Abstract During the past four years, Flash malware has become one of the most insidious threats to detect, with almost 600 critical vulnerabilities targeting Adobe Flash Player disclosed in the wild. Research has shown that machine learning can be successfully used to detect Flash malware by leveraging static analysis to extract information from the structure of the file or its bytecode. However, the robustness of Flash malware detectors against well-crafted evasion attempts - also known as adversarial examples - has never been investigated. In this paper, we propose a security evaluation of a novel, representative Flash detector that embeds a combination of the prominent, static features employed by state-of-the-art tools. In particular, we discuss how to craft adversarial Flash malware examples, showing that it suffices to manipulate the corresponding source malware samples slightly to evade detection. We then empirically demonstrate that popular defense techniques proposed to mitigate evasion attempts, including re-training on adversarial examples, may not always be sufficient to ensure robustness. We argue that this occurs when the feature vectors extracted from adversarial examples become indistinguishable from those of benign data, meaning that the given feature representation is intrinsically vulnerable. In this respect, we are the first to formally define and quantitatively characterize this vulnerability, highlighting when an attack can be countered by solely improving the security of the learning algorithm, or when it requires also considering additional features. We conclude the paper by suggesting alternative research directions to improve the security of learning-based Flash malware detectors.

中文翻译：

---

Flash 恶意软件的对抗性检测：局限性和未解决的问题

摘要 在过去四年中，Flash 恶意软件已成为最需要检测的威胁之一，近 600 个针对 Adob​​e Flash Player 的严重漏洞被公开披露。研究表明，通过利用静态分析从文件或其字节码的结构中提取信息，机器学习可以成功地用于检测 Flash 恶意软件。然而，Flash 恶意软件检测器对精心设计的规避尝试（也称为对抗性示例）的稳健性从未被调查过。在本文中，我们提出了一种新颖的、具有代表性的 Flash 检测器的安全评估，该检测器嵌入了最先进工具采用的突​​出静态特征的组合。我们特别讨论了如何制作对抗性 Flash 恶意软件示例，表明它足以稍微操纵相应的源恶意软件样本以逃避检测。然后，我们凭经验证明，为减轻逃避尝试而提出的流行防御技术，包括对对抗性示例的重新训练，可能并不总是足以确保稳健性。我们认为，当从对抗样本中提取的特征向量与良性数据的特征向量无法区分时，就会发生这种情况，这意味着给定的特征表示本质上是脆弱的。在这方面，我们是第一个正式定义和定量描述此漏洞的人，强调何时可以仅通过提高学习算法的安全性来应对攻击，或者何时还需要考虑其他功能。