  With the growing pace of using Deep Learning (DL) to solve various problems,
securing these models against adversaries has become one of the main concerns
of researchers. Recent studies have shown that DL-based malware detectors are
vulnerable to adversarial examples. An adversary can create carefully crafted
adversarial examples to evade DL-based malware detectors. In this paper, we
propose Mal2GCN, a robust malware detection model that uses Function Call Graph
(FCG) representation of executable files combined with Graph Convolution
Network (GCN) to detect Windows malware. Since FCG representation of executable
files is more robust than raw byte sequence representation, numerous proposed
adversarial example generating methods are ineffective in evading Mal2GCN.
Moreover, we use the non-negative training method to transform Mal2GCN to a
monotonically non-decreasing function; thereby, it becomes theoretically robust
against appending attacks. We then present a black-box source code-based
adversarial malware generation approach that can be used to evaluate the
robustness of malware detection models against real-world adversaries. The
proposed approach injects adversarial codes into the various locations of
malware source codes to evade malware detection models. The experiments
demonstrate that Mal2GCN with non-negative weights has high accuracy in
detecting Windows malware, and it is also robust against adversarial attacks
that add benign features to the Malware source code.
