DroidBreaker: a practical, functionality-preserving problem-space attack against machine learning Android malware detectors
DroidBreaker: Practical and Functional Problem-Space Attacks on Machine-Learning Android Malware Detectors
AI summary
DroidBreaker is a practical, functionality-preserving problem-space attack framework against machine learning Android malware detectors. It manipulates only the APK components with the greatest influence on the target model, supports white-box/black-box attacks, and uses fine-grained injection/obfuscation plus execution-log and API-level trace comparison to preserve APK runtime behavior and reduce side effects. On recent Android corpora, it achieves high evasion rates with a small number of queries and substantially reduces detection by commercial scanners on VirusTotal.