# Static Malware Detection & Subterfuge: Quantifying the Robustness of Machine Learning and Current Anti-Virus

arXiv: https://arxiv.org/abs/1806.04773 · HTML: https://mlsanity.com/paper/1806.04773/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 12 Jun 2018.

## Built on by (most cited first, 8 of 8)

- [Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art](https://mlsanity.com/paper/2112.12310/) (2021)
- [Assemblage: Automatic Binary Dataset Construction for Machine Learning](https://mlsanity.com/paper/2405.03991/) (2024)
- [The Cross-evaluation of Machine Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2203.04686/) (2022)
- [Evading Malware Classifiers via Monte Carlo Mutant Feature Discovery](https://mlsanity.com/paper/2106.07860/) (2021)
- [Stealing and Evading Malware Classifiers and Antivirus at Low False Positive Conditions](https://mlsanity.com/paper/2204.06241/) (2022)
- [A Comparison of State-of-the-Art Techniques for Generating Adversarial Malware Binaries](https://mlsanity.com/paper/2111.11487/) (2021)
- [Instance Attack:An Explanation-based Vulnerability Analysis Framework Against DNNs for Malware Detection](https://mlsanity.com/paper/2209.02453/) (2022)
- [High-resolution Image-based Malware Classification using Multiple Instance Learning](https://mlsanity.com/paper/2311.12760/) (2023)

## Abstract (arXiv)

As machine-learning (ML) based systems for malware detection become more prevalent, it becomes necessary to quantify the benefits compared to the more traditional anti-virus (AV) systems widely used today. It is not practical to build an agreed upon test set to benchmark malware detection systems on pure classification performance. Instead we tackle the problem by creating a new testing methodology, where we evaluate the change in performance on a set of known benign & malicious files as adversarial modifications are performed. The change in performance combined with the evasion techniques then quantifies a system's robustness against that approach. Through these experiments we are able to show in a quantifiable way how purely ML based systems can be more robust than AV products at detecting malware that attempts evasion through modification, but may be slower to adapt in the face of significantly novel attacks.