frame=lines, language=WebAssembly, basicstyle = , showspaces=false,
showtabs=false, showstringspaces=false, breaklines=true,
breakatwhitespace=true,  11institutetext: Institute for IT-Security,
Ratzeburger Allee 160, 23562 Lübeck, Germany
11email: {n.loose, f.maechtle, c.pott<EMAIL_ADDRESS><EMAIL_ADDRESS>
#  Madvex: Instrumentation-based Adversarial Attacks on Machine Learning
Malware Detection

Nils Loose  Felix Mächtle  Claudius Pott  Volodymyr Bezsmertnyi  Thomas
Eisenbarth

###### Abstract

WebAssembly (Wasm) is a low-level binary format for web applications, which
has found widespread adoption due to its improved performance and
compatibility with existing software. However, the popularity of Wasm has also
led to its exploitation for malicious purposes, such as cryptojacking, where
malicious actors use a victim’s computing resources to mine cryptocurrencies
without their consent. To counteract this threat, machine learning-based
detection methods aiming to identify cryptojacking activities within Wasm code
have emerged. It is well-known that neural networks are susceptible to
adversarial attacks, where inputs to a classifier are perturbed with minimal
changes that result in a crass misclassification. While applying changes in
image classification is easy, manipulating binaries in an automated fashion to
evade malware classification without changing functionality is non-trivial. In
this work, we propose a new approach to include adversarial examples in the
code section of binaries via instrumentation. The introduced gadgets allow for
the inclusion of arbitrary bytes, enabling efficient adversarial attacks that
reliably bypass state-of-the-art machine learning classifiers such as the CNN-
based Minos recently proposed at NDSS 2021. We analyze the cost and
reliability of instrumentation-based adversarial example generation and show
that the approach works reliably at minimal size and performance overheads.

###### Keywords:

Malware Detection Adversarial Attack Binary Instrumentation Minos
Cryptojacking

##  1 Introduction

With the introduction of WebAssembly (Wasm) in 2017, web applications are able
to utilize a system’s CPUs with near-native efficiency [1]. Wasm allows
developers to make computationally heavy applications available in-browser and
has since been used for games, text processing, visualizations, and media
players [14, 21]. On the downside, malicious parties have also utilized Wasm
to distribute malicious binaries to victims that visit an infected website and
thus gain access to the victim’s resources without having to gain access to
their system. In particular, the near-native performance of Wasm and the
support provided by all major browsers make WebAssembly a prime target for
cryptojacking attacks [14, 21, 35]. In-browser cryptojacking or drive-by
cryptocurrency mining allows an attacker to utilize their victim’s
computational resources for mining cryptocurrencies without their knowledge or
consent, thus profiting from the returns without having to pay for the spent
energy. To address this issue, various methods have been proposed to protect
against cryptojacking attacks. However, while fast, traditional static
approaches like blacklisting malicious hosts or matching signatures are easily
bypassed [31]. Dynamic detection systems [17, 15, 30], on the other hand, rely
on more sophisticated metrics that cause a runtime overhead and require the
malicious binary to be executed. Minos, a lightweight machine learning-based
detection system, provides a promising solution to this problem [23]. By
transforming Wasm binaries to grey-scale images, Minos can utilize a
convolutional neural network (CNN) for the classification of binaries. This
provides a rapid and effective approach that can be applied prior to executing
the binaries, thereby offering efficient protection against in-browser
cryptojacking attacks. While promising, CNNs are known to be susceptible to
adversarial attacks [39]. Malicious parties looking to distribute their
malware have a high incentive to evaluate possible avenues for bypassing
detection frameworks. In particular, the development of more sophisticated
evasion techniques by attackers could render existing detection methods
ineffective. Adversarial examples are usually crafted under the assumption
that small changes to the input are neglectable. However, applying adversarial
examples to binaries that follow strict syntactical and semantical rules
requires specific placement of adversarial payloads without invalidating the
binary or changing the semantics. Still, attacks leveraging adversarial
examples to bypass visualization-based malware detectors have been proven to
succeed on Windows Portable Executables [20, 16, 28].

In this paper, we evaluate the feasibility of utilizing adversarial examples
against the Wasm-based classifier Minos [23] presented at NDSS 2021. We
demonstrate the feasibility of inserting semantic-preserving gadgets using
binary instrumentation into the code section of WebAssembly applications,
allowing effective crafting of adversarial examples inside the gadget, thus
enabling the evasion of the Minos detection system. In contrast to existing
work, we add the adversarial payload directly into the application’s control
flow and introduce both size-efficient (SE) and optimization-resistant (OR)
gadgets. Our findings shed light on the potential weaknesses of machine
learning-based classifiers in detecting cryptojacking and highlight the need
for ongoing efforts to improve their robustness and security, particularly
when classifiers are applied in scenarios with incentives to evade
classification. To summarize, our key contributions are:

  * •

Comprehensive collection of malign Wasm samples from the Cisco Umbrella 1
Million websites list.

  * •

A novel approach for automatically crafting adversarial examples in code by
introducing semantic-preserving instruction gadgets via instrumentation.

  * •

Demonstrating a grey-box adversarial attack against the Minos classifier by
training a substitute model and applying our gadgets.

  * •

A comprehensive evaluation of the efficacy and costs of the attack.

##  2 Background

###  2.1 WebAssembly

WebAssembly (Wasm) [1] is a binary instruction format for a stack-based
virtual machine that enables high-performance applications that run seamlessly
in web browsers. It is designed to provide near-native performance to web
applications and allows developers to write applications in various
programming languages, including C, C++, and Rust, while still being executed
in the browser. Wasm is supported by all major web browsers and has gained
significant traction in recent years, particularly in resource-intensive
applications, where the performance benefits provided by Wasm are especially
important. In most settings, Wasm is integrated into the JavaScript code of a
website, from where the Wasm modules are loaded, and the respective functions
are called. Its stack-based architecture, widespread support, and versatility
make it an essential tool for modern web development.

