二进制代码相似性检测（BCSD）方法测量了两个二进制可执行代码的相似性。最近，基于学习的BCSD方法取得了巨大的成功，在检测准确性和效率方面表现优于传统的BCSD。但是，现有的研究在基于学习的BCSD方法的对抗脆弱性上相当稀疏，这会导致与安全相关的应用程序危害。为了评估对抗性的鲁棒性，本文设计了一种高效且黑色的对抗代码生成算法，即FuncFooler。 FuncFooler限制了对抗代码1）保持程序的控制流程图（CFG）和2）保持相同的语义含义。具体而言，funcfooler连续1）在恶意代码中确定脆弱的候选人，2）从良性代码中选择和插入对抗性指令，以及3）纠正对抗代码的语义副作用以满足约束。从经验上讲，我们的FuncFooler可以成功攻击包括Safe，ASM2VEC和JTRAN在内的三种基于学习的BCSD模型，它们质疑是否需要基于学习的BCSD。

Machine learning algorithms are often vulnerable to adversarial examples that have imperceptible alterations from the original counterparts but can fool the state-of-the-art models. It is helpful to evaluate or even improve the robustness of these models by exposing the maliciously crafted adversarial examples. In this paper, we present TEXTFOOLER, a simple but strong baseline to generate adversarial text. By applying it to two fundamental natural language tasks, text classification and textual entailment, we successfully attacked three target models, including the powerful pre-trained BERT, and the widely used convolutional and recurrent neural networks. We demonstrate three advantages of this framework:(1) effective-it outperforms previous attacks by success rate and perturbation rate, (2) utility-preserving-it preserves semantic content, grammaticality, and correct types classified by humans, and (3) efficient-it generates adversarial text with computational complexity linear to the text length. 1

恶意软件是跨越多个操作系统和各种文件格式的计算机的最损害威胁之一。为了防止不断增长的恶意软件的威胁，已经提出了巨大的努力来提出各种恶意软件检测方法，试图有效和有效地检测恶意软件。最近的研究表明，一方面，现有的ML和DL能够卓越地检测新出现和以前看不见的恶意软件。然而，另一方面，ML和DL模型本质上易于侵犯对抗性示例形式的对抗性攻击，这通过略微仔细地扰乱了合法输入来混淆目标模型来恶意地产生。基本上，在计算机视觉领域最初广泛地研究了对抗性攻击，并且一些快速扩展到其他域，包括NLP，语音识别甚至恶意软件检测。在本文中，我们专注于Windows操作系统系列中的便携式可执行文件（PE）文件格式的恶意软件，即Windows PE恶意软件，作为在这种对抗设置中研究对抗性攻击方法的代表性案例。具体而言，我们首先首先概述基于ML / DL的Windows PE恶意软件检测的一般学习框架，随后突出了在PE恶意软件的上下文中执行对抗性攻击的三个独特挑战。然后，我们进行全面和系统的审查，以对PE恶意软件检测以及增加PE恶意软件检测的稳健性的相应防御，对近最新的对手攻击进行分类。我们首先向Windows PE恶意软件检测的其他相关攻击结束除了对抗对抗攻击之外，然后对未来的研究方向和机遇脱落。

可提供许多开源和商业恶意软件探测器。然而，这些工具的功效受到新的对抗性攻击的威胁，由此恶意软件试图使用例如机器学习技术来逃避检测。在这项工作中，我们设计了依赖于特征空间和问题空间操纵的对抗逃避攻击。它使用可扩展性导向特征选择来最大限度地通过识别影响检测的最关键的特征来最大限度地逃避。然后，我们将此攻击用作评估若干最先进的恶意软件探测器的基准。我们发现（i）最先进的恶意软件探测器容易受到简单的逃避策略，并且可以使用现成的技术轻松欺骗; （ii）特征空间操纵和问题空间混淆可以组合起来，以便在不需要对探测器的白色盒子理解的情况下实现逃避; （iii）我们可以使用解释性方法（例如，Shap）来指导特征操纵并解释攻击如何跨多个检测器传输。我们的调查结果阐明了当前恶意软件探测器的弱点，以及如何改善它们。

