SecML Malware plugin

PyPI GitHub code size in bytes GitHub issues PyPI - Python Version PyPI - Downloads

This is a plugin for the SecML Python library. There is a pre-trained MalConv model trained by EndGame, included in this project for testing.

Included Attacks

Installation

Navigate to the folder where you want to clone the project. I recommend creating a new environment (I use conda):

conda create -n secml_malware_env python=3.7
conda activate secml_malware_env
pip install secml-malware
pip install git+https://github.com/endgameinc/ember.git

You also need to install pytorch, find instructions here.

Troubleshooting possible errors

If you encouter problem due to libmagic, follow this instruction. If, for some reason, the installation through pip does not work, install ember and pytorch as described before, then:

git clone https://github.com/zangobot/secml_malware.git
cd secml_malware
pip install -r requirements.txt

How to use

Activate your environment, and import the secml_malware package inside your script:

import secml_malware
print(secml_malware.__version__)

The tests included in this project show how the library can be used for applying the manipulation to the input programs. There is also an example Jupyter notebook tutorial that shows how to build a apply a standard attack.

Docker

There is also a Dockerfile that can be used to start a container and test the library without messing with virtual environments!

docker build --tag secml_malware:0.2 .
docker run --rm -it secml_malware:0.2 bash

The container is also shipped with ipython, for a more interactive experience with this library.

Cite

Depending on the manipulations / formalization you are using, please cite our work:

Content shifting and DOS header extension manipulations or RAMEn formalization

@article{demetrio2020adversarial,
    title={Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection},
    author={Luca Demetrio and Scott E. Coull and Battista Biggio and Giovanni Lagorio and Alessandro Armando and Fabio Roli},
    year={2020},
    eprint={2008.07125},
    archivePrefix={arXiv},
    primaryClass={cs.CR}
}

GAMMA

@misc{demetrio2021functionalitypreserving,
      title={Functionality-preserving Black-box Optimization of Adversarial Windows Malware},
      author={Luca Demetrio and Battista Biggio and Giovanni Lagorio and Fabio Roli and Alessandro Armando},
      year={2021},
      eprint={2003.13526},
      archivePrefix={arXiv},
      primaryClass={cs.CR}
}

Partial DOS manipulation

@inproceedings{demetrio2019explaining,
  title={Explaining Vulnerabilities of Deep Learning to Adversarial Malware Binaries},
  author={Luca Demetrio and Battista Biggio and Giovanni Lagorio and Fabio Roli and Alessandro Alessandro},
  booktitle={ITASEC19},
  volume={2315},
  year={2019}
}

Bug reports

If you encounter something strange, feel free to open an issue! I am working a lot, and bugs are present everywhere. Let me know, and I’ll try to fix them as soon as possible.

Testing

I provide a small test suite for the attacks I have developed inside the plugin. If you want to run them, ADD GOODWARE/MALWARE samples! There are two distinct folders:

secml_malware/data/goodware_samples
secml_malware/data/malware_samples/test_folder

Please, add samples to both folders (if and only if you want to run the internal tests).

Indices and tables