###  2.2 Cryptojacking Malware

Cryptocurrency mining is the process of solving complex mathematical problems
in order to validate transactions and add new blocks to a blockchain network
[22]. The process requires a significant amount of computational power and
energy. As compensation for the computation time, miners are rewarded with new
units of the respective cryptocurrency. This reward mechanism is a key
component of the decentralized nature of many cryptocurrencies, as it
incentivizes individuals and organizations to participate in the network and
maintain its security. However, as the difficulty of mining increases and the
competition among miners grows, the margin between the resources spent on
mining and the returned profits diminishes. If a malicious actor manages to
utilize a victim’s resources for mining, the computational cost is removed
from the equation. In general, the unauthorized use of a device’s computing
power to mine cryptocurrencies, typically without the knowledge or consent of
the device’s owner, is referred to as cryptojacking. This type of attack can
occur via host- or browser-based mining and can have significant impacts on
both individual users and organizations. Host-based cryptojacking requires the
installation of a cryptocurrency miner on the victim’s machine through, i.e.,
malicious software installed by the victim [35]. Browser-based cryptojacking
is a method of exploiting a victim’s device through a malicious website. The
attacker inserts a script into the website’s code that runs in the victims’
browser upon visiting the site and uses their device’s processing power to
mine cryptocurrency while profiting the owner of the operation. With the
introduction of WebAssembly and its near-native speed, the efficiency of
browser-based mining has significantly increased, making the attack lucrative.
Unlike traditional malware, browser-based cryptojacking does not require the
victims to download any files, making it subtle and difficult to prevent.

###  2.3 Malware Detection

Identifying whether a binary contains malicious functionality is an active
area of research across different types of binaries. Various approaches have
been proposed for detecting cryptojacking, one of the primary malicious usages
of Wasm binaries [21]. Due to the reliance of cryptojacking malware on network
communication, network-based detection systems have been proposed, analysing
the network traffic [32]. Host-based detection frameworks rely, in general, on
either static or dynamic analysis to identify malware. Dynamic approaches
observe the execution of a binary while monitoring key metrics such as memory
consumption [25], the number of executed arithmetic operations [37], or
through CPU profiling [17]. Prevention techniques that identify malware based
on resource consumption can be circumvented through throttling [12].
Additionally, a number of machine learning classifiers have been proposed that
require dynamic features such as API calls and resource information [30] or
runtime information such as the number of web sockets or workers [15]. In
order to generate dynamic features, the potentially malicious binary needs to
be executed on the host’s machine. Static approaches, on the other hand, do
not require the evaluated code to be executed; instead, the binary is directly
evaluated, for example, by matching known signatures or URL blacklisting [12].
However, these techniques can be circumvented using obfuscation [31]. MinerRay
[31] relies on the static detection of hash semantics to make obfuscation-
based prevention harder as the semantics of the functions are evaluated.

In general, efficiently detecting whether a WebAssembly binary utilizes the
host’s resources for mining cryptocurrencies without relying on dynamic
features allows a detection framework to warn the user that a malicious binary
is loaded before the execution of the binary. Nassem _et al._ developed Minos
[23], a lightweight real-time detection system that aims to efficiently detect
whether a WebAssembly binary utilizes the host’s resources for cryptomining
using a CNN. Minos is designed to be implemented as a browser plug-in which
uses the detection framework to warn users about any detected cryptomining
binaries before they are executed. Upon visiting a website that loads a Wasm
binary, the detection framework transforms the bytes contained inside the
binary into a two-dimensional grey-scale image which is then evaluated by a
pre-trained CNN. This architecture allows the system to classify a binary, on
average, in $25.9\;ms$ while achieving an overall accuracy of $98.97\%$
against an in-the-wild dataset [23].

###  2.4 Adversarial Attacks

Deep neural networks, along with other machine learning models, have been
discovered to be susceptible to adversarial attacks on their input data [34,
4]. Given a target model $\theta$, an input $x$ and a target class
$t\neq\theta(x)$, an adversaries objective is to find a minimal perturbation
$\delta_{x}$ under a norm $\mathcal{N}=||~{}\cdot~{}||$ s.t.

$\theta(x+\delta_{x})=t$ (1)

Minimizing the perturbation vector $\delta_{x}$ under a norm $\mathcal{N}$
ensures that the original input $x$ and the newly generated input, or
adversarial example, $x^{*}=x+\delta_{x}$ are close to each other under a
given distance metric $\mathcal{D}$. However, finding a perturbation
$\delta_{x}$ that satisfies Equation 1 is generally a hard problem due to the
nonlinearity of the evaluated model $\theta$ [34]. Existing methods for
crafting an adversarial example, such as the L-BFGS, solve the problem using
approximations [39]. Carlini and Wagner (C&W) proposed a different approach by
transforming the constraint shown in Equation 1 into an optimization problem
using an appropriately chosen objective function $\mathcal{L}$, s.t. if
$\theta(x+\delta_{x})=t$ is satisfied, $\mathcal{L}(x^{*})\leq 0$ holds [8].
By moving the constraint into the minimization term, the problem of finding an
adversarial example is an optimization task that minimizes
$\mathcal{N}(\delta_{x})+\epsilon\cdot\mathcal{L}(x^{*})$ such that
$x^{*}\in[0,1]^{n}$ where $\epsilon>0$ is a suitably chosen constant. The
optimization problem is solved using gradient-based optimization methods [5].
The gradient of the objective function with respect to the input $x$ is used
to update the perturbation $\delta_{x}$ in each iteration of the optimization
process. The process is repeated until the minimum perturbation, which results
in the adversarial example being classified as the target class t, is found.
Without access to the gradients of the target model $\theta$, the
aforementioned attack cannot be utilized. However, given query access, the
adversary can train a local substitute network [27] by querying the target
classifier with synthesized or otherwise gathered data. Using the results
obtained through inference against the target network as labels, the local
model is trained. Due to the transferability between models, it is possible to
train a machine learning model that mimics the behaviour of a target model
[13]. In a black-box scenario [27], a network with unknown architecture is
attacked, requiring a custom architecture for the local substitute network. In
the grey-box scenario, additional information about the target network, such
as parameters or its architecture, is known, and hence the substitution
network architecture can be chosen similarly to the target model. The local
model can then be utilized to generate adversarial examples that are
transferable to the target network [27].

##  3 Madvex: Crafting Functional Adversarial Binaries

Figure 1: Systematic overview of the training procedure for the substitute
model. Malicious (M) samples are augmented to generate a balanced dataset. To
generate labels, the target model is queried. The labelled benign (B) and
malicious data is used to train the substitute model using $5$-fold cross-
validation.

