Pith. sign in

REVIEW 5 major objections 6 minor 46 references

Adapting Novelty towards Generating Antigens for Antivirus systems

T0 review · 5 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read An evolutionary algorithm guided by novelty search can generate diverse, scanner-evading variants of a malware's assembly code, serving as antigens for improving antivirus detection.

desk verdict A modest but real EA-malware contribution undermined by a load-bearing gap: the variants' maliciousness is never dynamically verified, so the 98% evasion rate may just be broken binaries. read the letter →

arxiv 2505.18520 v1 pith:GW6UXPJY submitted 2025-05-24 cs.CR cs.NE

Ritwik Murali , C Shunmuga Velayutham This is my paper · ORCID
classification cs.CRcs.NE
keywords EvolutionaryAlgorithmMalwareGenerationNoveltySearchAntivirusEvasionAssemblyCodeTransformationProactiveDefenceVariantsAntigens
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that an evolutionary algorithm that searches for novelty rather than a fixed fitness optimum can generate large numbers of diverse variants of a malware program by mutating its assembly source code, and that these variants still behave maliciously while escaping detection by antivirus scanners. Such variants are proposed as 'antigens': a proactive dataset a detection engine can be trained on before real-world versions of the malware appear. The authors implement this as MAGE, seed it with the Intruder virus, and report that variants evolved with a novelty-supported fitness function are significantly more diverse than those from a similarity-only fitness function, and that over 98% of the scanners on an online multi-engine service fail to detect them by generation 250. If correct, the contribution is a generic, modular framework for producing malware variant datasets for proactive defence, not a single bespoke generator.

What carries the argument

The central object is the novelty-search fitness function acting on a linear representation of the assembly code. Each individual is represented as a vector of assembly statements; the fitness is the Euclidean distance between the individual's Jaccard similarity vector and the mean similarity vector of the population. Jaccard similarity here is the size of the intersection of two code-statement sets divided by the size of their union, so the fitness rewards individuals that are structurally unusual relative to both their neighbours and the source malware. The variation machinery consists of five constrained mutation operators (fake instruction, forced JMP, untouchable block, conditional-zero JMP, conditional-nonzero JMP) and a code-block-interchange crossover operator with a pivot point; the constraints are what keep the transformed code a valid, assemblable program. Together the operators and the fitness function push the population toward divergent code structures instead of convergence to a single optimum.

What would settle it

Place each evolved variant in an isolated virtual machine and check whether it still exhibits Intruder's infection behaviour, namely attaching itself to .EXE files and spreading to directories and drives. If scanner-evading variants fail to infect any target file, the retained-maliciousness claim collapses; a complementary control would apply the same transformation operators to benign assembly programs and verify that the constraints really produce valid, correctly running executables.

Watch

Extended reading notes

Core claim

The paper's central claim is that MAGE, an evolutionary algorithm operating on the assembly source code of a seed malware, can evolve a large population of diverse variants that remain valid executables, retain the malicious behaviour of the source, and evade the signature-based detection of commercial antivirus scanners. The authors build the algorithm from generic transformation operators—fake NOP instructions, forced jumps, untouchable dead-code blocks, conditional zero and non-zero jumps, and pivot-constrained code block interchange—and combine them with a novelty-search fitness function that rewards assembly programs whose Jaccard similarity profiles differ from their neighbours and from the source. Using the Intruder virus as the seed, 20 of the scanners on the online service detected the original, while after 250 generations of evolution the best variants evaded over 98% of those scanners. A Mann-Whitney U test on the similarity of initial and final populations supports the paper's claim that novelty-based fitness induces significantly greater structural diversity than similarity-only fitness.

Load-bearing premise

The load-bearing premise is that the transformation operators preserve both the validity and the maliciousness of the evolved executables; the paper never executes the variants to confirm they still infect files, so if the mutations break the virus, the evasion result may just mean the variants are inert.

