EvadeDroid: A Practical Evasion Attack on Machine Learning for Black-box
  Android Malware Detection
  Over the last decade, several studies have investigated the weaknesses of
Android malware detectors against adversarial examples by proposing novel
evasion attacks; however, their practicality in manipulating real-world malware
remains arguable. The majority of studies have assumed attackers know the
details of the target classifiers used for malware detection, while in reality,
malicious actors have limited access to the target classifiers. This paper
presents a practical evasion attack, EvadeDroid, to circumvent black-box
Android malware detectors. In addition to generating real-world adversarial
malware, the proposed evasion attack can also preserve the functionality of the
original malware samples. EvadeDroid prepares a collection of
functionality-preserving transformations using an n-gram-based similarity
method, which are then used to morph malware instances into benign ones via an
iterative and incremental manipulation strategy. The proposed manipulation
technique is a novel, query-efficient optimization algorithm with the aim of
finding and injecting optimal sequences of transformations into malware
samples. Our empirical evaluation demonstrates the efficacy of EvadeDroid under
hard- and soft-label attacks. Moreover, EvadeDroid is capable to generate
practical adversarial examples with only a small number of queries, with
evasion rates of $81\%$, $73\%$, $75\%$, and $79\%$ for DREBIN, Sec-SVM,
MaMaDroid, and ADE-MA, respectively. Finally, we show that EvadeDroid is able
to preserve its stealthiness against five popular commercial antivirus, thus
demonstrating its feasibility in the real world.
