CertRob: Detecting PDF Malware with Certified Adversarial Robustness via Randomization Smoothing

Adversarial examples challenge PDF malware classifiers. Current defensive approaches offer partial robustness certification for specific attacks, but cannot defend against all adversarial attacks. In this paper, we propose CertRob, a PDF malware detection approach with certified adversarial robustness via randomization smoothing. We construct a comprehensive threat model to address various perturbations in both feature and problem spaces. We apply randomization smoothing training to malicious PDF classifiers, enhancing their robustness. We further optimize the threat model with feature constraints, narrowing the perturbation range and reducing training time. Furthermore, Shapley values prioritize important features during training, reducing randomization. We assess the smoothed PDF classifiers’ effectiveness against various attacks and their robustness certificates across different perturbation distances. Experiments based on the Contagio dataset confirm that CertRob shows strong robustness against both feature-space attacks and problem-space attacks compared to existing defensive approaches.