewer": "Reviewer_5AC4", "summary": "The author employs the de-randomized smoothing technique to develop a certified defense for malware detection. Furthermore, the author introduces a new dataset named PACE, comprising 15.5K recent benign raw executables from diverse sources. Experimental results validate the effectiveness of their approach.", "questions": "1.The proposed \"window ablation\" strategy seems to be applicable only to scenarios where perturbations are clustered together (similar to patch attacks in the CV domain). However, many adversarial attack methods for malware disperse the inserted perturbations across various locations within the software. It remains unclear whether the proposed method would still be effective in such cases.\nUpdate: this has now been addressed\n\n2.The construction of many malware samples follows a piggyback approach, where the majority of the software consists of benign code, with only a small portion exhibiting malicious behavior. That’s to say most of the ablated sequences will be given a benign label. The algorithm proposed by the author may result in false negatives for such malware samples.\nUpdate: this has now been addressed\n\n3.It is essential to provide a comparative analysis of the author's proposed defense method against existing adversarial example defense techniques for malware.\n Update: this has now been addressed", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The paper is well written and generally easy to follow.  \n2. A well-structured and clear presentation.\n3. I appreciate the author for providing a novel dataset.", "weaknesses": "1.\tThe motivation behind the method somewhat contradicts intuition to a certain extent.\n2.\tThere is a lack of comparison with recent methods for defense adversarial attack.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "zmFHsWyfFd", "reviewer": "Reviewer_sYdT", "summary": "This paper applies de-randomized smoothing to produce a classifier for malware detection (called DRSM) that is certifiably robust against patch attacks. The proposed classifier can be viewed as an ensemble of base classifiers, each of which operates on a distinct block of the input file. After collecting predictions for each block from the base classifiers, the prediction for the file as a whole is made by majority vote. This architecture admits a patch certificate that depends on the block size, maximum input length and the voting margin. The included experiments show that DRSM (with MalConv base classifiers) achieves a similar accuracy as vanilla MalConv, while producing patch certificates of order 100KB in size. Experiments examining empirical robustness to several attacks are also reported, which generally demonstrate improvements compared to vanilla MalConv and MalConv with non-negative weights. The paper also contributes a new dataset of benign executables, which is useful given the limited availability of publicly available benchmark datasets for malware.", "questions": "It would be great if the authors could comment on my feedback about:\n- novelty of DRSM (how does it differ from Levine & Feizi (2020) and Hammoudeh & Lowd (2023)?)\n- how DSRM operates on small files\n- the threat model", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. It’s great to see a paper investigating certified robustness outside the vision domain, which has dominated the literature to date. The patch-like threat model seems well-motivated for malware, given it encompasses several existing attacks. \n\n2. Another strength of the work is its simplicity. DRSM is conceptually straightforward to implement and analyze, which could reduce barriers to adoption.\n\n3. I’m pleased the authors have found a way to share a public dataset for malware analysis. The lack of public benchmark datasets is a major impediment for academic malware research. Having this dataset available will save researchers' time, and it should allow for better comparison between papers (which tend to use different datasets currently).", "weaknesses": "1. The paper can be seen as applying an existing method (de-randomized smoothing) to a new domain (malware). Although the authors claim that it is “challenging” to adapt de-randomized smoothing for malware, I’m not convinced. The proposed method is a form of structured ablation, originally studied by Levine & Feizi (2020) for 2-d inputs with homogeneous base classifiers. The modification from 2-d to 1-d inputs and from homogeneous to heterogeneous base classifiers seems straightforward. Moreover, the proposed method has appeared in prior work in a more general form by Hammoudeh & Lowd (2023).\n\n1. The paper claims to be “first to offer certified robustness in the realm of static detection of malware executables”. However there is prior work on this topic by Huang et al. (2023) which appeared on arXiv in January 2023. Their work considers a different threat model for malware: edit distance robustness rather than patch robustness.