The Minos classifier [23] uses an image-based machine learning technique to
quickly identify malicious WebAssembly binaries. However, such classifiers are
shown to be vulnerable to adversarial attacks [34]. This section describes the
attack methodology used to craft binaries that are misclassified by Minos. To
illustrate the applicability of such an attack, we limit the adversary and
assume a grey-box scenario where the attacker has query access to the model
and knowledge of the network’s architecture. Although the Minos classifier’s
architecture was published by Naseem _et al._ , the training data and model
were not made available. Therefore, we use a Minos classifier trained by
Cabrera-Arteaga _et al._ [7] as the target of our attack experiments.

###  3.1 Data Acquisition

The performance of the attack correlates with the quality of the local
substitute model trained by the adversary. Therefore a comprehensive dataset
of malicious and benign WebAssembly binaries is required to train a suitable
substitute network. The original Minos model was trained on a balanced dataset
containing 300 samples [23]. The data preparation and training procedure for
the substitute model is schematically visualized in Fig. 1 and described below
in detail. To obtain benign samples, we used
WasmBench111https://github.com/sola-st/WasmBench (Accessed 2023/01/31), a
WebAssembly dataset containing more than $23.000$ real-world binaries
published by Hilbig _et al._ as part of an empirical study [14]. We obtained
$34$ malicious samples from a dataset222https://github.com/vusec/minesweeper
(Accessed 2023/01/31) published in the context of Minesweeper [17].
Additionally, we ran a crawler to increase the number of malware samples and
gather up-to-date malware. By iterating over the Cisco Umbrella $1$ Million
list [11], we were able to download $187$ WebAssembly binaries. Each domain on
this list is visited by the crawler, which resides on any page for three
seconds. By hooking a JavaScript function into each document load, we are able
to dump any WebAssembly binary before it is executed. Considering that the
malware may not reside on the homepage directly, the crawler additionally
visits three randomly chosen internal links. Overall $40\%$ of the crawled
binaries resided on subdomains and were found either through accessing
internal links or redirects. The Minesweeper [17] classifier categorized ten
out of the $187$ crawled binaries as being malicious. Even after combining the
samples of public datasets with the results of our crawling campaign, the
number of obtained malicious binaries is considerably lower than that of
benign binaries. In order to compensate for this difference and additionally
increase the number of samples, we utilize the Wasm-fuzzer wasm-mutate [6] as
a diversifier. By utilizing wasm-mutate, one can generate a variety of
different WebAssembly binaries that retain the original semantic. Mutation
cores available in wasm-mutate enable semantic-preserving transformations. A
sample function that performs the addition of two integers and two mutations
of the function are shown in Fig. 2. Each mutation is generated using a
different seed, allowing us to generate a larger variety of syntactically
different binaries with identical semantics. To generate appropriate
adversarial examples, a shadow model that is as similar to the target model as
possible must be utilized. To achieve this, the internal labels assigned to
the samples are only used for balancing and not used for training. Instead,
the pre-trained Minos network [7] is employed for label generation. After
augmentation of the malicious samples, we obtain a dataset containing
$2.3\text{\times}{10}^{4}$ malicious and $2.3\text{\times}{10}^{4}$ benign
binaries that are used for training the substitute model.

(a) Original function

⬇

(func (;0;)

(param i32 i32)

(result i32)

local.get 0

local.get 1

i32.add

)

(b) Mutated version of (a)

⬇

(func (;0;)

(param i32 i32)

(result i32)

local.get 0

i32.const 0

i32.shl

i32.const 0

i32.add

local.get 1

i32.add

)

(c) Mutated version of (a)

⬇

(func (;0;)

(param i32 i32)

(result i32)

local.get 0

local.get 1

i32.add

i32.const 0

i32.shr_u

local.get 0

local.get 1

i32.add

i32.const 0

i32.sub

i32.and

)

Figure 2: Wasm function performing the addition of two integers (a) and two
semantic-preserving mutations (b),(c) of the original function using different
seeds in wasm-mutate [6].

###  3.2 Substitute Network Training

We use the architecture employed by Minos for the substitute model because we
assume a known architecture in the grey-box attack. The architecture of the
CNN is shown in Fig. 3. Convolutional neural networks typically receive an
image as the input for classification. The Minos classifier requires the input
to be a grey-scale image of size $100\times 100$. To allow binaries of varying
sizes to be represented as a fixed-dimensional image, the bytes are reshaped
into the largest possible two-dimensional array with the same width and
height. The remaining bytes are discarded. Initially, each byte of the binary
corresponds to one pixel. However, the image is downscaled to a $100\times
100$ image. A detailed description of the downsampling process is given in
Section 3.3.2.

Figure 3: Architectural overview of the Minos classifier from Naseem _et al._
[23]. The CNN contains three convolution layers, three pooling layers, and one
fully connected layer. The input image shows a Wasm binary that is transformed
into a grey-scale image.

The original model was trained using an $80\%$ training and $20\%$ testing
split. However, we use $5$-fold cross-validation for training. Hence five
models are trained each on $80\%$ of the dataset described in Section 3.1,
while $20\%$ of samples are withheld for validation. For the evaluation, Minos
was trained with one epoch (M-1) to prevent overfitting, followed by 50 epochs
(M-50), the same number as the target model. The area under the curve (AUC)
and loss after the final epochs are reported in Table 1. Even after training
the substitute network for only one epoch, the validation AUC reaches $99\%$
with a validation loss of $0.14$. After training for $50$ epochs, the
validation loss decreases to $0.04$.

Table 1: Substitute network training evaluation after the last epoch for (a)
one epoch (M-1) and (b) $50$ epochs (M-50).

(a) M-1 Fold | 0 | 1 | 2 | 3 | 4
---|---|---|---|---|---
AUC | 0.96 | 0.95 | 0.96 | 0.96 | 0.94
Val. AUC | 0.99 | 0.99 | 0.99 | 0.99 | 0.99
Loss | 0.29 | 0.30 | 0.29 | 0.29 | 0.34
Val. Loss | 0.13 | 0.14 | 0.15 | 0.15 | 0.14

(b) M-50 Fold | 0 | 1 | 2 | 3 | 4
---|---|---|---|---|---
AUC | 1.00 | 1.00 | 1.00 | 1.00 | 1.00
Val. AUC | 1.00 | 1.00 | 1.00 | 1.00 | 1.00
Loss | 0.03 | 0.03 | 0.04 | 0.03 | 0.03
Val. Loss | 0.05 | 0.05 | 0.03 | 0.04 | 0.04

###  3.3 Attack Methodology

Figure 4: Histogram of relative section size (a) for code section, data
section and all remaining sections for all binaries as described in Section
3.1. Cumulative density for relative section size for all malicious binaries
(b) and benign binaries (c).

