# A Comparison of Adversarial Learning Techniques for Malware Detection

arXiv: https://arxiv.org/abs/2308.09958 · HTML: https://mlsanity.com/paper/2308.09958/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 24 of its 75 references that are in the map.
- First posted on arXiv 19 Aug 2023.

## Builds on (most cited first, 24 of 24)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Generative Adversarial Networks](https://mlsanity.com/paper/2203.00667/) (2022)
- [The Limitations of Deep Learning in Adversarial Settings](https://mlsanity.com/paper/1511.07528/) (2015)
- [Generative Adversarial Networks: An Overview](https://mlsanity.com/paper/1710.07035/) (2017)
- [Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning](https://mlsanity.com/paper/1712.03141/) (2017)
- [EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models](https://mlsanity.com/paper/1804.04637/) (2018)
- [Malware Detection by Eating a Whole EXE](https://mlsanity.com/paper/1710.09435/) (2017)
- [Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN](https://mlsanity.com/paper/1702.05983/) (2017)
- [Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables](https://mlsanity.com/paper/1803.04173/) (2018)
- [Learning to Evade Static PE Machine Learning Malware Models via Reinforcement Learning](https://mlsanity.com/paper/1801.08917/) (2018)
- [Functionality-preserving Black-box Optimization of Adversarial Windows Malware](https://mlsanity.com/paper/2003.13526/) (2020)
- [Exploring Adversarial Examples in Malware Detection](https://mlsanity.com/paper/1810.08280/) (2018)
- [Explaining Vulnerabilities of Deep Learning to Adversarial Malware Binaries](https://mlsanity.com/paper/1901.03583/) (2019)
- [Deceiving End-to-End Deep Learning Malware Detectors using Adversarial Examples](https://mlsanity.com/paper/1802.04528/) (2018)
- [Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection](https://mlsanity.com/paper/2008.07125/) (2020)
- [Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art](https://mlsanity.com/paper/2112.12310/) (2021)
- [Arms Race in Adversarial Malware Detection: A Survey](https://mlsanity.com/paper/2005.11671/) (2020)
- [A Survey on Adversarial Attacks for Malware Analysis](https://mlsanity.com/paper/2111.08223/) (2021)
- [Against All Odds: Winning the Defense Challenge in an Evasion Competition with Diversification](https://mlsanity.com/paper/2010.09569/) (2020)
- [secml-malware: Pentesting Windows Malware Classifiers with Adversarial EXEmples in Python](https://mlsanity.com/paper/2104.12848/) (2021)
- [MDEA: Malware Detection with Evolutionary Adversarial Learning](https://mlsanity.com/paper/2002.03331/) (2020)
- [Practical Attacks on Machine Learning: A Case Study on Adversarial Windows Malware](https://mlsanity.com/paper/2207.05548/) (2022)
- [Combining Generators of Adversarial Malware Examples to Increase Evasion Rate](https://mlsanity.com/paper/2304.07360/) (2023)

## Built on by (most cited first, 5 of 5)

- [Cluster Analysis and Concept Drift Detection in Malware](https://mlsanity.com/paper/2502.14135/) (2025)
- [Adversarial Co-Evolution of Malware and Detection Models: A Bilevel Optimization Perspective](https://mlsanity.com/paper/2604.22569/) (2026)
- [Adversarial Malware Generation in Linux ELF Binaries via Semantic-Preserving Transformations](https://mlsanity.com/paper/2604.22639/) (2026)
- [Building an Adversarial Malware Dataset by Family and Type: Generation, Evasion, and Poisoning Evaluation](https://mlsanity.com/paper/2605.25937/) (2026)
- [EXE-Bench: Ranking the Tradeoffs of AI-based Windows Malware Detectors for Real-World Usability](https://mlsanity.com/paper/2607.24177/) (2026)

## Abstract (arXiv)

Machine learning has proven to be a useful tool for automated malware detection, but machine learning models have also been shown to be vulnerable to adversarial attacks. This article addresses the problem of generating adversarial malware samples, specifically malicious Windows Portable Executable files. We summarize and compare work that has focused on adversarial machine learning for malware detection. We use gradient-based, evolutionary algorithm-based, and reinforcement-based methods to generate adversarial samples, and then test the generated samples against selected antivirus products. We compare the selected methods in terms of accuracy and practical applicability. The results show that applying optimized modifications to previously detected malware can lead to incorrect classification of the file as benign. It is also known that generated malware samples can be successfully used against detection models other than those used to generate them and that using combinations of generators can create new samples that evade detection. Experiments show that the Gym-malware generator, which uses a reinforcement learning approach, has the greatest practical potential. This generator achieved an average sample generation time of 5.73 seconds and the highest average evasion rate of 44.11%. Using the Gym-malware generator in combination with itself improved the evasion rate to 58.35%.