| As a popular form of cloud service,Deep Learning as a Service(DLaaS)refers to a platform for cloud service,which provides convenient training of deep neural networks.Deep neural networks have achieved good results in Android malware detection.However,due to the lack of robustness of deep neural networks,as the weakest part of DLaaS,deep neural networks are often deceived by adversarial samples carefully designed by attackers.Therefore,DLaaS deployed in the cloud is not secure.Existing adversarial sample generation attacks on DLaaS mainly focus on image classification services.Such attacks modify a large number of pixels so that Android software cannot be used,which are not suitable for Android malware detection services.Therefore,with regard to attacks on Android adversarial samples,how to reduce the feature modification of Android adversarial samples and the number of queries to DLaaS is an important challenge.In the defense of Android adversarial samples,how to accurately detect Android adversarial samples is also an important challenge.Thus this paper proposes a new Bayesian optimization-based Android adversarial sample generation framework OFEI in the case of a semi-black box.The framework uses Bayesian optimization and simulated annealing in each feature modification process.In the query process,OFEI is different from the GenAttack attack algorithm that uses random query.OFEI uses Bayesian optimization to build a Gaussian model for querying historical information to predict the next sample of DLaaS to be queried,and uses simulated annealing to limit the maximum number of queries.Therefore,OFEI reduces the number of queries to DLaaS.In the process of modifying features,OFEI is different from GenAttack based on genetic algorithm and PointWiseAttack with noise.OFEI uses simulated annealing in each iteration to modify the features that have the greatest impact on the output of DLaaS.Therefore,OFEI has the advantage of modifying fewer features.This paper evaluates the OFEI framework through comparative experiments with benchmark methods JSMF,GenAttack and Point Wise Attack.Experimental results show that the OFEI can reduce at most 5 features and reduce more than 2000 queries while ensuring a slightly higher misclassification rate than JSMF.Besides,the OFEI sample generation framework is able to be an extension of the traditional whitebox attack methods in the image field to generate Android adversarial samples.Finally,this paper proposes an Android defense framework based on Bayesian uncertainty.The defense framework uses two types of uncertainties to detect Android adversarial samples.So it is capable of defending against uncertainties-based attacks.The previous methods of detecting adversarial samples only used the epistemic uncertainty of the output layer.However,this paper not only extracts the epistemic uncertainty from the hidden layer of the deep neural network,but also extracts the aleatoric uncertainty related to data errors through the Bayesian neural network,and finally constitute a combined uncertainty.Compared with other traditional defense methods,Experiments show that combined uncertainty can accurately detect Android adversarial samples,reducing the model’s misclassification rate by up to 30%. |
