# Anti-Malware Sandbox Games

arXiv: https://arxiv.org/abs/2202.13520 · HTML: https://mlsanity.com/paper/2202.13520/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 3 of its 22 references that are in the map.
- First posted on arXiv 28 Feb 2022.

## Builds on (most cited first, 3 of 3)

- [General Heuristics for Nonconvex Quadratically Constrained Quadratic Programming](https://mlsanity.com/paper/1703.07870/) (2017)
- [Audit Games with Multiple Defender Resources](https://mlsanity.com/paper/1409.4503/) (2014)
- [Moving Target Defense for Web Applications using Bayesian Stackelberg Games](https://mlsanity.com/paper/1602.07024/) (2016)

## Abstract (arXiv)

We develop a game theoretic model of malware protection using the state-of-the-art sandbox method, to characterize and compute optimal defense strategies for anti-malware. We model the strategic interaction between developers of malware (M) and anti-malware (AM) as a two player game, where AM commits to a strategy of generating sandbox environments, and M responds by choosing to either attack or hide malicious activity based on the environment it senses. We characterize the condition for AM to protect all its machines, and identify conditions under which an optimal AM strategy can be computed efficiently. For other cases, we provide a quadratically constrained quadratic program (QCQP)-based optimization framework to compute the optimal AM strategy. In addition, we identify a natural and easy to compute strategy for AM, which as we show empirically, achieves AM utility that is close to the optimal AM utility, in equilibrium.