# Malware Makeover: Breaking ML-based Static Analysis by Modifying Executable Bytes

arXiv: https://arxiv.org/abs/1912.09064 · HTML: https://mlsanity.com/paper/1912.09064/

## Key facts

- Cited by 31 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 19 Dec 2019.

## Built on by (most cited first, 30 of 31)

- [Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art](https://mlsanity.com/paper/2112.12310/) (2021)
- [RS-Del: Edit Distance Robustness Certificates for Sequence Classifiers via Randomized Deletion](https://mlsanity.com/paper/2302.01757/) (2023)
- [Towards a Practical Defense against Adversarial Attacks on Deep Learning-based Malware Detectors via Randomized Smoothing](https://mlsanity.com/paper/2308.08906/) (2023)
- [A Robust Defense against Adversarial Attacks on Deep Learning-based Malware Detectors via (De)Randomized Smoothing](https://mlsanity.com/paper/2402.15267/) (2024)
- [SLIFER: Investigating Performance and Robustness of Malware Detection Pipelines](https://mlsanity.com/paper/2405.14478/) (2024)
- [Mal2GCN: A Robust Malware Detection Approach Using Deep Graph Convolutional Networks With Non-Negative Weights](https://mlsanity.com/paper/2108.12473/) (2021)
- [Adversarial Attacks against Binary Similarity Systems](https://mlsanity.com/paper/2303.11143/) (2023)
- [DRSM: De-Randomized Smoothing on Malware Classifier Providing Certified Robustness](https://mlsanity.com/paper/2303.13372/) (2023)
- [URET: Universal Robustness Evaluation Toolkit (for Evasion)](https://mlsanity.com/paper/2308.01840/) (2023)
- [Level Up with ML Vulnerability Identification: Leveraging Domain Constraints in Feature Space for Robust Android Malware Detection](https://mlsanity.com/paper/2205.15128/) (2022)
- [Practical Attacks on Machine Learning: A Case Study on Adversarial Windows Malware](https://mlsanity.com/paper/2207.05548/) (2022)
- [PBP: Post-training Backdoor Purification for Malware Classifiers](https://mlsanity.com/paper/2412.03441/) (2024)
- [On the Lack of Robustness of Binary Function Similarity Systems](https://mlsanity.com/paper/2412.04163/) (2024)
- [Defending against Adversarial Malware Attacks on ML-based Android Malware Detection Systems](https://mlsanity.com/paper/2501.13782/) (2025)
- [On deceiving malware classification with section injection](https://mlsanity.com/paper/2208.06092/) (2022)
- [Hyper-parameter Tuning for Adversarially Robust Models](https://mlsanity.com/paper/2304.02497/) (2023)
- [Machine Learning for Windows Malware Detection and Classification: Methods, Challenges and Ongoing Research](https://mlsanity.com/paper/2404.18541/) (2024)
- [A New Formulation for Zeroth-Order Optimization of Adversarial EXEmples in Malware Detection](https://mlsanity.com/paper/2405.14519/) (2024)
- [On the Effectiveness of Adversarial Training on Malware Classifiers](https://mlsanity.com/paper/2412.18218/) (2024)
- [On the Security Risks of ML-based Malware Detection Systems: A Survey](https://mlsanity.com/paper/2505.10903/) (2025)
- [Attacking Autonomous Driving Agents with Adversarial Machine Learning: A Holistic Evaluation with the CARLA Leaderboard](https://mlsanity.com/paper/2511.14876/) (2025)
- [Fool Me If You Can: On the Robustness of Binary Code Similarity Detection Models against Semantics-preserving Transformations](https://mlsanity.com/paper/2602.12681/) (2026)
- [A Comparison of State-of-the-Art Techniques for Generating Adversarial Malware Binaries](https://mlsanity.com/paper/2111.11487/) (2021)
- [Instance Attack:An Explanation-based Vulnerability Analysis Framework Against DNNs for Malware Detection](https://mlsanity.com/paper/2209.02453/) (2022)
- [On the Effectiveness of Adversarial Samples against Ensemble Learning-based Windows PE Malware Detectors](https://mlsanity.com/paper/2309.13841/) (2023)
- [Certified Adversarial Robustness of Machine Learning-based Malware Detectors via (De)Randomized Smoothing](https://mlsanity.com/paper/2405.00392/) (2024)
- [On the Robustness of Malware Detectors to Adversarial Samples](https://mlsanity.com/paper/2408.02310/) (2024)
- [Sy-FAR: Symmetry-based Fair Adversarial Robustness](https://mlsanity.com/paper/2509.12939/) (2025)
- [Adversarial Malware Generation in Linux ELF Binaries via Semantic-Preserving Transformations](https://mlsanity.com/paper/2604.22639/) (2026)
- [Attacking the First-Principle: A Black-Box, Query-Free Targeted Mimicry Attack on Binary Function Classifiers](https://mlsanity.com/paper/2605.18231/) (2026)

## Abstract (arXiv)

Motivated by the transformative impact of deep neural networks (DNNs) in various domains, researchers and anti-virus vendors have proposed DNNs for malware detection from raw bytes that do not require manual feature engineering. In this work, we propose an attack that interweaves binary-diversification techniques and optimization frameworks to mislead such DNNs while preserving the functionality of binaries. Unlike prior attacks, ours manipulates instructions that are a functional part of the binary, which makes it particularly challenging to defend against. We evaluated our attack against three DNNs in white- and black-box settings, and found that it often achieved success rates near 100%. Moreover, we found that our attack can fool some commercial anti-viruses, in certain cases with a success rate of 85%. We explored several defenses, both new and old, and identified some that can foil over 80% of our evasion attempts. However, these defenses may still be susceptible to evasion by attacks, and so we advocate for augmenting malware-detection systems with methods that do not rely on machine learning.