Adversarial Attack with Genetic Algorithm against IoT Malware Detectors

The exponential growth and sophistication of Internet of Things (IoT) malware behavior have resulted in new detection technologies capable of defending IoT devices against some threats. However, their success has stimulated the interest of attackers attempting to circumvent current IoT malware detectors. Among detection technologies, the detectors trained based on Uniform Resource Locator (URL) requests have become popular. To draw attention to the safety of the detectors, we propose a grey-box method to attack detectors based on URL requests without breaking malicious functions of URL requests. The key idea is to add perturbations to the tail of URLs. Specifically, this method is based on a Genetic Algorithm (GA) to find suitable perturbations and optimizes the process of adversarial attacks through a dynamic number of evolution directions and a maximum generation limit. The effectiveness of our adversarial attack is demonstrated by experimental results based on a widely used public dataset CSIC2010 and several representative detectors. As far as we know, this is the first time an adversarial attack against IoT detectors based on URL requests has been done. The method has an attack success rate of more than 92 %. Furthermore, experiment results show that the method can reduce query numbers while maintaining the attack success rate.