model_extraction_malware

Repository for the paper Stealing Malware Classifiers and antivirus at Low False Positive Conditions

Usage

In order to generate a surrogate model you need to specify the target, the surrogate type, the sampling method and the dataset. Please see the details below for the allowed values for each parameter.

python model_extraction.py -h                               
usage: Model extraction using active learning techniques [-h] -d DATA_DIR [-s SEED] [-m METHOD] [-n NUM_QUERIES] [-b BUDGET]
                                                         [-e NUM_EPOCHS] [-t {DNN,dualDNN,LGB,SVM}] [-l LOG_DIR]
                                                         [-tg {ember,sorel-FCNN,sorel-LGB,AV1,AV2,AV3,AV4}]
                                                         [-f {top10families,Adload,WannaCry,Pykse,Azorult,Bancteian,Emotet,Swisyn,Vobfus}]
                                                         [--dataset {ember,sorel,AV}] [--fpr FPR]

optional arguments:
  -h, --help            show this help message and exit
  -d DATA_DIR, --data_dir DATA_DIR
                        Directory that holds the data
  -s SEED, --seed SEED  Seed for random states
  -m METHOD, --method METHOD
                        entropy, random, medoids, mc_dropout, k-center, ensemble
  -n NUM_QUERIES, --num_queries NUM_QUERIES
                        Number of query rounds
  -b BUDGET, --budget BUDGET
                        Total query budget
  -e NUM_EPOCHS, --num_epochs NUM_EPOCHS
                        Number of training epochs per round
  -t {DNN,dualDNN,LGB,SVM}, --type {DNN,dualDNN,LGB,SVM}
                        Type of surrogate model
  -l LOG_DIR, --log_dir LOG_DIR
                        Where to store the log files with the results
  -tg {ember,sorel-FCNN,sorel-LGB,AV1,AV2,AV3,AV4}, --target_model {ember,sorel-FCNN,sorel-LGB,AV1,AV2,AV3,AV4}
                        Target model
  -f {top10families,Adload,WannaCry,Pykse,Azorult,Bancteian,Emotet,Swisyn,Vobfus}, --family {top10families,Adload,WannaCry,Pykse,Azorult,Bancteian,Emotet,Swisyn,Vobfus}
                        Select top10 families or one specific malware family
  --dataset {ember,sorel,AV}
                        Thief and test dataset
  --fpr FPR             FPR level for surrogate merics.

Example

The following command will create a LightGBM surrogate model and it will store it in the output folder (/tmp/logs) along with a log file with the results for each iteration.

python model_extraction.py --data_dir /data/mari/sorel-data --dataset sorel --seed 42 --method medoids --type LGB --target_model sorel-FCNN --num_epochs 1 --num_queries 10 --log_dir "/tmp/logs/" --budget 2500 --fpr 0.006

If you use this code please cite:

@article{RIGAKI2023103192,
  title = {Stealing and evading malware classifiers and antivirus at low false positive conditions},
  journal = {Computers & Security},
  volume = {129},
  pages = {103192},
  year = {2023},
  issn = {0167-4048},
  doi = {https://doi.org/10.1016/j.cose.2023.103192},
  url = {https://www.sciencedirect.com/science/article/pii/S0167404823001025},
  author = {M. Rigaki and S. Garcia},
}