\n\n1. A characteristic feature of the malware domain is that inputs vary in length. However, it’s not clear to me how the proposed classifier architecture handles this. As an example, consider a 100 KB malicious file and a classifier with a maximum input length of 2 MB. For $n$ in the range 4–20, the malicious file fits within a single block, meaning it is passed to a single base classifier, while the remaining $n - 1$ base classifiers receive padding as input. Assuming the base classifiers predict “benign” for padding, the votes are $1$ “malicious” and $n - 1$ “benign” giving a prediction of “benign”. I wonder if I’m missing something here, because it seems the classifier is guaranteed to make false negative errors on small files, which are abundant according to Figure 6.\n\n1. I found the description of the threat model and certificate unclear. Section 3.2 states that the attacker is allowed to “modify or add any bytes in a contiguous portion”. I understand that “modify” means overwrite or replace, but it’s not clear what “add” means in this context. For instance, “add” could mean “insert” or “append”, or it may mean “increment or decrement by some amount”.  The mathematical description $x’ = x + \\delta$ implies the original sequence $x$ is additively perturbed by $\\delta$ (which is undefined), but this seems to be at odds with the earlier description. Reading between the lines, my understanding is that the certificate covers a contiguous chunk of the original file being overwritten, which may include some bytes being appended to the end of the file. This should be precisely stated somewhere. The current definition of the certificate in Section 5 is in terms of ablated sequences – it would be helpful to translate this to the input space.\n\n1. It’s great that the authors are planning to release the PACE dataset. However, the current description of the collection process is a bit light on detail. It would be helpful to describe how binaries were selected from the various sources. For instance, was there a preference for recent binaries? Are the binaries for a single platform (e.g., Windows x64) or multiple platforms? How do you know the binaries are benign?\n\nMinor points:\n1. Section 2 states that it’s “surprising” MalConv is still considered state-of-the-art for malware detection on raw byte sequences, given it was released in 2018. The authors attribute this to limited availability of public data. However, I think the main reason is due to difficulties in scaling more complex models (such as transformers) to very long sequences, containing upwards of a million tokens. It’s worth pointing out that the authors of MalConv have released a follow up model known as MalConv 2 (Raff et al., 2021).\n1. Section 3 states that the input vector fed into the network “has to be of a fixed dimension”. This is not true in general, and I don’t believe it’s true for MalConv. I believe it is possible to support arbitrary length inputs in modern frameworks such as PyTorch by specifying `None` for the size of the dimension.\n1. Section 3.1 states that models like EMBER and GBDT “can work only on feature vectors”. I’m a bit puzzled by this statement. When composed with their feature extractors, these models must be able to operate on raw binaries, otherwise they would be useless as malware detectors?\n1. Section 5 states that vision-oriented ablation techniques such as masking and block ablations are infeasible for byte sequences. However I can’t see why these wouldn’t work on 1d sequences? It seems feasible to mask bytes or ablate 1d blocks.\n1. Section 7 states MalConv NonNeg “has been believed as a robust model for a long time”. It would be good to include a citation for this claim.\n\n**References**\n\n- Huang et al., “Certified robustness of learning-based static malware detectors,” arXiv:2302.01757 (2023). https://arxiv.org/abs/2302.01757\n\n- Hammoudeh & Lowd, “Feature Partition Aggregation: A Fast Certified Defense Against a Union of $\\ell_0$ Attacks,” AdvML-Frontiers 2023. https://openreview.net/forum?id=NX5Nxrz6PV \n\n- Levine & Feizi, “(De)Randomized Smoothing for Certifiable Defense against Patch Attacks,” NeurIPS 2020. https://proceedings.neurips.cc/paper/2020/file/47ce0875420b2dbacfc5535f94e68433-Paper.pdf\n\n- Raff et al., “Classifying Sequences of Extreme Length with Constant Memory Applied to Malware Detection,” AAAI 2021. https://ojs.aaai.org/index.php/AAAI/article/view/17131/16938", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "P5ym5Tgp6Q", "reviewer": "Reviewer_grdf", "summary": "This paper applies the de-randomized smoothing technique from the image classification domain to the domain of malware detection - proposing a window ablation scheme. Theoretical robustness is argued and certified and empirical robustness (the latter against a broad range of attacks) is tested empirically. A dataset of benign executables will also be made available to support future research.", "questions": "Would it be possible to indicate the values of \\Delta on the x-axis of figure 3? Everything has been in terms of that up to this point.\n\nOne issue would be with attacks which INSERT bytes. Section 3.2 seems to suggest this is possible (\"attacker can modify or add any bytes in a contiguous portion\"). Surely, if added at the start of the file, this can change the contents then of EVERY window, as all the bytes get shifted to the right. So adding bytes does not seem to be in the threat model that would give certified robustness.