深度神经网络（DNN）越来越多地应用于恶意软件检测中，其鲁棒性已广泛争论。传统上，对抗性示例生成方案依赖于详细的模型信息（基于梯度的方法）或许多样本来训练替代模型，在大多数情况下都无法使用。我们提出了基于实例的攻击的概念。我们的方案是可解释的，可以在黑箱环境中起作用。给定一个特定的二进制示例和恶意软件分类器，我们使用数据增强策略来生成足够的数据，我们可以从中训练一个简单的可解释模型。我们通过显示特定二进制的不同部分的重量来解释检测模型。通过分析解释，我们发现数据小节在Windows PE恶意软件检测中起重要作用。我们提出了一个新函数，以保存可以应用于数据子分校的转换算法。通过采用我们提出的二进制多样化技术，我们消除了最加权零件对产生对抗性例子的影响。在某些情况下，我们的算法可以欺骗DNN，成功率接近100 \％。我们的方法的表现优于最新方法。最重要的方面是我们的方法在黑框设置中运行，并且可以通过域知识来验证结果。我们的分析模型可以帮助人们改善恶意软件探测器的鲁棒性。

Strengthening the robustness of machine learning-based Android malware detectors in the real world requires incorporating realizable adversarial examples (RealAEs), i.e., AEs that satisfy the domain constraints of Android malware. However, existing work focuses on generating RealAEs in the problem space, which is known to be time-consuming and impractical for adversarial training. In this paper, we propose to generate RealAEs in the feature space, leading to a simpler and more efficient solution. Our approach is driven by a novel interpretation of Android malware properties in the feature space. More concretely, we extract feature-space domain constraints by learning meaningful feature dependencies from data and applying them by constructing a robust feature space. Our experiments on DREBIN, a well-known Android malware detector, demonstrate that our approach outperforms the state-of-the-art defense, Sec-SVM, against realistic gradient- and query-based attacks. Additionally, we demonstrate that generating feature-space RealAEs is faster than generating problem-space RealAEs, indicating its high applicability in adversarial training. We further validate the ability of our learned feature-space domain constraints in representing the Android malware properties by showing that (i) re-training detectors with our feature-space RealAEs largely improves model performance on similar problem-space RealAEs and (ii) using our feature-space domain constraints can help distinguish RealAEs from unrealizable AEs (unRealAEs).

Decompilation aims to transform a low-level program language (LPL) (eg., binary file) into its functionally-equivalent high-level program language (HPL) (e.g., C/C++). It is a core technology in software security, especially in vulnerability discovery and malware analysis. In recent years, with the successful application of neural machine translation (NMT) models in natural language processing (NLP), researchers have tried to build neural decompilers by borrowing the idea of NMT. They formulate the decompilation process as a translation problem between LPL and HPL, aiming to reduce the human cost required to develop decompilation tools and improve their generalizability. However, state-of-the-art learning-based decompilers do not cope well with compiler-optimized binaries. Since real-world binaries are mostly compiler-optimized, decompilers that do not consider optimized binaries have limited practical significance. In this paper, we propose a novel learning-based approach named NeurDP, that targets compiler-optimized binaries. NeurDP uses a graph neural network (GNN) model to convert LPL to an intermediate representation (IR), which bridges the gap between source code and optimized binary. We also design an Optimized Translation Unit (OTU) to split functions into smaller code fragments for better translation performance. Evaluation results on datasets containing various types of statements show that NeurDP can decompile optimized binaries with 45.21% higher accuracy than state-of-the-art neural decompilation frameworks.

Binary code similarity detection (BCSD) is widely used in various binary analysis tasks such as vulnerability search, malware detection, clone detection, and patch analysis. Recent studies have shown that the learning-based binary code embedding models perform better than the traditional feature-based approaches. In this paper, we proposed a novel transformer-based binary code embedding model, named UniASM, to learn representations of the binary functions. We designed two new training tasks to make the spatial distribution of the generated vectors more uniform, which can be used directly in BCSD without any fine-tuning. In addition, we proposed a new tokenization approach for binary functions, increasing the token's semantic information while mitigating the out-of-vocabulary (OOV) problem. The experimental results show that UniASM outperforms state-of-the-art (SOTA) approaches on the evaluation dataset. We achieved the average scores of recall@1 on cross-compilers, cross-optimization-levels and cross-obfuscations are 0.72, 0.63, and 0.77, which is higher than existing SOTA baselines. In a real-world task of known vulnerability searching, UniASM outperforms all the current baselines.

