Evasive Ransomware Attacks Using Low-level Behavioral Adversarial Examples

2025-08-12

AI Summary

This work addresses behavioral-level vulnerabilities in AI-driven cybersecurity defense systems by introducing the novel concept of low-level behavioral adversarial examples and establishing an evasion-oriented threat model targeting ransomware. Unlike conventional pixel-level perturbations, our approach operates at the source-code level to modulate fine-grained malicious behavioral features—such as thread scheduling, file encryption ratio, and post-encryption delay—while preserving semantic functionality, and leverages adversarial optimization to generate evasive variants. Empirical evaluation on the Conti ransomware codebase demonstrates that our method significantly reduces detection rates across mainstream deep learning–based detectors. This study constitutes the first systematic demonstration of the practical feasibility and severity of behavioral-level adversarial attacks against AI security systems, thereby providing critical theoretical foundations and empirical evidence for robustness modeling and defensive mechanism design.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements
• Web Mining and Content Analysis: Models for Web evolution

Abstract

Protecting state-of-the-art AI-based cybersecurity defense systems from cyber attacks is crucial. Attackers create adversarial examples by adding small changes (i.e., perturbations) to the attack features to evade or fool the deep learning model. This paper introduces the concept of low-level behavioral adversarial examples and its threat model of evasive ransomware. We formulate the method and the threat model to generate the optimal source code of evasive malware. We then examine the method using the leaked source code of Conti ransomware with the micro-behavior control function. The micro-behavior control function is our test component to simulate changing source code in ransomware; ransomware's behavior can be changed by specifying the number of threads, file encryption ratio, and delay after file encryption at the boot time. We evaluated how much an attacker can control the behavioral features of ransomware using the micro-behavior control function to decrease the detection rate of a ransomware detector.

Problem

• Protecting AI-based cybersecurity from adversarial ransomware attacks
• Generating optimal evasive malware source code using behavioral perturbations
• Evaluating ransomware detection rate reduction via micro-behavior control

Innovation

• Low-level behavioral adversarial examples for evasion
• Micro-behavior control function simulates code changes
• Optimizes source code to reduce detection rates