Editorial extensions

If this is right

  • If MAGE works as claimed, a single seed malware can yield a large dataset of structurally distinct variants, with the paper reporting on the order of 12,000 valid executables over 600 generations, that can be fed to antivirus and malware analysis engines for retraining.
  • The novelty-supported fitness function outperforming similarity-only fitness implies that future malware-generation evolutionary algorithms should adopt divergence-promoting objectives rather than pure similarity to the source.
  • Since the 98% evasion emerges from constrained assembly-level changes, the result underscores how brittle signature-based detection is; detection engines would need to incorporate the same transformation space to keep up.
  • The modular framework allows representation, transformation operators, quality indicator, and the underlying evolutionary algorithm to be swapped, so the same design can be applied to other malware families or code representations without redesigning the generator.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's 'retained maliciousness' claim is supported only by the fact that the transformations never touch the virus's infection logic, not by observation of infection; the most direct test would be executing the variants, and the evasion numbers would be equally explained by variants that are broken or inert.
  • The same novelty-search objective could be transferred to adjacent security generation tasks, such as producing diverse fuzzing inputs or adversarial examples, wherever population diversity is the goal rather than a single optimum.
  • A practical deployment would require showing that the antigen dataset improves detector accuracy on held-out variants, not merely that the variants evade the scanners they were tested against.
  • Because the transformations are assembly-level, they could in principle be applied at build time to benign programs as a stress test for false positives, giving detection engines a calibration signal.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes MAGE, an evolutionary framework that starts from an input malware's assembly source and applies code transformation operators (fake instructions, forced jumps, untouchable blocks, conditional jumps, and code-block crossover) together with a novelty-inspired fitness function to evolve variants. The authors claim that the variants are diverse, valid, retain maliciousness, and evade over 98% of VirusTotal scanners, and they suggest that the resulting dataset can serve as "antigens" for training antivirus engines. The experiments compare two fitness functions, alpha (Jaccard similarity only) and beta (distance to the population-mean similarity vector), on a single virus, Intruder, using one run of 300 generations. The central claims are that beta produces more diverse variants than alpha and that the variants evade antivirus detection while remaining malicious.

Significance. If substantiated, the framework would be a useful modular testbed for proactive malware variant generation, and the antigen framing is a plausible application for augmenting antivirus training sets. The paper's strengths are its explicit formulation of assembly-level transformation operators with constraints, the modular separation of representation, variation, and fitness, and the inclusion of a baseline comparison and a statistical test. However, the current evidence does not yet support the central claims: maliciousness is never confirmed behaviorally, the diversity advantage of beta is largely encoded in its fitness function, the statistical test ignores within-run dependence, and the VirusTotal data are unreproducible. No code or data artifacts are provided, which further limits reproducibility. The idea is promising, but the manuscript needs substantial additional validation before the core claims can be accepted.

