Being Single Has Benefits. Instance Poisoning to Deceive Malware
  Classifiers
  The performance of a machine learning-based malware classifier depends on the
large and updated training set used to induce its model. In order to maintain
an up-to-date training set, there is a need to continuously collect benign and
malicious files from a wide range of sources, providing an exploitable target
to attackers. In this study, we show how an attacker can launch a sophisticated
and efficient poisoning attack targeting the dataset used to train a malware
classifier. The attacker's ultimate goal is to ensure that the model induced by
the poisoned dataset will be unable to detect the attacker's malware yet
capable of detecting other malware. As opposed to other poisoning attacks in
the malware detection domain, our attack does not focus on malware families but
rather on specific malware instances that contain an implanted trigger,
reducing the detection rate from 99.23% to 0% depending on the amount of
poisoning. We evaluate our attack on the EMBER dataset with a state-of-the-art
classifier and malware samples from VirusTotal for end-to-end validation of our
work. We propose a comprehensive detection approach that could serve as a
future sophisticated defense against this newly discovered severe threat.
