DNN-GRAD: Exploiting Membership Inference for Adversarial Attacks on Malware Detection Models

Android is currently the most dominant mobile operating system, with over 70 % of smartphones using it. This widespread adoption makes malware developers target Android devices to exploit security vulnerabilities. Current mal ware de-tection solutions use a combination of traditional signature and heuristics-based methods along with newer machine learning-based methods for protection against evolving malware attacks. While effective, machine learning models are often vulnerable to adversarial attacks. Adversaries can carefully perturb malware samples to evade detection by these models. Furthermore, these models are known to leak information about their training data, which adversaries can exploit to infer private and sensitive information via membership inference attacks. In this study, we propose a novel method to exploit membership information to improve the effectiveness of adversarial attacks. This method effectively selects a subset of available data using membership information leaked from the target model, allowing one to better approximate the target model's training data. Training a local model with the selected data, we demonstrate that an attacker can improve the effectiveness of the attack, achieving a 17 % increase in fooling rate while using 15 % less data compared to using all available data. We then propose DNN-GRAD, a grey-box gradient-based adversarial attack which, by using this leaked membership information, achieves a fooling rate of 56.69 % against various machine learning-based malware detectors. We also demonstrate that a combination of defences like adversarial training and regularization reduces the fooling rate by 46 % reduction in fooling rate across various model architectures.