Performing an adversarial attack against an image-based classifier requires
slight modifications of the original image to manipulate the generated
response in the desired direction. The alterations are often transparent to
the naked eye as they result in a small amount of noise added to the original
image. However, in the case of binaries, slightly manipulating the value of a
pixel, for example, changing a value from $0x2A$ to $0x2B$, changes the
original instruction from f32.load to f64.load invalidating the binary. We
require a procedure that allows us to manipulate certain areas of the binary
without changing the behaviour. Using instrumentation, we can add, manipulate
or remove instructions from the malware and provide areas inside the code
section that can be utilized for the adversarial attack. While we are still
unable to manipulate arbitrary pixels, adding specially crafted gadgets into
the binary enables specific bytes to be utilized for the adversarial attack.
Generating an adversarial example requires iterative manipulation of the
target value in small increments. Hence, an area of bytes that are arbitrarily
manipulable is ideal. Each WebAssembly binary is split into several sections,
each with a different purpose. As shown in Fig. 4a, the code section
represents, in most cases, the largest section inside both malicious and
benign binaries that were analyzed. When separately evaluating the section
distribution for malicious and benign binaries (cf. Fig. 4b and Fig. 4c), it
is apparent that in both cases, the code section remains the largest section.
The code section contains all functions with their instructions, whereas the
data section represents a linear array of memory accessible through
instructions in the code section. While an attack against the data section is
also possible by extending the size of the linear memory and using this area
for crafting the attack, we chose to target the code section as it represents
the largest section of the binaries. An overview of our attack methodology is
given in Fig. 5. Each step is described in detail below.

####  3.3.1 Semantic-preserving Gadgets

To enable manipulation inside the code section, we require an instruction that
has a number of bytes that are freely choosable. In particular, instructions
that load constants onto the stack cause specific values to be present inside
the code section. Hence, constructing a gadget that loads an arbitrary
constant onto the stack and removes it allows a number of bytes to be
arbitrarily chosen. Additionally, it can be inserted anywhere into the control
flow because, after the gadget’s execution, the stack will be in the same
state as before.

Figure 5: Schematic overview of the attack methodology. A malicious binary is
instrumented to add the gadgets used for carrying the adversarial payload.
After downsampling, the adversarial attack is performed against the substitute
model. To recreate the original binary, we upsample the adversarial image and
recreate the original binary.

WebAssembly allows four number types to be pushed onto the stack as constants
- $32$ and $64$ bit variants of integers and floats. We opt to use $64$ bit
constants, as the ratio between the number of bytes that are available for the
adversarial attack and the number of bytes required for the overall gadget is
higher. Generally, both integers and floats can work. However, WebAssembly
encodes all integers using the LEB128 variable-length encoding in either the
signed or unsigned variant. Compared to the encoding utilized for floating
point values, IEEE-754 [2], the integer encoding enforces a number of
restrictions on the bytes representing the integer. IEEE-754, on the other
hand, allows all bytes to assume all possible values. Hence we use $64$ bit
floating point constants to craft the attack. The f64.const x:f64 instruction
can be used to push the $64$ bit floating point number x onto the stack. We
initialize the constant to $0x80808080$ to allow both positive and negative
perturbations. To ensure that the functionality of the target binary is not
modified, the value must be removed from the stack before normal execution
resumes. We demonstrate two gadgets that can be inserted after arbitrary
instructions, as the execution of the gadget only changes the contents of the
stack temporarily. A size-efficient gadget (SE) is shown in Fig. 6a. After the
constant is pushed onto the stack, it is immediately removed again using the
drop instruction. Each inserted gadget of this type increases the size of the
binary by ten bytes, out of which the adversarial attack can utilize eight
bytes (compare Fig. 6b). Hence, only $20\%$ of the size overhead is attributed
to bytes that cannot be manipulated during the attack phase.

(a) Size-efficient gadget

⬇

f64.const 0x0

drop

(b) Binary representation of (a)

⬇

0x44, 0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0

0x1a

(c) Optimizer-res. gadget

⬇

(local $UID1 f64)

(loop $UID2

local.get $UID1

f64.const 0x0

f64.add

local.tee $UID1

local.get $UID1

f64.div

f64.const 42

f64.gt

br_if $UID2

)

(d) Binary representation of (c)

⬇

0x03,0x40

0x20,0x02

0x44, 0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0

0xa0

0x22,0x02

0x20,0x02

0xa3

0x44,0x0,0x0,0x0,0x0,0x0,0x0,0x45,0x40

0x64

0x0d,0x00

0x0b

Figure 6: Size-efficient (a) and optimizer-resistant (c) gadget and their
binary representation (b,d). Bytes that can be manipulated during the
adversarial attack are highlighted in blue.

Due to the low complexity of the size-efficient gadget, it is easy to discern
that the two instructions will retain the program’s semantics. However,
optimizers such as wasm-opt [38] can remove all gadgets of this type from the
binary. Note that using an optimizer before classifying the binary is not part
of the Minos framework [23] because it would counteract the high efficiency of
the detection system. Nevertheless, we are able to craft a gadget that is not
removed by wasm-opt, even when using its most aggressive optimization setting.
This resilience, however, is only made possible by increasing the gadget’s
complexity. The composition of our optimizer-resistant gadget (OR) is shown in
Fig. 6c and the binary representation in Fig. 6d. The basic idea remains
unchanged; we still load a constant onto the stack, thus introducing a value
that can be manipulated during the attack phase. However, instead of directly
loading the value onto the stack and dropping it, we use it as the increasing
constant for a loop counter. However, as the value can be an arbitrary float
value, i.e. negative and positive, we divide it by itself to have a known
value, i.e. one. We then check whether this new value is less than some
constant, i.e. $42$, which is always true, and break the loop. While it is
intuitively understandable that this loop will never be executed more than
once, it is not easily determined by an algorithm since loops are difficult to
analyze. While this gadget survives optimization passes, only eight out of
$32$ bytes can be utilized for the adversarial attack. Gadgets are inserted
into the code section at randomly drawn insertion points with a predetermined
frequency. The relation between the number of inserted gadgets and the success
rate of the attack is evaluated in Section 4.1. In Section 4.2, we evaluate
the execution speed of both gadgets in relation to the number of gadgets
inserted into the binary. Insertion of either gadget into the target binary
can be performed once per binary before distribution and requires linear time
in the size of the binary, making the instrumentation efficient.

