Rule-based Adversarial Learning: Disguising and Recognizing Maliciousness in Opcodes

Adversarial learning has previously demonstrated effectiveness as a tool for improving performance in deep learning models trained on limited data. In this work, we apply adversarial learning to the constrained, discrete domain of opcode-based deep malware detection. We do this by developing a deep learning model for detecting maliciousness in sequences of opcodes, and using this model in order to alter sequences of code from the dataset in minimal ways to create example sequences which are misclassified by the original model. We augment our original training dataset with these adversarial examples, thereby improving the classification accuracy on unseen sequences of opcodes. Using adversarial examples to supplement our training data, we demonstrate statistically significant increases in performance (> 0.5% increase in both accuracy and F1-score). Additionally, we present a preliminary investigation into the transferability of our adversarial examples between different model architectures.M.A.S