major comments (5)
  1. [This concerns Section 3 (Experiments and Discussion) and Section 4 (Conclusion).] The paper's central claim that variants retain their maliciousness is not verified. The text equates "valid virus executables" with assembly code that assembles under MASM, but no experiment executes the evolved binaries to confirm that they still attach to and infect .EXE files. The operators T_FJ, T_UB, T_CZJ, and T_CNZJ insert jumps and dead code in the program body; without dynamic analysis, the observed VirusTotal evasion could simply be a consequence of non-functional executables. Please add behavioral verification, for example by executing each evolved variant in the isolated VM against clean .EXE files and checking infection behavior, and report the fraction of variants that remain infectious. Without this, the antigen-dataset claim in Section 4 is unsupported.
  2. [This concerns Section 2.2, Eq. (1), and Section 3, Fig. 5 and Table 2.] The claimed diversity advantage of fitness beta over alpha is partly a consequence of the fitness definition. Eq. (1) defines beta as the Euclidean distance of an individual's similarity vector from the population-mean similarity vector, so selection explicitly rewards deviation from the population mean; lower final similarity to the source under beta is therefore expected. The Mann-Whitney test in Table 2 largely confirms that the beta objective was optimized, rather than demonstrating that beta discovers a more diverse variant space in an independent sense. Please compare alpha and beta using a diversity metric not contained in the fitness, such as pairwise assembly edit distance, instruction n-gram overlap, or behavioral traces, and discuss the relationship between the objective and the measured outcome.
  3. [This concerns Section 3, Table 2.] The Mann-Whitney U test is applied to the 20 individuals of the initial population versus the 20 individuals of the final population of a single evolutionary run. These individuals are not independent samples: they are produced by one stochastic process, share ancestry through crossover and selection, and the final population is the result of selection on the fitness under test. The reported p-value (6.467e-8) therefore overstates the statistical significance. The hypothesis should be tested over multiple independent runs with different random seeds, using one summary statistic per run, or with an appropriate hierarchical model that accounts for within-run dependence.
  4. [This concerns Section 3, Figure 6 and the VirusTotal evaluation.] The VirusTotal evaluation is not reproducible and the headline number is under-specified. The paper does not provide the SHA-256 hashes or VirusTotal report URLs for the source and evolved variants, the submission date, the exact scanner set, or the raw detection counts behind Figure 6. Since VirusTotal detections change over time and the paper itself notes that minor code modifications evade scanners, the claim that variants "evaded over 98% of popular antivirus scanners" cannot be verified or compared with future work. Please include the per-generation detection counts, the total scanner count, and a permanent artifact, such as hashes and reports or a public repository.
  5. [This concerns Section 2.2, Eq. (1), and Algorithm 2, line 4.] The fitness function is not defined unambiguously enough to reproduce. Eq. (1) is written as a sum over i=1..P of (\bar{S}, \vec{S}_{I_i})^2, which is not the Euclidean distance between an individual similarity vector and the mean vector described in the text; the roles of \bar{S} and \vec{S}_{I_i} are not clear, and Algorithm 2 line 4 abbreviates the quantity with an undefined "J_i". Please rewrite the per-individual fitness definition with explicit vector components and dimensions, and align Algorithm 2 with that definition.
minor comments (6)
  1. [This concerns Section 3, experimental setup.] The paper says the EA was run for 300 generations, but later states that MAGE evolved valid virus executables for "over 600 generations" and 12,000 variants; please reconcile this discrepancy and report the actual run length.
  2. [This concerns Section 3, generality of the results.] The text claims the framework is generic and applicable to "any malware", but the experiments use a single virus (Intruder) and a single random seed; please temper the generalization claim or support it with additional malware families and seeds.
  3. [This concerns Algorithm 2, line 10.] Algorithm 2 mentions adding novel individuals to a "Unique" variant dataset, but no novelty threshold or dataset construction rule is specified; please clarify how this dataset is formed and how it relates to the final evaluation.
  4. [This concerns Section 3, hyperparameters.] The paper does not report the mutation probabilities p_mi, the crossover probability, the tournament size, or the actual random seed value, even though the comparison is said to use the same seed; please list all hyperparameters.
  5. [This concerns Figure 5 and Table 2.] The caption of Figure 5 and the columns of Table 2 do not state whether the reported similarity values are for the best individual per generation or for the whole population; please clarify the aggregation. In addition, Table 2 appears to have formatting errors with missing values in some rows.
  6. [This concerns the overall reproducibility of the manuscript.] No repository or artifact link is provided for the MAGE implementation or the evolved variants; please include one to support reproducibility and follow-up research.

Circularity Check

1 steps flagged · score 5.0 of 10

The novelty-based diversity result is partly engineered by construction: fitness β rewards distance from a mean that includes similarity to the source, and the paper validates diversity using exactly that source-similarity metric.

  1. self definitional [Section 2.2, Eqs. (1)-(2); Section 3, Figure 5 and Table 2]
    "the quality indicator (ξ) is calculated as the euclidean distance between each individual in the population and the mean vector (S̄) of all intra-population similarity vectors in the population as shown in equation 1 ... The similarity vector S_Ii for the ith individual within the population P is S_Ii = J(p1,pi),J(p2,pi),...,J(p_NP,pi),J(ζ,pi) where ... ζ is the source virus code and J(pj,pi) is the Jaccard similarity index between a jth and ith chromosome as shown in equation 2."

    Fitness β is defined as the Euclidean distance of each individual's similarity vector from the population mean of those vectors, and that vector explicitly includes J(ζ,p_i), the Jaccard similarity to the source virus. Because the initial population is generated by transforming the source, all J(ζ,p_i) values start near 1, so the mean of that component is near 1. Maximizing distance from that mean therefore pushes individuals to reduce J(ζ,p_i). The paper then validates the 'greater diversity' claim by measuring exactly this similarity to the source (Figure 5, Table 2), and reports that β's final population has similarity values around 0.49 versus α's values near 0.98.

full rationale

The VirusTotal evasion result is external and not circular: scanner detections provide independent evidence that the evolved executables evade detection. However, the paper never executes the evolved variants to verify infection behavior, so 'retaining maliciousness' is asserted rather than demonstrated; this is a validity gap, not a circularity. The paper's self-citations ([24], [29], [30]) are background and not load-bearing. The partial circularity is confined to the diversity claim: fitness β includes source-similarity J(ζ,p_i) inside the vector whose distance from the population mean is maximized, and the evaluation metric for diversity is that same source-similarity. Hence the headline diversity improvement is partly constructed by the fitness definition. Overall score 5 reflects one central-but-partial reduction by construction, with the evasion result remaining independent.