####  3.3.2 Downsampling

A given binary can be of any size between a few kilobytes and many megabytes.
Hence, the authors of Minos [23] downsample each binary into an image of fixed
dimensionality, i.e. $100\times 100$ pixels (Fig. 3). As our shadow model
utilizes the same architecture, it also requires an input image of that size.
However, as we need to keep track of the positions that allow for a change
within the instrumented binary, i.e. the constants within our gadgets, we use
a custom downsampling algorithm for crafting the attacks. Yet, at inference
time, the original downsampling method is used. At first, we transform the
sequence of bytes $b$ from the binary into a squared image with a dimension of
$\lfloor\sqrt{|b|}\rfloor$. Hence, a few bytes at the end are discarded. From
this squared image, we combine as many pixels as needed in order to downsample
the image to $100\times 100$ pixels. For this purpose, we calculate the mean
of a group of pixels, which then become a single pixel. To keep track of what
pixels contain a byte that is used for the adversarial attack, we maintain a
mask $M_{1}$. The mask has the same dimensionality as the image and marks all
positions that contain editable values. To easily revert the downsampling when
restoring the binary, we store the coordinates of the original group of pixels
for each downsampled pixel.

####  3.3.3 Adversarial Attack

After downsampling, the image $x$ is perturbed iteratively until our shadow
model misclassifies the image as benign using the method proposed by Carlini &
Wagner [8]. However, instead of optimizing for a fixed number of iterations,
we keep iterating until the shadow model prediction reaches a threshold
$\tau$. Experimentally we determined $\tau=10^{-13}$. However, we also
terminate the optimization after $1\text{\times}{10}^{4}$ iterations. During
our experiments, we found that the lower the threshold for the prediction
score is, the higher the chance that an original model will share the
classification of the shadow model. In order to only perturb pixels related to
the gadgets, we multiply the mask $M_{1}$ that was saved during downsampling
before adding the perturbation $\delta_{x}$ to the sample. Given the model
$\theta$, a normalization $|\cdot|$ and the constant $\epsilon$, the
perturbation of the input under the objective function $\mathcal{L}$ is given
as:

$x=x+M_{1}\cdot\epsilon\cdot\left|\frac{\mathrm{d}}{\mathrm{d}x}\mathcal{L}(\theta(x),0)\right|$

In our experiments, we chose $\epsilon=0.05$ and $\mathcal{L}$ as binary
cross-entropy [5]. We derive the change needed for the input $x$ within the
normalization term so that the prediction $\theta(x)$ gets closer to zero,
i.e. benign. However, instead of adding the whole perturbation to $x$, only a
small factor is added. This can be compared to the learning rate in classical
machine learning. As we cannot perturb the whole input image but rather just
the constants within the gadgets, our crafted mask is multiplied before the
summation. As the mask has zeros on all non-editable pixels, i.e. the original
code of the binary, and a one wherever there is at least a single gadget, the
perturbation is only applied to pixels that relate to gadgets.

####  3.3.4 Upsampling

The result of the adversarial attack is a perturbed image $x^{*}$ where the
perturbation is only applied to the pixels that initially belonged to at least
a single gadget. Those changes must now be mapped back to the original binary.
For the perturbed image, we look at every pixel that belonged to at least one
gadget. If such a pixel is found, we retrieve the corresponding group of
pixels $\mathcal{G}$. To correctly update $\mathcal{G}$, the bytes belonging
to an adversarial payload need to be modified s.t. the mean value of
$\mathcal{G}$ equals the corresponding pixel value of $x^{*}$. Given the sum
of the pixel values $\sum_{p\in\mathcal{G}}p$, the number of pixels
$|\mathcal{G}|$ and the target pixel $p^{*}$ the update factor $f_{adv}$ can
be derived using the following equation:

$f_{adv}=p^{*}\cdot|\mathcal{G}|-\sum_{p\in\mathcal{G}}p$

To apply the factor $f_{adv}$ to the adversarial payload, we create a mask
$M_{2}$ that has a one at every editable position within $\mathcal{G}$.
$\overline{M_{2}}$ contains the same values as $M_{2}$ but flipped, s.t., ones
become zeros and vice versa. We can update the group of pixels using the
following equation:

$\mathcal{G}_{adv}=\begin{cases}M_{2}\cfrac{f_{adv}}{\sum
M_{2}}+\overline{M_{2}}\mathcal{G}&\text{if }\sum M_{2}\geq 1\\\
\mathcal{G}&\text{otherwise}\end{cases}$

The left term of the addition in the first case replaces all the editable
pixels within the image with a shared factor. The second term adds the
original values. This way, the new mean value of $\mathcal{G}_{adv}$ equals
the target value of the downsampled image. In case there are no gadgets in the
particular group, i.e. $\sum M_{2}=0$, $\mathcal{G}$ is simply copied. After
the termination of the adversarial attack, the image is flattened into a byte
array $b_{adv}$, and the bytes that were cropped during downsampling are
appended again.

####  3.3.5 Possible Countermeasures

In Section 4.1, we show that Minos [23] is susceptible to the presented
adversarial attack. However, it is essential to also discuss possible
improvements that could prevent such adversarial attacks and aid in hardening
the detection framework. The option to remove semantic-preserving gadgets
using an optimizer was already discussed in Section 1. While an additional
optimization step prevents an adversary from relying on the size-efficient
gadget, the more complex optimization-resistant gadget still allows effective
adversarial attacks. Machine learning models can be directly hardened against
adversarial attacks using, for example, defensive distillation [26], which is
a technique where the class probability vectors of a trained DNN are used to
train another DNN of the same dimensionality. As the name suggests, defensive
distillation is derived from the concept of distillation [3], where one
trained DNN is used to train a smaller DNN without losing accuracy. Another
promising method for hardening models against adversarial attacks is presented
by Goodfellow _et al._ [13]. They create adversarial examples and use them as
training data for their model. However, the presented countermeasures were
shown not to be effective against a thoughtful attacker [36].

##  4 Evaluation

###  4.1 Gadget Effectiveness

Figure 7: Minos misclassification rate of binaries with size-efficient gadgets
(a) and optimizer-resistant gadgets (b) against the pre-trained Minos [23]
classifier by Cabrera-Arteaga _et al._ [7]. Each plot depicts the
misclassification rate of the original binary (Original), the instrumented
binary without adversarial payload (Instr.), and the misclassification rate of
the binaries with adversarial payload derived using Minos trained for one
epoch (Adv. M-1) and for $50$ epochs (Adv. M-50). The adversarial
misclassification rates are average over all five folds. The error bars depict
the standard deviation.

