REPLICANT 能让恶意软件绕过检测，还能帮安全人员训练更强大的检测器，效果提升近四成。
REPLICANT 是一种深度强化学习框架，在严格的仅标签黑盒威胁模型下学习规避技术。该框架可重用策略，适用于不同样本、检测器和特征空间。在七个 Android 恶意软件检测器和三种特征空间测试中，REPLICANT 实现了 78.8% 的平均攻击成功率，比现有技术提高 20.9%-39.2%。当用于对抗训练时，REPLICANT 产生的检测器具有更强的泛化鲁棒性。
REPLICANT: Learning Policies for Evading and Hardening Malware Detectors
To determine the real-world effectiveness of machine learning based malware detection, it is vital to evaluate its robustness against highly capable adversaries. However, state-of-the-art attacks do not effectively model realistic adversaries, as they often assume access to privileged information such as the training data, feature space, or confidence scores of the target. In this work, we present Replicant, a deep reinforcement learning framework that learns the realistic task of evasion under a strict label-only black-box threat model. Replicant learns a reusable policy on how to modify a malware sample and when to query the target, which transfers across samples, detectors, and feature spaces. Across seven Android malware detectors and three feature spaces, Replicant is the strongest and most query-efficient approach achieving a mean attack success rate of 78.8%, a relative improvement of 20.9%-39.2% over the state-of-the-art. Furthermore, when used for adversarial training, Replicant also outperforms the state-of-the art by producing detectors with more generalizable robustness. With Replicant we demonstrate that learning the task of evasion not only results in stronger attack performance but, crucially, provides a better signal for hardening malware detectors.