Assumptions & free parameters 4 free parameters · 4 assumptions · 1 invented entities

The central diversity claim is driven by the fitness definition and the statistical result; the evasion claim depends on unverified VirusTotal runs. No fitted constants appear. The main unsupported inputs are the preservation-of-maliciousness assumption and the mapping from population-level novelty to per-individual fitness.

free parameters (4)
  • population_size = 20
    Population size was 'set at a random value of 20' (Section 3); no sensitivity analysis is provided.
  • generations = 300
    EA termination after 300 generations; no justification is given beyond the observed plateau.
  • mutation_probabilities = not specified
    Algorithm 2 uses per-transformation probabilities p_mi but their values are never reported.
  • random_seed = single common seed
    One seed is used for both alpha and beta runs, with no repeated runs or variance estimates.
assumptions (4)
  • domain assumption The five assembly transformations (Fake Instruction, Forced JMP, Untouchable Block, Conditional Zero JMP, Conditional Non Zero JMP) always produce correctly assembling executables with preserved semantics.
    Assumed via constraints C_com and pivot rules (Section 2.3); no formal proof or dynamic verification is provided.
  • domain assumption Jaccard similarity over tokenized assembly code is a faithful proxy for malware code diversity.
    Chosen after 'preliminary experiments' (Section 2.2), but no comparative evaluation of alternative metrics is shown.
  • ad hoc to paper The novelty fitness xi defined as Euclidean distance to the mean of similarity vectors can be used as a per-individual selection pressure in the EA.
    Equation 1 defines xi as a population-level aggregate, while Algorithm 2 says 'Compute fitness xi for every candidate i'; the mapping from individual to fitness value is not stated precisely.
  • domain assumption VirusTotal detection ratio is a valid measure of antivirus evasion for the generated variants.
    VirusTotal is a third-party aggregation service; scans are time-dependent and engine updates change results.
invented entities (1)
  • Malware variants as 'antigens'
    purpose: Conceptual framing for using evolved variants as training data for antivirus systems.
    The paper does not test whether presenting these variants to detection engines improves future detection, so the antigen mechanism is proposed, not demonstrated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adapting Novelty towards Generating Antigens for Antivirus systems." pith.science (2026). https://pith.science/paper/GW6UXPJY

@misc{pith2026250518520,
  author       = {Pith},
  title        = {Pith review of: Adapting Novelty towards Generating Antigens for Antivirus systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GW6UXPJY}},
  note         = {Machine review of arXiv:2505.18520}
}
read the original abstract

It is well known that anti-malware scanners depend on malware signatures to identify malware. However, even minor modifications to malware code structure results in a change in the malware signature thus enabling the variant to evade detection by scanners. Therefore, there exists the need for a proactively generated malware variant dataset to aid detection of such diverse variants by automated antivirus scanners. This paper proposes and demonstrates a generic assembly source code based framework that facilitates any evolutionary algorithm to generate diverse and potential variants of an input malware, while retaining its maliciousness, yet capable of evading antivirus scanners. Generic code transformation functions and a novelty search supported quality metric have been proposed as components of the framework to be used respectively as variation operators and fitness function, for evolutionary algorithms. The results demonstrate the effectiveness of the framework in generating diverse variants and the generated variants have been shown to evade over 98% of popular antivirus scanners. The malware variants evolved by the framework can serve as antigens to assist malware analysis engines to improve their malware detection algorithms.

Figures

Figures reproduced from arXiv: 2505.18520 by the authors.