Using our corpus of malicious samples (Section 3.1), we evaluate the
effectiveness of our attack by creating adversarial examples for each binary.
We consider the insertion density $d$ as the relative frequency of occurrence
of our gadget, s.t. for a given density $d\in[0,1]$, for every 1000
instructions $d\cdot 1000$ gadgets are added. Fig. 7 shows the
misclassification rates of binaries with the size-efficient gadget (Fig. 7a)
and the optimization-resistant gadget (Fig. 7b) against the Minos classifier
[23] trained by Cabrera-Arteaga et _al._ [7]. To the best of our knowledge,
Minos is the only WebAssembly malware classifier that utilizes machine
learning to classify malware directly on a representation of the binary
itself. To evaluate the effectiveness of our adversarial payloads at invoking
misclassifications, we plot the misclassification rates for the original
binary, the instrumented binary without adversarial payload and the
adversarially crafted binaries. The original binaries are unaffected by the
gadget density and never result in misclassification. For instrumented
binaries without adversarial payloads, it becomes apparent that after a
sufficiently large number of insertions, the classifier cannot detect the
malicious binary even without the adversarial attack. Fig. 8b shows the size
increase of the binary through the addition of our gadgets. For each gadget,
the misclassification rates of the instrumented binaries start to increase
significantly at a size of roughly $1.5\times$ the original binary.
Considering that the larger the binary gets, the higher the compression rates
and information loss are during downsampling, an increase in misclassification
rates that correlates with a size increase can occur. Due to the difference in
the number of added bytes per gadget, the misclassification rate for the
larger optimization-resistant gadget increases at lower densities. However,
for both gadgets, one can observe that the adversarially crafted binaries
consistently outperform the binaries that are only instrumented, causing
higher misclassification rates at lower densities. Additionally, adversarial
payloads generated using the substitute models trained for one epoch
consistently cause higher misclassifications at lower densities than payloads
generated using the models trained for 50 epochs. To further evaluate the
misclassification caused by instrumenting the malicious binary, we
additionally instrumented $50$ randomly selected benign binaries with the
optimizer-resistant gadget that caused higher misclassification rates. At
densities of both $0.1$ and $0.01$, the classifier correctly identified all
evaluated benign binaries as benign, suggesting a tendency of the classifier
to classify samples as benign. To evaluate the effectiveness of our method, we
additionally generated adversarial payloads for the benign binaries that
caused the substitute model to misclassify the binary as malicious. Using the
substitute model trained for one epoch, we were able to successfully cause the
target classifier to misclassify, on average, $77\%$ of the binaries over all
folds at a density of $0.1$. Overall, at a density of $0.02$, both gadgets are
shown to be successful in evading the target classifier for at least $70\%$ of
evaluated malicious binaries, while the misclassification rates for the
instrumented binary without the adversarial payload are at or below $20\%$,
highlighting the effectiveness of our approach.

###  4.2 Performance Analysis

Figure 8: Correlation between the insertion density and the relative increase
in execution time (a) and size (b). Both the size-efficient gadget (SE) and
the optimization-resistant gadget (OR) are evaluated. The $x$-axis represents
the density of the gadgets, while the $y$-axis represents the relative
execution time compared to the baseline (no gadget insertion) (a) and the
relative increase of the binary’s size in bytes (b). The average over the
evaluated binaries is plotted, and the error bars represent the standard
deviation.

To quantify the gadget’s impact on the runtime of instrumented binaries, we
measured the execution time in relation to the gadget density. This
correlation is illustrated in Fig. 8a. We utilized a WebAssembly hashing
library [24] and performed $5\text{\times}{10}^{5}$ rounds of SHA-256 hashing.
A baseline was established by measuring the execution time without inserting
the gadgets. The execution time of both gadgets is shown in relation to the
baseline. The insertion of the size-efficient gadget only results in a small
constant increase in execution time, suggesting that the inserted gadget is
not executed. WebAssembly is compiled using an ahead-of-time compiler, which
includes optimization of the code. As the size-efficient gadget neither
changes the data flow nor the control flow, the compiler likely identifies and
removes those instructions during compilation. However, similar to wasm-opt
[38], this optimizer cannot detect the optimization-resistant gadget. As a
result, the execution time increases linearly in the number of inserted
gadgets. However, considering that a density of $0.02$ is enough to trick the
target classifier, the increase in runtime is reasonable.

Additionally, we evaluated the requirements for generating an adversarial
example, which heavily depends on the gadget density. The number of iterations
required to achieve a confidence of less than $1\text{\times}{10}^{-13}$
within the shadow model was measured as a function of the chosen gadget
density. The results are depicted in Fig. 9, which displays the average number
of iterations required during the adversarial example generation over the
applied gadget density. As both gadget types hold the same number of bytes
utilized for the adversarial payload, they require a similar number of
iterations to reach the confidence level. The adversarial training
optimization loop was run for a maximum of $1\text{\times}{10}^{4}$
iterations. Overall, the lower the chosen density, the more iterations are
required to reach the target confidence, as fewer bytes are available for
adversarial crafting. While the adversarial examples crafted using the
substitute model trained for one epoch outperform the adversarial examples
crafted using the model trained for $50$ epochs, the adversarial example
reaches the target confidence with fewer iterations on the model trained for
$50$ epochs. The execution time of a single iteration is 9.84 ms on an AMD
Ryzen 9 7950X 16-Core Processor, which renders the attack feasible. Note that
this optimization needs to only be performed once per malware. However, an
attacker could potentially exploit the low cost of generating new adversarial
examples by regularly distributing new binaries to website visitors.

Figure 9: Average number of iterations ($y$-axis) required to achieve a
confidence of $1\text{\times}{10}^{-12}$ for a given gadget density
($x$-axis). Both the size-efficient gadget (SE) and the optimizer-resistant
gadget (OR) are evaluated on the substitute model trained for one epoch (M-1)
and $50$ epochs (M-50). The error bars show the standard deviation.

