# Deceiving End-to-End Deep Learning Malware Detectors using Adversarial Examples

arXiv: https://arxiv.org/abs/1802.04528 · HTML: https://mlsanity.com/paper/1802.04528/

## Key facts

- Cited by 20 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Feb 2018.

## Built on by (most cited first, 20 of 20)

- [Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art](https://mlsanity.com/paper/2112.12310/) (2021)
- [RS-Del: Edit Distance Robustness Certificates for Sequence Classifiers via Randomized Deletion](https://mlsanity.com/paper/2302.01757/) (2023)
- [EvadeDroid: A Practical Evasion Attack on Machine Learning for Black-box Android Malware Detection](https://mlsanity.com/paper/2110.03301/) (2021)
- [A Survey on Malware Detection with Graph Representation Learning](https://mlsanity.com/paper/2303.16004/) (2023)
- [Explanation-Guided Diagnosis of Machine Learning Evasion Attacks](https://mlsanity.com/paper/2106.15820/) (2021)
- [A Comparison of Adversarial Learning Techniques for Malware Detection](https://mlsanity.com/paper/2308.09958/) (2023)
- [A Robust Defense against Adversarial Attacks on Deep Learning-based Malware Detectors via (De)Randomized Smoothing](https://mlsanity.com/paper/2402.15267/) (2024)
- [Mal2GCN: A Robust Malware Detection Approach Using Deep Graph Convolutional Networks With Non-Negative Weights](https://mlsanity.com/paper/2108.12473/) (2021)
- [DRSM: De-Randomized Smoothing on Malware Classifier Providing Certified Robustness](https://mlsanity.com/paper/2303.13372/) (2023)
- [Creating Valid Adversarial Examples of Malware](https://mlsanity.com/paper/2306.13587/) (2023)
- [Practical Attacks on Machine Learning: A Case Study on Adversarial Windows Malware](https://mlsanity.com/paper/2207.05548/) (2022)
- [Combining Generators of Adversarial Malware Examples to Increase Evasion Rate](https://mlsanity.com/paper/2304.07360/) (2023)
- [Artificial Intelligence for Cybersecurity: Threats, Attacks and Mitigation](https://mlsanity.com/paper/2209.13454/) (2022)
- [CARE: Ensemble Adversarial Robustness Evaluation Against Adaptive Attackers for Security Applications](https://mlsanity.com/paper/2401.11126/) (2024)
- [ML-based IoT Malware Detection Under Adversarial Settings: A Systematic Evaluation](https://mlsanity.com/paper/2108.13373/) (2021)
- [A Comparison of State-of-the-Art Techniques for Generating Adversarial Malware Binaries](https://mlsanity.com/paper/2111.11487/) (2021)
- [Towards Robust Domain Generation Algorithm Classification](https://mlsanity.com/paper/2404.06236/) (2024)
- [Certified Adversarial Robustness of Machine Learning-based Malware Detectors via (De)Randomized Smoothing](https://mlsanity.com/paper/2405.00392/) (2024)
- [Adversarial Evasion in Non-Stationary Malware Detection: Minimizing Drift Signals through Similarity-Constrained Perturbations](https://mlsanity.com/paper/2604.21310/) (2026)
- [Guarding Organizations Against Malware Risk: A Novel Graph-Based Malware Detection Method](https://mlsanity.com/paper/2607.26634/) (2026)

## Abstract (arXiv)

In recent years, deep learning has shown performance breakthroughs in many applications, such as image detection, image segmentation, pose estimation, and speech recognition. However, this comes with a major concern: deep networks have been found to be vulnerable to adversarial examples. Adversarial examples are slightly modified inputs that are intentionally designed to cause a misclassification by the model. In the domains of images and speech, the modifications are so small that they are not seen or heard by humans, but nevertheless greatly affect the classification of the model. Deep learning models have been successfully applied to malware detection. In this domain, generating adversarial examples is not straightforward, as small modifications to the bytes of the file could lead to significant changes in its functionality and validity. We introduce a novel loss function for generating adversarial examples specifically tailored for discrete input sets, such as executable bytes. We modify malicious binaries so that they would be detected as benign, while preserving their original functionality, by injecting a small sequence of bytes (payload) in the binary file. We applied this approach to an end-to-end convolutional deep learning malware detection model and show a high rate of detection evasion. Moreover, we show that our generated payload is robust enough to be transferable within different locations of the same file and across different files, and that its entropy is low and similar to that of benign data sections.