Figure 1
Figure 1. Linear representation of virus code [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Graph representation of virus code. dictates), the quality indicator (𝜉) is calculated as the euclidean distance between each individual in the population and the mean vector (¯𝑆) of all intra-population similarity vectors in the population as shown in equation 1. Here P is the population size. 𝜉 = vut∑︁ 𝑃 𝑖=1 ( ¯𝑆, −→𝑆𝐼𝑖) 2 (1) The similarity vector −→𝑆 𝐼𝑖 for the 𝑖 𝑡ℎ individual within the pop￾ulation P is −→𝑆𝐼𝑖 =… view at source ↗
Figure 3
Figure 3. Forced JMP Transformation There are also certain transformation functions that are classi￾fied under 𝜓, 𝜏 and 𝜎, commonly used in higher level programming languages. These include operations such as loop unrolling, class transformations, array transformations, etc., which are not feasi￾ble to apply in the context of assembly language transformations because the format is not supported in assembly languages and/or th… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Code block interchange transformation be considered to be in the middle of the source assembly code thus facilitating equal opportunity to the blocks above and below for arbitrary transformations. It is worth observing that𝑇𝐶𝐵𝐼 is a poten￾tial candidate transformation …
Figure 5
Figure 5. Figure 5: Similarity values of Initial and Final population [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Evasion capability of MAGE: Number of antivirus [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

46 extracted references · 42 canonical work pages

  1. [1]

    Giovanni Apruzzese, Michele Colajanni, Luca Ferretti, Alessandro Guido, and Mirco Marchetti. 2018. On the effectiveness of machine and deep learning for cyber security. In 2018 10th International Conference on Cyber Conflict (CyCon) . IEEE, IEEE, Tallinn, 371–390

    work page 2018

  2. [3]

    Emre Aydogan and Sevil Sen. 2015. Automatic generation of mobile malwares using genetic programming. In European conference on the applications of evolu- tionary computation. Springer, Copenhagen, 745–756

    work page 2015

  3. [4]

    Wolfgang Banzhaf, Peter Nordin, Robert E Keller, and Frank D Francone. 1998. Genetic programming: an introduction . Vol. 1. Morgan Kaufmann Publishers San Francisco, California

    work page 1998

  4. [5]

    Shamik Bose, Timothy Barao, and Xiuwen Liu. 2020. Explaining ai for mal- ware detection: Analysis of mechanisms of malconv. In 2020 International Joint Conference on Neural Networks (IJCNN) . IEEE, IEEE, Glasgow, 1–8

    work page 2020

  5. [6]

    Andrea Cani, Marco Gaudesi, Ernesto Sanchez, Giovanni Squillero, and Alberto Tonda. 2014. Towards automated malware creation: code generation and code integration. In Proceedings of the 29th Annual ACM Symposium on Applied Com- puting. ACM, Gyeongju, Republic of Korea, 157–160

    work page 2014

  6. [7]

    Raphael Labaca Castro, Corinna Schmitt, and Gabi Dreo. 2019. AIMED: Evolv- ing Malware with Genetic Programming to Evade Detection. In 2019 18th IEEE International Conference On Trust, Security And Privacy In Computing And Commu- nications/13th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE). IEEE, Rotorua, 240–247

    work page 2019

  7. [8]

    Rory Coulter, Qing-Long Han, Lei Pan, Jun Zhang, and Yang Xiang. 2020. Code analysis for intelligent cyber systems: A data-driven approach. Information sciences 524 (2020), 46–58

    work page 2020

  8. [9]

    T Divya and Kandasamy Muniasamy. 2015. Real-time intrusion prediction using hidden Markov model with genetic algorithm. In Artificial intelligence and evolutionary algorithms in engineering systems . Springer, New Delhi, 731–736

    work page 2015

Show all 46 references
  1. [10]

    Stephane Doncieux, Alban Laflaquière, and Alexandre Coninx. 2019. Novelty search: a theoretical perspective. In Proceedings of the Genetic and Evolutionary Computation Conference. ACM, Prague, 99–106. https://doi.org/10.1145/3321707. 3321752

    2019 doi

  2. [11]

    Stephane Doncieux, Giuseppe Paolo, Alban Laflaquière, and Alexandre Coninx

  3. [12]

    Weijie Han, Jingfeng Xue, Yong Wang, Fuquan Zhang, and Xianwei Gao. 2021. APTMalInsight: Identify and cognize APT malware based on system call infor- mation and ontology knowledge framework. Information Sciences 546 (2021), 633–664

    2021

  4. [13]