##  5 Related work

The use of machine learning-based classifiers for detecting malware has been
shown to be fast and effective in identifying binaries as malicious or benign.
However, the robustness of these classifiers against adversarial inputs is
often limited. As more machine learning-based classifiers are utilized for
detecting malware, malicious actors who want to distribute their malware have
a high incentive to utilize evasion techniques to prevent detection.
Especially for Windows Portable Executables (PEs), a number of classifiers and
evasions exist. Existing adversarial evasions on classifiers that utilize a
gray-scale image representation of the target binary [16] rely on FSGM [13] or
Carlini & Wagner [8], to generate a perturbation vector for the image [20, 16,
28]. However, in contrast to our attack, Liu _et al._ [20] directly apply the
perturbation to the image representation of the binary. While they show a
successful attack against the classifier, the generated adversarial example is
not a valid binary anymore, rendering their evasion ineffective. Khormali _et
al._ [16] generate the adversarial example and append the adversarial payload
to the end of the file or at the end of a section. This ensures that the
adversarial example is added into nonexecutable areas, and hence the original
functionality remains. While this enables the addition of the adversarial
payload into the malicious binary, a sophisticated defender can easily remove
the payload by statically identifying unused bytes and masking them before
classification, as they should have no impact on the classification
performance. Using our attack methodology, the adversarial payload is placed
inside the code section and directly baked into the control flow of the target
binary, preventing a defender from easily removing the payload. Additionally,
we have presented the optimization-resistant gadget that cannot be generally
removed using an optimization pass. Evasions against other network
architectures that directly consider the sequence of bytes from Windows PE
files generally insert adversarial payloads in unused bytes between sections
[18, 33, 29], in a new section [18] or at the end of the file [9, 29]. While
these approaches generate executable binaries, it is rather easy to circumvent
for a slightly more sophisticated detection model, e.g. one that first removes
unused bytes or truncates sections or files. Either of our proposed gadgets is
inserted directly into the instructions so that more sophisticated static
analysis techniques, such as data flow and control flow analysis, are required
to detect them fully. However, there are also numerous adversarial attacks
against classifiers that classify a binary on more sophisticated features than
just an image from its raw binary data, e.g. based on extracted features such
as control flow, data flow, API calls, libraries, or dynamic features [10,
19]. While the general procedure for generating the perturbation vector is
similar, the application to the binary relies on transforming the target in a
way that the corresponding features change. The interested reader is referred
to Ling _et al._ [19], who provide an in-depth evaluation of different evasion
techniques against Windows PE malware. Cabrera-Arteaga _et al._ [7] proposed a
malware evasion system against Wasm malware detectors and, in particular,
Minos. However, their system relies on obfuscation to bypass detection
frameworks, and they do not utilize adversarial attacks.

##  6 Conclusion

In this paper, we introduced a novel technique for placing adversarial
payloads directly into the instruction stream using binary instrumentation to
bypass machine learning-based malware detectors. We have demonstrated the
effectiveness of our technique by crafting a grey-box adversarial attack
against Minos [23], a lightweight cryptojacking detection framework for
WebAssembly presented at NDSS 2021. To place payloads inside the code section
of the binary, we have introduced two semantic-preserving gadgets for Wasm
binaries with a focus on size-efficiency and optimization-resistance,
respectively. We have collected an extensive dataset with both benign and
malicious binaries by utilizing two existing benchmark datasets [17, 14] as
well as results from a crawling campaign of one million websites from the
Cisco Umbrella list [11]. To populate this dataset, we used wasm-mutate [6] to
generate augmented binaries. Every sample was then assigned a label by
querying the target model, i.e. Minos [23] provided by Cabrera-Arteaga _et
al._ [7]. All samples with their corresponding label were then used to train a
substitute model of our targeted model. The challenge of creating a functional
adversarial example inside a binary without altering the semantics was met by
carefully inserting novel semantic-preserving gadgets. These gadgets can be
injected freely into the code section of a Wasm binary without changing the
semantics using binary instrumentation. Each gadget contains a number of bytes
that carry the adversarial payload and can be manipulated freely during the
attack phase. By attacking our substitute model, we successfully craft
functional adversarial examples for cryptojacking binaries. Using an insertion
density of $0.02$ and the better-performing substitute network trained for one
epoch (M-1), we are able to cause the target detector to misclassify all of
the evaluated malicious binaries, demonstrating the effectiveness of our
attack. Additionally, we show that our size-efficient gadget is removed during
compilation resulting in only a negligible runtime overhead. The optimizer-
resistant gadget, by design, is not removed before execution and thus leads to
a linear overhead in the density. However, as a small insertion density of
$0.02$ is sufficient in bypassing the classifier, the execution time is only
increased by roughly $10\%$. To prevent such attacks, we addressed typical
countermeasures; However, as discussed by Tramèr _et al._ [36], as long as the
adversary is able to manipulate features used by a classifier, the threat of
adversarial attacks cannot be fully mitigated. The success of our grey-box
adversarial attack on Minos highlights the need for continued research and
improvement of defences against adversarial attacks on machine learning-based
malware detection frameworks.

####  6.0.1 Acknowledgements.

We thank the reviewers and our shepherd for their helpful comments and
suggestions. This work has been supported by ERDF through the EMSIK project
and by BMBF through the PeT-HMR project.

