mlsanityData to 7 Oct 2026

MalProtect: Stateful Defense Against Adversarial Query Attacks in ML-based Malware Detection

arXiv 2302.10739 ↗First posted 21 Feb 2023cs.LG cs.CRcited by 8

Not on the map. Why?

Abstract (arXiv)

ML models are known to be vulnerable to adversarial query attacks. In these attacks, queries are iteratively perturbed towards a particular class without any knowledge of the target model besides its output. The prevalence of remotely-hosted ML classification models and Machine-Learning-as-a-Service platforms means that query attacks pose a real threat to the security of these systems. To deal with this, stateful defenses have been proposed to detect query attacks and prevent the generation of adversarial examples by monitoring and analyzing the sequence of queries received by the system. Several stateful defenses have been proposed in recent years. However, these defenses rely solely on similarity or out-of-distribution detection methods that may be effective in other domains. In the malware detection domain, the methods to generate adversarial examples are inherently different, and therefore we find that such detection mechanisms are significantly less effective. Hence, in this paper, we present MalProtect, which is a stateful defense against query attacks in the malware detection domain. MalProtect uses several threat indicators to detect attacks. Our results show that it reduces the evasion rate of adversarial query attacks by 80+% in Android and Windows malware, across a range of attacker scenarios. In the first evaluation of its kind, we show that MalProtect outperforms prior stateful defenses, especially under the peak adversarial threat.

Key facts. Cited by 8 papers in the map (data through 7 Oct 2026). Builds on 50 of its 99 references that are in the map. First posted on arXiv 21 Feb 2023.

Builds on

50 of 99 references.

References · 50

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2017A Unified Approach to Interpreting Model Predictionscited by 6,488
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  5. 2016Adversarial examples in the physical worldcited by 1,762
  6. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  7. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  8. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  9. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  10. 2014Deep Learning in Neural Networks: An Overviewcited by 765
  11. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  12. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
38 more
  1. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  2. 2019Memorizing Normality to Detect Anomaly: Memory-augmented Deep Autoencoder for Unsupervised Anomaly Detectioncited by 560
  3. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  4. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  5. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  6. 2019On Evaluating Adversarial Robustnesscited by 442
  7. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  8. 2021Unsolved Problems in ML Safetycited by 291
  9. 2019Improving Adversarial Robustness via Promoting Ensemble Diversitycited by 213
  10. 2017On the (Statistical) Detection of Adversarial Examplescited by 180
  11. 2018The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigationcited by 159
  12. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 159
  13. 2018TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Timecited by 108
  14. 2019Improving Adversarial Robustness of Ensembles with Diversity Trainingcited by 69
  15. 2019Stateful Detection of Black-Box Adversarial Attackscited by 55
  16. 2019Defending Against Model Stealing Attacks with Adaptive Misinformationcited by 55
  17. 2022"Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practicecited by 55
  18. 2020Transcending Transcend: Revisiting Malware Classification in the Presence of Concept Driftcited by 53
  19. 2017Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detectioncited by 51
  20. 2019Few-Shot Learning with Global Class Representationscited by 44
  21. 2016Adversarial Perturbations Against Deep Neural Networks for Malware Classificationcited by 42
  22. 2018Exploring Adversarial Examples in Malware Detectioncited by 41
  23. 2021Partner-Assisted Learning for Few-Shot Image Classificationcited by 36
  24. 2020Blacklight: Scalable Defense for Neural Networks against Query-Based Black-Box Attackscited by 34
  25. 2018Adversarial Deep Learning for Robust Detection of Binary Encoded Malwarecited by 32
  26. 2022SoK: Explainable Machine Learning for Computer Security Applicationscited by 20
  27. 2015Reviewer Integration and Performance Measurement for Malware Detectioncited by 19
  28. 2019Extraction of Complex DNN Models: Real Threat or Boogeyman?cited by 19
  29. 2020Arms Race in Adversarial Malware Detection: A Surveycited by 16
  30. 2017MTDeep: Boosting the Security of Deep Neural Nets Against Adversarial Attacks with Moving Target Defensecited by 12
  31. 2021Morphence: Moving Target Defense Against Adversarial Examplescited by 9
  32. 2021Stateful Detection of Model Extraction Attackscited by 8
  33. 2020Voting based ensemble improves robustness of defensive modelscited by 7
  34. 2018Gradient Similarity: An Explainable Approach to Detect Adversarial Attacks against Deep Learningcited by 6
  35. 2020A Framework for Enhancing Deep Neural Networks Against Adversarial Malwarecited by 6
  36. 2017Attack and Defense of Dynamic Analysis-Based, Adversarial Neural Malware Classification Modelscited by 5
  37. 2019Effectiveness of Adversarial Examples and Defenses for Malware Classificationcited by 4
  38. 2022StratDef: Strategic Defense Against Adversarial Attacks in ML-based Malware Detectioncited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 3; 2024: 0; 2025: 2; 2026: 3.

8 papers.

  1. 2023Privacy Side Channels in Machine Learning Systemscited by 38
  2. 2026SoK: The Pitfalls of Deep Reinforcement Learning for Cybersecuritycited by 4
  3. 2023Evasion Adversarial Attacks Remain Impractical Against ML-based Network Intrusion Detection Systems, Especially Dynamic Onescited by 2
  4. 2025Defending against Adversarial Malware Attacks on ML-based Android Malware Detection Systemscited by 2
  5. 2025On the Security Risks of ML-based Malware Detection Systems: A Surveycited by 1
  6. 2023F2AT: Feature-Focusing Adversarial Training via Disentanglement of Natural and Perturbed Patternscited by 0
  7. 2026EGAMA-RC: Risk-Calibrated Evidence-Gated Adaptive Malware Analysis for Robust and Interpretable Memory-Forensic Triagecited by 0
  8. 2026REPLICANT: Learning Policies for Evading and Hardening Malware Detectorscited by 0