    Shohreh Hosseinzadeh, Sampsa Rauti, Samuel Laurén, Jari-Matti Mäkelä, Jo- hannes Holvitie, Sami Hyrynsalmi, and Ville Leppänen. 2018. Diversification and obfuscation techniques for software security: A systematic literature review. Information and Software Technology 104 (2018), 72–93

    2018

  5. [14]

    Weiwei Hu and Ying Tan. 2017. Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN. https://doi.org/10.48550/ARXIV.1702.05983

    2017 doi arXiv

  6. [15]

    Seungho Jeon and Jongsub Moon. 2020. Malware-detection method with a convolutional recurrent neural network using opcode sequences. Information Sciences 535 (2020), 1–15

    2020

  7. [16]

    Alireza Khalilian, Amir Nourazar, Mojtaba Vahidi-Asl, and Hassan Haghighi

  8. [17]

    Joel Lehman and Kenneth O Stanley. 2011. Abandoning objectives: Evolution through the search for novelty alone. Evolutionary computation 19, 2 (2011), 189–223

    2011

  9. [18]

    Joel Lehman and Kenneth O Stanley. 2011. Improving evolvability through nov- elty search and self-adaptation. In 2011 IEEE congress of evolutionary computation (CEC). IEEE, New Orleans, 2693–2700

    2011

  10. [19]

    Yuanzhang Li, Yaxiao Wang, Ye Wang, Lishan Ke, and Yu-an Tan. 2020. A feature-vector generative adversarial network for evading PDF malware classi- fiers. Information Sciences 523 (2020), 38–48

    2020

  11. [20]

    Mark A. Ludwig. 1991. The Little Black Book of Computer Viruses . Amer Eagle Pubns Inc, Arizona

    1991

  12. [21]

    Noah MacAskill, Zachary Wilkins, and Nur Zincir-Heywood. 2021. Scaling Multi- Objective Optimization for Clustering Malware. In 2021 IEEE Symposium Series on Computational Intelligence (SSCI) . IEEE, Orlando, 1–8

    2021

  13. [22]

    Alexey V Malanov and Vitaliy A Kamlyuk. 2012. Rapid heuristic method and system for recognition of similarity between malware variants. US Patent 8,250,655

    2012

  14. [23]

    Farnoush Manavi and Ali Hamzeh. 2019. A new approach for malware detection based on evolutionary algorithm. In Proceedings of the Genetic and Evolutionary Computation Conference Companion. ACM, Prague, 1619–1624

    2019

  15. [24]

    KannanMani S ManiArasuSekar, Paveethran Swaminathan, Ritwik Murali, Govind K Ratan, and Surya V Siva. 2020. Optimal feature selection for non- network malware classification. In 2020 International Conference on Inventive Computation Technologies (ICICT). IEEE, IEEE, Coimbatore, 82–87

    2020

  16. [25]

    Syed Bilal Mehdi, Ajay Kumar Tanwani, and Muddassar Farooq. 2009. Imad: in-execution malware analysis and detection. In Proceedings of the 11th Annual conference on Genetic and evolutionary computation . ACM, Montréal, 1553–1560

    2009

  17. [26]

    Héctor D Menéndez, David Clark, and Earl T Barr. 2021. Getting ahead of the Arms Race: Hothousing the Coevolution of VirusTotal with a Packer. Entropy 23, 4 (2021), 395

    2021

  18. [27]

    Guozhu Meng, Yinxing Xue, Chandramohan Mahinthan, Annamalai Narayanan, Yang Liu, Jie Zhang, and Tieming Chen. 2016. Mystique: Evolving android malware for auditing anti-malware tools. In Proceedings of the 11th ACM on Asia conference on computer and communications security . A...

    2016

  19. [28]

    Peter Morley. 2001. Processing virus collections. VIRUS 129 (2001), 129–134

    2001

  20. [29]

    Ritwik Murali, Akash Ravi, and Harshit Agarwal. 2020. A Malware Variant Resistant To Traditional Analysis Techniques. In2020 International Conference on Emerging Trends in Information Technology and Engineering (ic-ETITE) . IEEE, Chennai, 1–7

    2020

  21. [30]

    Ritwik Murali and C Shunmuga Velayutham. 2020. A preliminary investigation into automatically evolving computer viruses using evolutionary algorithms. Journal of Intelligent & Fuzzy Systems 38, 5 (2020), 6517–6526

    2020

  22. [31]