## References

  * [1] WebAssembly Core Specification, https://www.w3.org/TR/wasm-core-2/
  * [2] Ieee standard for floating-point arithmetic. IEEE Std 754-2019 (Revision of IEEE 754-2008) (2019)
  * [3] Ba, J., Caruana, R.: Do deep nets really need to be deep? In: Advances in Neural Information Processing Systems. vol. 27 (2014)
  * [4] Biggio, B., Corona, I., Maiorca, D., Nelson, B., Srndic, N., Laskov, P., Giacinto, G., Roli, F.: Evasion attacks against machine learning at test time. In: Blockeel, H., Kersting, K., Nijssen, S., Zelezný, F. (eds.) Machine Learning and Knowledge Discovery in Databases - European Conference, ECML PKDD 2013, Prague, Czech Republic, September 23-27, 2013, Proceedings, Part III. Lecture Notes in Computer Science, vol. 8190. Springer (2013)
  * [5] de Boer, P., Kroese, D.P., Mannor, S., Rubinstein, R.Y.: A tutorial on the cross-entropy method. Ann. Oper. Res. 134(1) (2005)
  * [6] Bytecodealliance: wasm-mutate. https://github.com/bytecodealliance/wasm-tools/tree/main/crates/wasm-mutate (2023, Accessed: 2023)
  * [7] Cabrera-Arteaga, J., Monperrus, M., Toady, T., Baudry, B.: Webassembly diversification for malware evasion. Computers & Security 131 (2023)
  * [8] Carlini, N., Wagner, D.A.: Towards evaluating the robustness of neural networks. In: 2017 IEEE Symposium on Security and Privacy, SP 2017 (2017)
  * [9] Chen, B., Ren, Z., Yu, C., Hussain, I., Liu, J.: Adversarial examples for cnn-based malware detectors. IEEE Access 7 (2019)
  * [10] Chen, L., Ye, Y., Bourlai, T.: Adversarial machine learning in malware detection: Arms race between evasion attack and defense. In: European Intelligence and Security Informatics Conference, EISIC 2017 (2017)
  * [11] Dan Hubbard: Cisco Umbrella 1 Million. https://umbrella.cisco.com/blog/cisco-umbrella-1-million (2021, Accessed: 2023)
  * [12] Eskandari, S., Leoutsarakos, A., Mursch, T., Clark, J.: A first look at browser-based cryptojacking. In: 2018 IEEE European Symposium on Security and Privacy Workshops, EuroS&P Workshops 2018 (2018)
  * [13] Goodfellow, I., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples (2014)
  * [14] Hilbig, A., Lehmann, D., Pradel, M.: An empirical study of real-world webassembly binaries: Security, languages, use cases. In: WWW ’21: The Web Conference 2021. ACM / IW3C2 (2021)
  * [15] Kharraz, A., Ma, Z., Murley, P., Lever, C., Mason, J., Miller, A., Borisov, N., Antonakakis, M., Bailey, M.: Outguard: Detecting in-browser covert cryptocurrency mining in the wild. In: The World Wide Web Conference, WWW 2019 (2019)
  * [16] Khormali, A., Abusnaina, A., Chen, S., Nyang, D., Mohaisen, A.: Copycat: Practical adversarial attacks on visualization-based malware detection (2019)
  * [17] Konoth, R.K., Vineti, E., Moonsamy, V., Lindorfer, M., Kruegel, C., Bos, H., Vigna, G.: Minesweeper: An in-depth look into drive-by cryptocurrency mining and its defense. In: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS (2018)
  * [18] Kreuk, F., Barak, A., Aviv-Reuven, S., Baruch, M., Pinkas, B., Keshet, J.: Deceiving end-to-end deep learning malware detectors using adversarial examples (2018)
  * [19] Ling, X., Wu, L., Zhang, J., Qu, Z., Deng, W., Chen, X., Wu, C., Ji, S., Luo, T., Wu, J., Wu, Y.: Adversarial attacks against windows PE malware detection: A survey of the state-of-the-art. CoRR (2021)
  * [20] Liu, X., Zhang, J., Lin, Y., Li, H.: ATMPA: attacking machine learning-based malware visualization detection methods via adversarial examples. In: Proceedings of the International Symposium on Quality of Service, IWQoS 2019 (2019)
  * [21] Musch, M., Wressnegger, C., Johns, M., Rieck, K.: New kid on the web: A study on the prevalence of webassembly in the wild. Lecture Notes in Computer Science (2019)
  * [22] Nakamoto, S.: Bitcoin: A peer-to-peer electronic cash system. Decentralized business review p. 21260 (2008)
  * [23] Naseem, F.N., Aris, A., Babun, L., Tekiner, E., Uluagac, A.S.: MINOS: A lightweight real-time cryptojacking detection system. In: 28th Annual Network and Distributed System Security Symposium, NDSS 2021 (2021)
  * [24] Noh, J.: WebAssembly Works. https://github.com/Snack-X/wasm-works (2008, Accessed: 2023)
  * [25] Papadopoulos, P., Ilia, P., Markatos, E.P.: Truth in web mining: Measuring the profitability and cost of cryptominers as a web monetization model (2018)
  * [26] Papernot, N., McDaniel, P., Wu, X., Jha, S., Swami, A.: Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks. Proceedings - 2016 IEEE Symposium on Security and Privacy, SP 2016 (2016)
  * [27] Papernot, N., McDaniel, P.D., Goodfellow, I.J., Jha, S., Celik, Z.B., Swami, A.: Practical black-box attacks against machine learning. In: Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, AsiaCCS 2017 (2017)
  * [28] Park, D., Khan, H., Yener, B.: Generation & evaluation of adversarial examples for malware obfuscation. In: 18th IEEE International Conference On Machine Learning And Applications, ICMLA 2019 (2019)
  * [29] Qiao, Y., Zhang, W., Tian, Z., Yang, L.T., Liu, Y., Alazab, M.: Adversarial malware sample generation method based on the prototype of deep learning detector. Comput. Secur. 119 (2022)
  * [30] Rodriguez, J.D.P., Posegga, J.: RAPID: resource and api-based detection against in-browser miners. In: Proceedings of the 34th Annual Computer Security Applications Conference, ACSAC 2018 (2018)
  * [31] Romano, A., Zheng, Y., Wang, W.: Minerray: Semantics-aware analysis for ever-evolving cryptojacking detection. In: 35th IEEE/ACM International Conference on Automated Software Engineering, ASE 2020 (2020)
  * [32] Russo, M., Srndic, N., Laskov, P.: Detection of illicit cryptomining using network metadata. EURASIP J. Inf. Secur. 2021(1) (2021)
  * [33] Suciu, O., Coull, S.E., Johns, J.: Exploring adversarial examples in malware detection. In: 2019 IEEE Security and Privacy Workshops, SP Workshops 2019 (2019)
  * [34] Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I.J., Fergus, R.: Intriguing properties of neural networks. In: 2nd International Conference on Learning Representations, ICLR 2014 (2014)
  * [35] Tekiner, E., Acar, A., Uluagac, A.S., Kirda, E., Selçuk, A.A.: Sok: Cryptojacking malware. In: IEEE European Symposium on Security and Privacy, EuroS&P (2021)
  * [36] Tramèr, F., Carlini, N., Brendel, W., Madry, A.: On adaptive attacks to adversarial example defenses. In: Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020 (2020)
  * [37] Wang, W., Ferrell, B., Xu, X., Hamlen, K.W., Hao, S.: SEISMIC: secure in-lined script monitors for interrupting cryptojacks. In: Computer Security \- 23rd European Symposium on Research in Computer Security, ESORICS 2018. Lecture Notes in Computer Science, vol. 11099 (2018)
  * [38] WebAssembly: Binaryen. https://github.com/WebAssembly/binaryen (2022, Accessed: 2023)
  * [39] Zhang, J., Jiang, X.: Adversarial examples: Opportunities and challenges (2018)