# Adversarial Deep Learning for Robust Detection of Binary Encoded Malware

arXiv: https://arxiv.org/abs/1801.02950 · HTML: https://mlsanity.com/paper/1801.02950/

## Key facts

- Cited by 32 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 9 Jan 2018.

## Built on by (most cited first, 30 of 32)

- [Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art](https://mlsanity.com/paper/2112.12310/) (2021)
- [RS-Del: Edit Distance Robustness Certificates for Sequence Classifiers via Randomized Deletion](https://mlsanity.com/paper/2302.01757/) (2023)
- [RoPGen: Towards Robust Code Authorship Attribution via Automatic Coding Style Transformation](https://mlsanity.com/paper/2202.06043/) (2022)
- [TANTRA: Timing-Based Adversarial Network Traffic Reshaping Attack](https://mlsanity.com/paper/2103.06297/) (2021)
- [Residue-Based Natural Language Adversarial Attack Detection](https://mlsanity.com/paper/2204.10192/) (2022)
- [MalProtect: Stateful Defense Against Adversarial Query Attacks in ML-based Malware Detection](https://mlsanity.com/paper/2302.10739/) (2023)
- [OFEI: A Semi-black-box Android Adversarial Sample Attack Framework Against DLaaS](https://mlsanity.com/paper/2105.11593/) (2021)
- [Improving the robustness and accuracy of biomedical language models through adversarial training](https://mlsanity.com/paper/2111.08529/) (2021)
- [Explanation-Guided Diagnosis of Machine Learning Evasion Attacks](https://mlsanity.com/paper/2106.15820/) (2021)
- [AttackGNN: Red-Teaming GNNs in Hardware Security Using Reinforcement Learning](https://mlsanity.com/paper/2402.13946/) (2024)
- [Realizable Universal Adversarial Perturbations for Malware](https://mlsanity.com/paper/2102.06747/) (2021)
- [PAD: Towards Principled Adversarial Malware Detection Against Evasion Attacks](https://mlsanity.com/paper/2302.11328/) (2023)
- [The Impacts of Unanswerable Questions on the Robustness of Machine Reading Comprehension Models](https://mlsanity.com/paper/2302.00094/) (2023)
- [Mal2GCN: A Robust Malware Detection Approach Using Deep Graph Convolutional Networks With Non-Negative Weights](https://mlsanity.com/paper/2108.12473/) (2021)
- [StratDef: Strategic Defense Against Adversarial Attacks in ML-based Malware Detection](https://mlsanity.com/paper/2202.07568/) (2022)
- [URET: Universal Robustness Evaluation Toolkit (for Evasion)](https://mlsanity.com/paper/2308.01840/) (2023)
- [Burning the Adversarial Bridges: Robust Windows Malware Detection Against Binary-level Mutations](https://mlsanity.com/paper/2310.03285/) (2023)
- [MalPurifier: Enhancing Android Malware Detection with Adversarial Purification against Evasion Attacks](https://mlsanity.com/paper/2312.06423/) (2023)
- [A Red Teaming Framework for Securing AI in Maritime Autonomous Systems](https://mlsanity.com/paper/2312.11500/) (2023)
- [Level Up with ML Vulnerability Identification: Leveraging Domain Constraints in Feature Space for Robust Android Malware Detection](https://mlsanity.com/paper/2205.15128/) (2022)
- [On deceiving malware classification with section injection](https://mlsanity.com/paper/2208.06092/) (2022)
- [A Malware Classification Survey on Adversarial Attacks and Defences](https://mlsanity.com/paper/2312.09636/) (2023)
- [CARE: Ensemble Adversarial Robustness Evaluation Against Adaptive Attackers for Security Applications](https://mlsanity.com/paper/2401.11126/) (2024)
- [MASKDROID: Robust Android Malware Detection with Masked Graph Representations](https://mlsanity.com/paper/2409.19594/) (2024)
- [On the Effectiveness of Adversarial Training on Malware Classifiers](https://mlsanity.com/paper/2412.18218/) (2024)
- [On the Security Risks of ML-based Malware Detection Systems: A Survey](https://mlsanity.com/paper/2505.10903/) (2025)
- [Adversarial Patterns: Building Robust Android Malware Classifiers](https://mlsanity.com/paper/2203.02121/) (2022)
- [Effectiveness of Moving Target Defenses for Adversarial Attacks in ML-based Malware Detection](https://mlsanity.com/paper/2302.00537/) (2023)
- [EGAN: Evolutional GAN for Ransomware Evasion](https://mlsanity.com/paper/2405.12266/) (2024)
- [Improving Adversarial Robustness in Android Malware Detection by Reducing the Impact of Spurious Correlations](https://mlsanity.com/paper/2408.16025/) (2024)

## Abstract (arXiv)

Malware is constantly adapting in order to avoid detection. Model based malware detectors, such as SVM and neural networks, are vulnerable to so-called adversarial examples which are modest changes to detectable malware that allows the resulting malware to evade detection. Continuous-valued methods that are robust to adversarial examples of images have been developed using saddle-point optimization formulations. We are inspired by them to develop similar methods for the discrete, e.g. binary, domain which characterizes the features of malware. A specific extra challenge of malware is that the adversarial examples must be generated in a way that preserves their malicious functionality. We introduce methods capable of generating functionally preserved adversarial malware examples in the binary domain. Using the saddle-point formulation, we incorporate the adversarial examples into the training of models that are robust to them. We evaluate the effectiveness of the methods and others in the literature on a set of Portable Execution~(PE) files. Comparison prompts our introduction of an online measure computed during training to assess general expectation of robustness.