A reinforcement learning environment for training AI agents to manipulate malware samples and evade static machine learning detection.
Malware Env for OpenAI Gym is a reinforcement learning environment designed for cybersecurity research. It allows AI agents to learn how to manipulate malware samples through functionality-preserving transformations to evade static machine learning detection models. The environment provides a set of binary manipulation actions and integrates with existing RL frameworks to train evasion policies.
Cybersecurity researchers and machine learning practitioners studying adversarial attacks, evasion techniques, and reinforcement learning applications in security. It is also suitable for academics conducting reproducible experiments in malware detection bypass.
It offers a specialized, open-source toolkit for training and evaluating reinforcement learning agents against realistic malware classifiers, bridging the gap between machine learning and offensive security research.
Malware Env for OpenAI Gym provides a specialized environment for reinforcement learning research focused on malware evasion. It enables AI agents to learn functionality-preserving transformations on Portable Executable (PE) files to bypass static machine learning malware classifiers.
The project aims to advance cybersecurity research by creating a standardized, reproducible environment for studying adversarial machine learning against malware detection systems.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Tailored for malware evasion with OpenAI Gym integration, allowing direct use with frameworks like ChainerRL and Keras-RL for reinforcement learning research.
Leverages the LIEF library for on-the-fly PE file modifications, providing actions such as appending bytes, removing signatures, and changing section headers as detailed in the action space.
Includes a gradient boosted decision trees model trained on 100k samples, offering a baseline for evaluating evasion success without needing to build a classifier from scratch.
Based on a peer-reviewed arXiv paper and provides tools like VirusTotal integration scripts, enabling standardized, reproducible experiments in adversarial machine learning.
Requires specific installations like LIEF v0.7.0 for Python 3.6 and manual sample acquisition, which can be cumbersome and error-prone, as noted in the setup instructions.
Stuck on older versions such as Python 3.6 and LIEF 0.7.0, limiting compatibility with modern machine learning libraries and potentially causing integration issues.
The fixed set of binary manipulations may not cover all evasion techniques, restricting the agent's learning scope and adaptability to newer malware detection methods.