Can Drift-Adaptive Malware Detectors Be Made Robust? Attacks and Defenses Under White-Box and Black-Box Threats

1. Problem Statement

The paper addresses a critical gap in cybersecurity: the adversarial robustness of drift-adaptive malware detectors.

• Context: Machine learning-based malware detectors face concept drift, where malware authors continuously evolve techniques, rendering models trained on historical data ineffective. To counter this, AdvDA (Adversarial Domain Adaptation) was proposed to periodically realign feature distributions between a labeled source domain (old malware) and a sparsely labeled target domain (new malware).
• The Gap: While AdvDA maintains high clean accuracy under concept drift, it has never been evaluated against adversarial attacks. Existing defenses for domain adaptation assume fixed data distributions, but in drift-adaptive settings, robustness learned on the source domain may not transfer to the target.
• Objective: The authors investigate whether drift-adaptive detectors can be made robust against two distinct threat models:
  1. White-Box: Projected Gradient Descent (PGD) attacks in the input feature space.
  2. Black-Box: MalGuise attacks, which modify malware binaries via functionality-preserving control-flow mutations.

2. Methodology

A. Universal Robustification Framework

The authors propose a framework to "robustify" a pre-trained AdvDA model. Instead of training from scratch, they fine-tune the domain-adapted model on adversarially transformed inputs.

• Core Mechanism: The framework replaces clean source ($X_S$) and target ($X_T$) inputs with transformed versions ($\tilde{X}_S, \tilde{X}_T$).
• Optimization: The model minimizes a combined objective: classification loss on transformed data + domain divergence loss (to maintain alignment).
• Variants: The framework is instantiated with five defense variants across two families:
  1. DART-based (PGD): Uses PGD perturbations in the feature space. Variants differ in how the source is transformed:
     • Clean: Source remains clean; only target is perturbed.
     • Adv: Source is perturbed to maximize classification loss.
     • KL: Source is perturbed to maximize KL divergence between clean and perturbed predictions.
  2. MalGuise-based: Uses MCTS-generated adversarial binaries. Variants differ in source transformation:
     • Clean: Source remains clean; only target binaries are mutated.
     • Adv: Source binaries are also mutated via MalGuise.

B. Evaluation Setup

• Dataset: MB-24+, a dataset of Windows malware spanning 9 months (March–December 2024) with high concept drift (27–50% new families monthly).
• Protocol: Monthly adaptation windows where the model is updated with 500 new labeled target samples.
• Metrics:
  • Attack Success Rate (ASR): Percentage of detected malware successfully evading detection after attack.
  • Clean True Positive Rate (TPR): Detection accuracy on unperturbed malware.
  • Computational Cost: Training time and overhead.
• Fairness: ASR is calculated on the intersection of malware samples detected by all models to ensure a fair comparison.

3. Key Contributions

1. First Study: The first adversarial robustness study of a Domain Adaptation (DA)-based malware detector under concept drift.
2. Dual Threat Evaluation: The first evaluation of both white-box (PGD) and black-box (MalGuise) attacks against a drift-adaptive system.
3. Universal Framework: A robustification framework agnostic to attack type and transformation choice, instantiated with five specific defense variants.
4. Empirical Insights: Discovery that robustness does not transfer across threat models and that the necessity of source-domain adversarial training depends entirely on the attack type.

4. Key Results

A. Vulnerability of Baseline

The undefended AdvDA model is completely vulnerable to PGD attacks (100% ASR) and moderately vulnerable to MalGuise attacks (13% ASR).

B. Defense Performance by Threat Model

• Against PGD (White-Box):
  • Source Training is Essential: Defenses that perturb the source domain (DART-adv, DART-kl) drastically reduce ASR to 3.2%.
  • Target-Only is Insufficient: DART (clean), which only perturbs the target, fails to generalize, resulting in ~28% ASR.
  • Budget Matching: Robustness is highly local; models trained on weak perturbations ($\epsilon=2/255$) fail against strong attacks ($\epsilon=8/255$).
• Against MalGuise (Black-Box):
  • Source Training is Counterproductive: Perturbing the source (MalGuise-adv) yields only a marginal ASR reduction (from 5.1% to 3.2%) but causes a severe drop in Clean TPR (32–44%) and a massive 76.8x increase in training cost.
  • Target-Only Suffices: MalGuise (clean) achieves 5.1% ASR with TPR comparable to the undefended model.
  • Implicit Robustness: The undefended AdvDA already shows surprising resilience to MalGuise (13% ASR) because the domain-adapted feature extractor (ResNet-18) attenuates sparse, localized binary changes.

C. Cross-Attack Robustness (Transferability)

• No Transfer: Robustness is not transferable between threat models.
  • DART-based defenses (robust to PGD) offer zero protection against MalGuise (100% ASR).
  • MalGuise-based defenses (robust to MalGuise) offer zero protection against PGD (100% ASR).
• Conclusion: Robustness is a property of the model-threat pairing, not the model itself.

D. Practical Trade-offs

• PGD Defense: Requires source adversarial training. DART (kl) is recommended for the best balance of robustness, TPR, and cost.
• MalGuise Defense: Requires only target adversarial training. MalGuise (clean) is recommended; adding source perturbation is inefficient and harmful to clean accuracy.

5. Significance and Implications

• Paradigm Shift: The paper challenges the assumption that robustness learned on a source domain automatically transfers to a target domain in drift-adaptive settings.
• Defense Strategy: Practitioners cannot use a single "one-size-fits-all" defense. They must select defenses based on the anticipated attack vector:
  • If the threat is feature-space (PGD), source adversarial training is mandatory.
  • If the threat is binary-level (MalGuise), source adversarial training is detrimental and should be avoided.
• Future Direction: The authors propose a multi-view defense architecture (an ensemble of specialized detectors) as the only viable path to defend against both attack types simultaneously, forcing attackers to solve a joint optimization problem across structurally distinct perturbation spaces.

In summary, the paper demonstrates that while drift-adaptive malware detectors can be hardened, doing so requires highly specific strategies tailored to the attack geometry, and robustness against one type of evasion does not imply resilience against others.