{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/a-framework-for-validating-models-of-evasion","title":"Improving Robustness of ML Classifiers against Realizable Evasion Attacks Using Conserved Features","arxiv_id":"1708.08327","date":"2017-08-28","proceeding":null,"authors":["Liang Tong","Bo Li","Chen Hajaj","Chaowei Xiao","Ning Zhang","Yevgeniy Vorobeychik"],"abstract":"Machine learning (ML) techniques are increasingly common in security applications, such as malware and intrusion detection. However, ML models are often susceptible to evasion attacks, in which an adversary makes changes to the input (such as malware) in order to avoid being detected. A conventional approach to evaluate ML robustness to such attacks, as well as to design robust ML, is by considering simplified feature-space models of attacks, where the attacker changes ML features directly to effect evasion, while minimizing or constraining the magnitude of this change. We investigate the effectiveness of this approach to designing robust ML in the face of attacks that can be realized in actual malware (realizable attacks). We demonstrate that in the context of structure-based PDF malware detection, such techniques appear to have limited effectiveness, but they are effective with content-based detectors. In either case, we show that augmenting the feature space models with conserved features (those that cannot be unilaterally modified without compromising malicious functionality) significantly improves performance. Finally, we show that feature space models enable generalized robustness when faced with a variety of realizable attacks, as compared to classifiers which are tuned to be robust to a specific realizable attack.","url_abs":"https://arxiv.org/abs/1708.08327v5","url_pdf":"https://arxiv.org/pdf/1708.08327v5.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"a-framework-for-validating-models-of-evasion","repo_url":"https://github.com/shinington/Robust-PDF-Classifier-with-Conserved-Features","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"none","reach":null}],"tasks":[{"task_slug":"intrusion-detection","task_name":"Intrusion Detection"},{"task_slug":"malware-detection","task_name":"Malware Detection"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":null,"atlas_url":"https://app.syntology.ai/?focus=1708.08327","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1708.08327"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/shinington/Robust-PDF-Classifier-with-Conserved-Features","reach":null}],"summary":{"ran_draft_wrong":2,"ran_honours":1,"ran_fixture":1},"by_repo_kind":{"official":{"samples":4,"ran":4,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":4,"samples":[{"code_sha256_prefix":"58dc9fe0c64d4cf7","entry":"classification_score","repo":"shinington/Robust-PDF-Classifier-with-Conserved-Features","repo_kind":"official","path":"src/retrain.py","file_url":"https://github.com/shinington/Robust-PDF-Classifier-with-Conserved-Features/blob/HEAD/src/retrain.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"58dc9fe0c64d4cf7"}},{"code_sha256_prefix":"f489e247e9ce3d0b","entry":"file_paths","repo":"shinington/Robust-PDF-Classifier-with-Conserved-Features","repo_kind":"official","path":"src/evaluate_robustness.py","file_url":"https://github.com/shinington/Robust-PDF-Classifier-with-Conserved-Features/blob/HEAD/src/evaluate_robustness.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f489e247e9ce3d0b"}},{"code_sha256_prefix":"643c2521c05b5e23","entry":"modification_cost","repo":"shinington/Robust-PDF-Classifier-with-Conserved-Features","repo_kind":"official","path":"src/retrain.py","file_url":"https://github.com/shinington/Robust-PDF-Classifier-with-Conserved-Features/blob/HEAD/src/retrain.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"643c2521c05b5e23"}},{"code_sha256_prefix":"fe57c3de660eaa68","entry":"next_point","repo":"shinington/Robust-PDF-Classifier-with-Conserved-Features","repo_kind":"official","path":"src/retrain.py","file_url":"https://github.com/shinington/Robust-PDF-Classifier-with-Conserved-Features/blob/HEAD/src/retrain.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"fe57c3de660eaa68"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}