Weaponizing Ground Truth: Data Poisoning Attacks by Exploiting Boundary Misalignment Between Antivirus Software and Learning-Based Detectors
Bi-Iocane poisons ML malware detectors by flipping antivirus labels with tiny byte edits.
Bi-Iocane is a black-box poisoning framework that abuses antivirus labels used to supervise machine-learning malware detectors. Small edits to AV-sensitive bytes flip malware to benign labels and benign software to malicious labels, including under simulated aggregation of 13 AV engines. After poisoned samples entered training, eight ML detectors misclassified 92.08% of 60 original clean targets on average, with only a 0.06% poisoning budget per target. Clean-set performance largely remained, six defenses offered limited mitigation, and VirusTotal testing indicated practical defamation risk.
- Attack flips AV labels while leaving ML feature views mostly unchanged.
- Tested with 13 antivirus engines and eight ML detectors.
- Models misclassified 92.08% of clean targets at a 0.06% poison budget.
- Six poisoning defenses showed limited mitigation; VirusTotal confirmed defamation risk.
- Organizations
- VirusTotal
From the original article
1 min read at arxiv.orgMachine-learning (ML)-based malware detectors are commonly trained using labels obtained from antivirus (AV) engines and aggregation services (e. g. , VirusTotal).
By Jieshuai Yang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.