迷惑云杀毒神经网络 (AML.CS0014)

一句话通俗理解

云杀毒的特征向量在用户侧生成、云端判别——攻击者在本地「污染」特征，云端模型就疯了。

维度	内容
案例类型	演练 / 安全研究
发生时间	2021-06-23
攻击者	Kaspersky ML Research Team
受害目标	Kaspersky’s Antimalware ML Model

云 ML 恶意软件检测器通常在用户侧构建特征再上传云端判别。研究者演示了在用户侧构造混淆特征向量的攻击方式：本地特征被「污染」后，云端神经网络对恶意文件的判别被完全误导。

以下攻击链映射来自 MITRE ATLAS 官方数据（AML.CS0014 的 employs 关系），按官方步骤编号排序；技术名称链接至本库对应技术文档，引用文字为官方对本次运用的描述。

搜索公开 AI 漏洞分析 (AML.T0001)

The researchers performed a review of adversarial ML attacks on antimalware products. They discovered that techniques borrowed from attacks on image classifiers have been successfully applied to the antimalware domain. However, it was not clear if these approaches were effective against the ML component of production antimalware solutions.

搜索受害者自有网站 (AML.T0003)

Kaspersky’s use of ML-based antimalware detectors is publicly documented on their website. In practice, an adversary could use this for targeting.

AI 产品或服务 (AML.T0047)

The researchers used access to the target ML-based antimalware product throughout this case study. This product scans files on the user’s system, extracts features locally, then sends them to the cloud-based ML malware detector for classification. Therefore, the researchers had only black-box access to the malware detector itself, but could learn valuable information for constructing the attack from the feature extractor.

数据集 (AML.T0002.000)

The researchers collected a dataset of malware and clean files. They scanned the dataset with the target ML-based antimalware solution and labeled the samples according to the ML detector’s predictions.

创建代理 AI 模型 (AML.T0005)

A proxy model was trained on the labeled dataset of malware and clean files. The researchers experimented with a variety of model architectures.

对抗性 AI 攻击 (AML.T0017.000)

By reverse engineering the local feature extractor, the researchers could collect information about the input features, used for the cloud-based ML detector. The model collects PE Header features, section features and section data statistics, and file strings information. A gradient based adversarial algorithm for executable files was developed. The algorithm manipulates file features to avoid detection by the proxy model, while still containing the same malware payload

黑盒迁移 (AML.T0043.002)

Using a developed gradient-driven algorithm, malicious adversarial files for the proxy model were constructed from the malware files for black-box transfer to the target model.

验证攻击 (AML.T0042)

The adversarial malware files were tested against the target antimalware solution to verify their efficacy.

规避 AI 模型 (AML.T0015)

The researchers demonstrated that for most of the adversarial files, the antimalware model was successfully evaded. In practice, an adversary could deploy their adversarially crafted malware and infect systems while evading detection.

以下为 MITRE ATLAS 官方案例收录的参考来源：

版本: ATLAS 2026.09 | 更新: 2026-10-24 | 模板: ATLAS 案例研究 v1.0