Domain Constraints in Feature Space: Strengthening Robustness of Android
  Malware Detection against Realizable Adversarial Examples
  Strengthening the robustness of machine learning-based malware detectors
against realistic evasion attacks remains one of the major obstacles for
Android malware detection. To that end, existing work has focused on
interpreting domain constraints of Android malware in the problem space, where
problem-space realizable adversarial examples are generated. In this paper, we
provide another promising way to achieve the same goal but based on
interpreting the domain constraints in the feature space, where feature-space
realizable adversarial examples are generated. Specifically, we present a novel
approach to extracting feature-space domain constraints by learning meaningful
feature dependencies from data, and applying them based on a novel robust
feature space. Experimental results successfully demonstrate the effectiveness
of our novel robust feature space in providing adversarial robustness for
DREBIN, a state-of-the-art Android malware detector. For example, it can
decrease the evasion rate of a realistic gradient-based attack by $96.4\%$ in a
limited-knowledge (transfer) setting and by $13.8\%$ in a more challenging,
perfect-knowledge setting. In addition, we show that directly using our learned
domain constraints in the adversarial retraining framework leads to about
$84\%$ improvement in a limited-knowledge setting, with up to $377\times$
faster implementation than using problem-space adversarial examples.
