# DOOM: A Novel Adversarial-DRL-Based Op-Code Level Metamorphic Malware Obfuscator for the Enhancement of IDS

arXiv: https://arxiv.org/abs/2010.08608 · HTML: https://mlsanity.com/paper/2010.08608/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Oct 2020.

## Built on by (most cited first, 6 of 6)

- [Detection of Malicious Android Applications: Classical Machine Learning vs. Deep Neural Network Integrated with Clustering](https://mlsanity.com/paper/2103.00637/) (2021)
- [Deep Reinforcement Learning for Cybersecurity Threat Detection and Protection: A Review](https://mlsanity.com/paper/2206.02733/) (2022)
- [LSTM Hyper-Parameter Selection for Malware Detection: Interaction Effects and Hierarchical Selection Approach](https://mlsanity.com/paper/2109.11500/) (2021)
- [ADVERSARIALuscator: An Adversarial-DRL Based Obfuscator and Metamorphic Malware SwarmGenerator](https://mlsanity.com/paper/2109.11542/) (2021)
- [Obfuscated Memory Malware Detection](https://mlsanity.com/paper/2408.12866/) (2024)
- [DRo: A data-scarce mechanism to revolutionize the performance of Deep Learning based Security Systems](https://mlsanity.com/paper/2109.05470/) (2021)

## Abstract (arXiv)

We designed and developed DOOM (Adversarial-DRL based Opcode level Obfuscator to generate Metamorphic malware), a novel system that uses adversarial deep reinforcement learning to obfuscate malware at the op-code level for the enhancement of IDS. The ultimate goal of DOOM is not to give a potent weapon in the hands of cyber-attackers, but to create defensive-mechanisms against advanced zero-day attacks. Experimental results indicate that the obfuscated malware created by DOOM could effectively mimic multiple-simultaneous zero-day attacks. To the best of our knowledge, DOOM is the first system that could generate obfuscated malware detailed to individual op-code level. DOOM is also the first-ever system to use efficient continuous action control based deep reinforcement learning in the area of malware generation and defense. Experimental results indicate that over 67% of the metamorphic malware generated by DOOM could easily evade detection from even the most potent IDS. This achievement gains significance, as with this, even IDS augment with advanced routing sub-system can be easily evaded by the malware generated by DOOM.