  Deep learning-based malware detectors have been shown to be susceptible to
adversarial malware examples, i.e. malware examples that have been deliberately
manipulated in order to avoid detection. In light of the vulnerability of deep
learning detectors to subtle input file modifications, we propose a practical
defense against adversarial malware examples inspired by (de)randomized
smoothing. In this work, we reduce the chances of sampling adversarial content
injected by malware authors by selecting correlated subsets of bytes, rather
than using Gaussian noise to randomize inputs like in the Computer Vision (CV)
domain. During training, our ablation-based smoothing scheme trains a base
classifier to make classifications on a subset of contiguous bytes or chunk of
bytes. At test time, a large number of chunks are then classified by a base
classifier and the consensus among these classifications is then reported as
the final prediction. We propose two strategies to determine the location of
the chunks used for classification: (1) randomly selecting the locations of the
chunks and (2) selecting contiguous adjacent chunks. To showcase the
effectiveness of our approach, we have trained two classifiers with our
chunk-based ablation schemes on the BODMAS dataset. Our findings reveal that
the chunk-based smoothing classifiers exhibit greater resilience against
adversarial malware examples generated with state-of-the-are evasion attacks,
outperforming a non-smoothed classifier and a randomized smoothing-based
classifier by a great margin.
