# Marvolo: Programmatic Data Augmentation for Practical ML-Driven Malware Detection

arXiv: https://arxiv.org/abs/2206.03265 · HTML: https://mlsanity.com/paper/2206.03265/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 15 of its 44 references that are in the map.
- First posted on arXiv 7 Jun 2022.

## Builds on (most cited first, 15 of 15)

- [EDA: Easy Data Augmentation Techniques for Boosting Performance on Text Classification Tasks](https://mlsanity.com/paper/1901.11196/) (2019)
- [Differentiable Augmentation for Data-Efficient GAN Training](https://mlsanity.com/paper/2006.10738/) (2020)
- [EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models](https://mlsanity.com/paper/1804.04637/) (2018)
- [Malware Detection by Eating a Whole EXE](https://mlsanity.com/paper/1710.09435/) (2017)
- [SOREL-20M: A Large Scale Benchmark Dataset for Malicious PE Detection](https://mlsanity.com/paper/2012.07634/) (2020)
- [Microsoft Malware Classification Challenge](https://mlsanity.com/paper/1802.10135/) (2018)
- [A Survey of Machine Learning Methods and Challenges for Windows Malware Classification](https://mlsanity.com/paper/2006.09271/) (2020)
- [An Observational Investigation of Reverse Engineers' Processes](https://mlsanity.com/paper/1912.00317/) (2019)
- [Automatic Yara Rule Generation Using Biclustering](https://mlsanity.com/paper/2009.03779/) (2020)
- [MOTIF: A Large Malware Reference Dataset with Ground Truth Family Labels](https://mlsanity.com/paper/2111.15031/) (2021)
- [Data Augmentation Based Malware Detection using Convolutional Neural Networks](https://mlsanity.com/paper/2010.01862/) (2020)
- [Unveiling Zeus](https://mlsanity.com/paper/1303.7012/) (2013)
- [Datalog Disassembly](https://mlsanity.com/paper/1906.03969/) (2019)
- [Would a File by Any Other Name Seem as Malicious?](https://mlsanity.com/paper/1910.04753/) (2019)
- [Data Augmentation for Opcode Sequence Based Malware Detection](https://mlsanity.com/paper/2106.11821/) (2021)

## Built on by (most cited first, 1 of 1)

- [MalMixer: Few-Shot Malware Classification with Retrieval-Augmented Semi-Supervised Learning](https://mlsanity.com/paper/2409.13213/) (2024)

## Abstract (arXiv)

Data augmentation has been rare in the cyber security domain due to technical difficulties in altering data in a manner that is semantically consistent with the original data. This shortfall is particularly onerous given the unique difficulty of acquiring benign and malicious training data that runs into copyright restrictions, and that institutions like banks and governments receive targeted malware that will never exist in large quantities. We present MARVOLO, a binary mutator that programmatically grows malware (and benign) datasets in a manner that boosts the accuracy of ML-driven malware detectors. MARVOLO employs semantics-preserving code transformations that mimic the alterations that malware authors and defensive benign developers routinely make in practice , allowing us to generate meaningful augmented data. Crucially, semantics-preserving transformations also enable MARVOLO to safely propagate labels from original to newly-generated data samples without mandating expensive reverse engineering of binaries. Further, MARVOLO embeds several key optimizations that keep costs low for practitioners by maximizing the density of diverse data samples generated within a given time (or resource) budget. Experiments using wide-ranging commercial malware datasets and a recent ML-driven malware detector show that MARVOLO boosts accuracies by up to 5%, while operating on only a small fraction (15%) of the potential input binaries.