普遍的对策扰动是图像不可思议的和模型 - 无关的噪声，当添加到任何图像时可以误导训练的深卷积神经网络进入错误的预测。由于这些普遍的对抗性扰动可以严重危害实践深度学习应用的安全性和完整性，因此现有技术使用额外的神经网络来检测输入图像源的这些噪声的存在。在本文中，我们展示了一种攻击策略，即通过流氓手段激活（例如，恶意软件，木马）可以通过增强AI硬件加速器级的对抗噪声来绕过这些现有对策。我们使用Conv2D功能软件内核的共同仿真和FuseSoC环境下的硬件的Verilog RTL模型的共同仿真，展示了关于几个深度学习模型的加速度普遍对抗噪声。

Pre-trained programming language (PL) models (such as CodeT5, CodeBERT, GraphCodeBERT, etc.,) have the potential to automate software engineering tasks involving code understanding and code generation. However, these models operate in the natural channel of code, i.e., they are primarily concerned with the human understanding of the code. They are not robust to changes in the input and thus, are potentially susceptible to adversarial attacks in the natural channel. We propose, CodeAttack, a simple yet effective black-box attack model that uses code structure to generate effective, efficient, and imperceptible adversarial code samples and demonstrates the vulnerabilities of the state-of-the-art PL models to code-specific adversarial attacks. We evaluate the transferability of CodeAttack on several code-code (translation and repair) and code-NL (summarization) tasks across different programming languages. CodeAttack outperforms state-of-the-art adversarial NLP attack models to achieve the best overall drop in performance while being more efficient, imperceptible, consistent, and fluent. The code can be found at https://github.com/reddy-lab-code-research/CodeAttack.

基于预先训练的语言模型（PRLMS）在源代码理解任务中取得的巨大成功，当前的文献研究要么进一步改善PRLM的性能（概括）或对对抗性攻击的鲁棒性。但是，他们必须在这两个方面之间的权衡方面妥协，而且它们都没有考虑以有效和实用的方式改善双方。为了填补这一空白，我们建议使用语义保护对抗代码嵌入（空间），以找到最坏的传播语义保留攻击，同时迫使模型在这些最坏情况下预测正确的标签。实验和分析表明，在提高PRLMS代码的性能的同时，空间可以保持强大的防御性攻击。

对抗性鲁棒性评估了机器学习模型的最坏情况性能方案，以确保其安全性和可靠性。这项研究是第一个研究视觉接地对话模型对文本攻击的鲁棒性的一项。这些攻击代表了最坏的情况，其中输入问题包含一个同义词，该代名词导致先前正确的模型返回错误的答案。使用这种情况，我们首先旨在了解多模式输入组件如何促进模型鲁棒性。我们的结果表明，编码对话框历史记录的模型更强大，并且在对历史记录发动攻击时，模型预测变得更加不确定。这与先前的工作相反，后者发现对话记录在此任务上的模型性能可以忽略不计。我们还评估了如何生成对抗性测试示例，这些测试示例成功地欺骗了模型，但仍未被用户/软件设计人员发现。我们发现文本以及视觉上下文对于生成合理的最坏情况很重要。

尽管机器学习容易受到对抗性示例的影响，但它仍然缺乏在不同应用程序上下文中评估其安全性的系统过程和工具。在本文中，我们讨论了如何使用实际攻击来开发机器学习的自动化和可扩展的安全性评估，并在Windows恶意软件检测中报告了用例。

This paper introduces and presents a new language named MAIL (Malware Analysis Intermediate Language). MAIL is basically used for building malware analysis and detection tools. MAIL provides an abstract representation of an assembly program and hence the ability of a tool to automate malware analysis and detection. By translating binaries compiled for different platforms to MAIL, a tool can achieve platform independence. Each MAIL statement is annotated with patterns that can be used by a tool to optimize malware analysis and detection.

深度学习技术的发展极大地促进了自动语音识别（ASR）技术的性能提高，该技术证明了在许多任务中与人类听力相当的能力。语音接口正变得越来越广泛地用作许多应用程序和智能设备的输入。但是，现有的研究表明，DNN很容易受到轻微干扰的干扰，并且会出现错误的识别，这对于由声音控制的智能语音应用非常危险。

Deep learning methods have gained increased attention in various applications due to their outstanding performance. For exploring how this high performance relates to the proper use of data artifacts and the accurate problem formulation of a given task, interpretation models have become a crucial component in developing deep learning-based systems. Interpretation models enable the understanding of the inner workings of deep learning models and offer a sense of security in detecting the misuse of artifacts in the input data. Similar to prediction models, interpretation models are also susceptible to adversarial inputs. This work introduces two attacks, AdvEdge and AdvEdge$^{+}$, that deceive both the target deep learning model and the coupled interpretation model. We assess the effectiveness of proposed attacks against two deep learning model architectures coupled with four interpretation models that represent different categories of interpretation models. Our experiments include the attack implementation using various attack frameworks. We also explore the potential countermeasures against such attacks. Our analysis shows the effectiveness of our attacks in terms of deceiving the deep learning models and their interpreters, and highlights insights to improve and circumvent the attacks.