    Sadia Noreen, Shafaq Murtaza, M Zubair Shafiq, and Muddassar Farooq. 2009. Evolvable malware. In Proceedings of the 11th Annual conference on Genetic and evolutionary computation. ACM, Montréal, 1569–1576

    2009

  23. [32]

    Sadia Noreen, Shafaq Murtaza, M Zubair Shafiq, and Muddassar Farooq. 2009. Using Formal Grammar and Genetic Operators to Evolve Malware. In Recent Advances in Intrusion Detection (RAID) . LNCS, Springer, France, 374–375

    2009

  24. [33]

    TG Gregory Paul and T Gireesh Kumar. 2017. A framework for dynamic malware analysis based on behavior artifacts. In Proceedings of the 5th International Con- ference on Frontiers in Intelligent Computing: Theory and Applications . Springer, Adapting Novelty towards Generating ...

    2017

  25. [34]

    M Zubair Rafique, Ping Chen, Christophe Huygens, and Wouter Joosen. 2014. Evolutionary algorithms for classification of malware families through different network behaviors. In Proceedings of the 2014 Annual Conference on Genetic and Evolutionary Computation. ACM, Vancouver, 1167–1174

    2014

  26. [35]

    Abhishek Singh, Debojyoti Dutta, and Amit Saha. 2019. MIGAN: malware im- age synthesis using GANs. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 33. Association for the Advancement of Artificial Intelligence, Honolulu, 10033–10034

    2019

  27. [36]

    SONICWALL. 2022. 2021 SonicWall Cyber Threat Report. SONICWALL. Retrieved January 28, 2022 from https://www.sonicwall.com/medialibrary/en/white-paper/ 2021-cyber-threat-report.pdf

    2022

  28. [37]

    Peter Szor. 2005. The Art of Computer Virus Research and Defense: ART COMP VIRUS RES DEFENSE _p1 . Addison Wesley Professional, USA

    2005

  29. [38]

    Wee Ling Tan and Tram Truong-Huu. 2020. Enhancing Robustness of Malware Detection using Synthetically-adversarial Samples. In GLOBECOM 2020-2020 IEEE Global Communications Conference . IEEE, Taipei, 1–6

    2020

  30. [39]

    VirusTotal. 2021. Getting started with VirusTotal. https://developers.virustotal. com/reference Last accessed August 2021

    2021

  31. [40]

    Zachary Wilkins and Nur Zincir-Heywood. 2020. COUGAR: clustering of un- known malware using genetic algorithm routines. In Proceedings of the 2020 Genetic and Evolutionary Computation Conference . ACM, Cancún, 1195–1203

    2020

  32. [41]

    Yinxing Xue, Guozhu Meng, Yang Liu, Tian Huat Tan, Hongxu Chen, Jun Sun, and Jie Zhang. 2017. Auditing anti-malware tools by evolving android malware and dynamic loading technique. IEEE Transactions on Information Forensics and Security 12, 7 (2017), 1529–1544

    2017

  33. [42]

    Yanfang Ye, Tao Li, Donald Adjeroh, and S Sitharama Iyengar. 2017. A survey on malware detection using data mining techniques. ACM Computing Surveys (CSUR) 50, 3 (2017), 1–40

    2017

  34. [43]

    Suyeon Yoo, Sungjin Kim, Seungjae Kim, and Brent Byunghoon Kang. 2021. AI- HydRa: Advanced hybrid approach using random forest and deep learning for malware classification. Information Sciences 546 (2021), 420–435

    2021

  35. [44]

    Nur Zincir-Heywood, Marco Mellia, and Yixin Diao. 2021. Overview of Artificial Intelligence and Machine Learning . Wiley Online Library, New Jersey. 19–32 pages

    2021

  36. [2018]

    Expert Systems with Applications 112 (2018), 15–33

    G3MD: Mining frequent opcode sub-graphs for metamorphic malware detection of existing families. Expert Systems with Applications 112 (2018), 15–33

    2018

  37. [2020]

    In Proceedings of the 2020 Genetic and Evolutionary Computation Conference

    Novelty search makes evolvability inevitable. In Proceedings of the 2020 Genetic and Evolutionary Computation Conference . ACM, Lille, 85–93

    2020

  38. [2111]

    arXiv:2111.08223 https://arxiv.org/abs/2111.08223

    arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.