REPLICANT: Learning Policies to Evade and Harden Malware Detectors

Researchers propose a deep reinforcement learning framework, Replicant, that learns policies for evading machine learning malware detectors under a strict label-only black-box threat model. Addressing the problem that existing state-of-the-art attacks often assume access to privileged information such as training data, feature space, or confidence scores and struggle to model realistic high-capability adversaries, Replicant learns how to modify malware samples and when to query the target, and the learned policy transfers across samples, detectors, and feature spaces. Across seven Android malware detectors and three feature spaces, it achieves an average attack success rate of 78.8%, a relative improvement of 20.9%-39.2% over existing state-of-the-art methods, and the highest query efficiency. The authors state that using it for adversarial training also produces detectors with more generalizable robustness, providing a better signal for hardening malware detectors.