Video classification systems are vulnerable to adversarial attacks, which can create severe security problems in video verification. Current black-box attacks need a large number of queries to succeed, resulting in high computational overhead in the process of attack. On the other hand, attacks with restricted perturbations are ineffective against defenses such as denoising or adversarial training. In this paper, we focus on unrestricted perturbations and propose StyleFool, a black-box video adversarial attack via style transfer to fool the video classification system. StyleFool first utilizes color theme proximity to select the best style image, which helps avoid unnatural details in the stylized videos. Meanwhile, the target class confidence is additionally considered in targeted attacks to influence the output distribution of the classifier by moving the stylized video closer to or even across the decision boundary. A gradient-free method is then employed to further optimize the adversarial perturbations. We carry out extensive experiments to evaluate StyleFool on two standard datasets, UCF-101 and HMDB-51. The experimental results demonstrate that StyleFool outperforms the state-of-the-art adversarial attacks in terms of both the number of queries and the robustness against existing defenses. Moreover, 50% of the stylized videos in untargeted attacks do not need any query since they can already fool the video classification model. Furthermore, we evaluate the indistinguishability through a user study to show that the adversarial samples of StyleFool look imperceptible to human eyes, despite unrestricted perturbations.

机器学习算法已被证明通过系统修改（例如，图像识别）中的输入（例如，对抗性示例）的系统修改（例如，对抗性示例）容易受到对抗操作的影响。在默认威胁模型下，对手利用了图像的无约束性质。每个功能（像素）完全由对手控制。但是，尚不清楚这些攻击如何转化为限制对手可以修改的特征以及如何修改特征的约束域（例如，网络入侵检测）。在本文中，我们探讨了受约束的域是否比不受约束的域对对抗性示例生成算法不那么脆弱。我们创建了一种用于生成对抗草图的算法：针对性的通用扰动向量，该向量在域约束的信封内编码特征显着性。为了评估这些算法的性能，我们在受约束（例如网络入侵检测）和不受约束（例如图像识别）域中评估它们。结果表明，我们的方法在约束域中产生错误分类率，这些域与不受约束的域（大于95％）相当。我们的调查表明，受约束域暴露的狭窄攻击表面仍然足够大，可以制作成功的对抗性例子。因此，约束似乎并不能使域变得健壮。实际上，只有五个随机选择的功能，仍然可以生成对抗性示例。

恢复程序的呼叫图对于基于流程间分析任务和应用程序至关重要。核心挑战是识别间接呼叫的目标（即，间接分支机构）。由于二进制文件中的信息丢失，如果目标程序以二元形式为二元形式，则变得更具挑战性。二进制文件的现有间接Callee识别解决方案都具有高误报和负面，使呼叫图不准确。在本文中，我们提出了一种基于暹罗神经网络的新解决方案，受到质疑答案应用的进步的启发。关键洞察力是，神经网络可以学习通过理解其上下文，即附近呼叫和分支机构的指示是间接代表的潜在目标。在此洞察力之后，我们首先预处理目标二进制文件，以提取电话和分支的上下文。然后，我们构建适用于汇编语言的自定义自然语言处理（NLP）模型。此外，我们收集了丰富的呼叫和分支，并将其上下文与NLP模型嵌入，然后培训暹罗网络和分类器以回答电呼叫路上的问题。我们已经实施了Inclelee的原型，并在几组目标上进行了评估。评价结果表明，我们的解决方案可以将手段与F1措施相匹配93.7％，召回的93.8％，精度为93.5％，比最先进的解决方案好得多。为了展示其有用性，我们将iCallee应用于两个特定的应用 - 二进制代码相似性检测和二进制程序硬化，并发现它可以大大提高最先进的解决方案。

尽管深度神经网络（DNNS）的对抗性鲁棒性研究取得了迅速的进展，但对于时间序列领域，几乎没有原则上的工作。由于时间序列数据出现在包括移动健康，金融和智能电网在内的各种应用中，因此验证和改善DNN在时间序列域的鲁棒性很重要。在本文中，我们为时间序列域提出了一个新颖的框架，称为{\ em动态时间扭曲，用于使用动态时间扭曲度量，以实现对抗性鲁棒性（DTW-AR）}。提供了理论和经验证据，以证明DTW对图像结构域的先前方法中采用的标准欧几里得距离度量的有效性。我们通过理论分析开发了一种原则性的算法，可以使用随机比对路径有效地创建各种对抗性示例。对不同现实世界基准的实验表明，DTW-AR对愚弄DNNS的有效性来欺骗时间序列数据，并使用对抗性训练提高其鲁棒性。 DTW-AR算法的源代码可在https://github.com/tahabelkhouja/dtw-ar上获得