\n\nIn fact, the above comment may explain why the DOS Extension attack has such a big effect on the DRSM models in Figure 5.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "This is a well written paper which clearly presents the core idea. The experiments are quite thorough and support the claims.\n\nMaking the dataset available for future research is a positive.", "weaknesses": "The basic idea is quite simple, and this is not a contribution of major impact in the field. \n\nIt would have been good to see a description of de-randomized smoothing in the related work, as this is core to the idea.\n\nThere are a few grammatical issues throughout the paper - it needs a polish before publication, e.g.\n- \"We will use it as base classifiers\"\n- \"potentially attributing to the issue\"\n- \"convolution neural network\"\n- \"there have been a large amount of work\"\n- \"to some extents\"\n- \"though it has been believed as a robust model\"\n- \"However, it's worth highlighting..\" not sure However is right word.\n\nMinor issues:\n- X \\subset [0,N-1] is wrong. [0,N-1] is a real-valued continuous interval. I think it means X is the set {0, 1, ..., N-1}", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "SnhwWeM1WZ", "reviewer": "Reviewer_EohB", "summary": "The authors propose DRSM, a custom de-randomized smoothing algorithm for MalConv, an end-to-end convolutional neural network. DRSM works by dividing input malware in chunks, each of them containing a percentage of the input bytes. These are classified independently, and labels are provided through majority voting. Table 3 shows that, using different number of windows, DRSM is able to certify more than 40% of points, with a peak of almost 54%.\nTo empirically show their results, the authors also use state-of-the-art adversarial attacks against DRMS, highlighting that DRMS-12 to 24 are able to stop most of the proposed attacks.\nLastly, the authors also release their PACE dataset, by sharing URLs and SHAs of both malware and goodware programs.", "questions": "1. How you conducted the adversarial attacks? Which library did you use / how you obtained the code of attacks? Inside the provided material, it is not possible to test the attacks from Lucas et al.\n\n2. Can the authors provide better information on the quality of the collected goodware?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. This paper bridges an interesting gap between general machine learning robustness, and its application to complex domains like malware detection. \n2. The certification approach works by splitting malware in chunks, averging its predictions. This is doable thanks to the nature of the architecture. Also, this would have been much more difficult to do with a model relying on hand-crafted features.\n3. The PACE dataset is timely, since it is always difficult to get goodware samples.", "weaknesses": "**No white-box evaluation.** The authors state that they compute attacks on the base model, thus framing them as white-box attacks (like Partial DOS; Shift, etc). However, these are evaluated as black-box transfer attack, and thus should be clarified on the paper.\n\n**Probable bad params for attacks.** The low success rates of attacks (especially GAMMA) might be due to a wrong initialisation. In the appendix, it is written that 200 as population size and query are used, but the number of queries for the GAMMA attack are computed as population_size * iterations. Also, the number of used sections is missing (which is a crucial point for the attack).\n\n**Dataset concerns.** While the release of a goodware dataset is for sure a great contribution, I am doubtful on the composition of such corpus. In particular, the sources might contain malware  or generic unwanted propgrams (Softonic is known to host plenty of installers and grayware that asks you to install other third-party programs). The authors should better clarify the origins of these data, or at least try to study the quality of the provided ground truth. Otherwise, the dataset might contain biases that reduce the fairness of the publication.\n\n**False statements.** The authors state that \"it is difficult to add more than 10% of content\". This statement is false, since adversarial malware attacks are automated through tools. Papers like [Demetrio et al. 2021a&b / Lucas et al. 2021] can increase the size more than 10% of the file size (Lucas et al. bound it to 5% just to not enlarge too much the input file).\nLastly, Header Modification is not proposed by Nisi et al. 2021, but it is contained inside the SecML Malware library, inspired by the paper (that states which fields are not used by the loader anymore).\n\n**Limitations and related work not addressed.** The paper does not discuss limitations of their methodology, by just saying that it is \n certification is a difficult problem to solve. Also, related work misses a preliminary (but unpublished) paper [1] that addressed the problem in the early months of 2023 (more than 6 moths ago). It would be better to mention the fact that preliminary work on certification for malware detection are already there.\n\n[1] Certified Robustness of Learning-based Static Malware Detectors - https://arxiv.org/pdf/2302.01757.pdf", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)