Pith. sign in

REVIEW 4 major objections 5 minor 54 references

Tarallo: Evading Behavioral Malware Detectors in the Problem Space

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that PS-FGSM, a position-sensitive gradient attack on discrete API call sequences, evades recurrent-neural-network behavioral malware detectors with a median of 12–13 injections and up to 99% success in favorable settings.

desk verdict A solid feature-space attack with a genuinely new position-selection heuristic, plus a serious attempt at the problem space that is weaker than the abstract suggests and never verifies that injections actually land as intended. read the letter →

arxiv 2506.02660 v1 pith:QJ6F2PAI submitted 2025-06-03 cs.CR

Gabriele Digregorio , Salvatore Maccarrone , Mario D'Onghia , Luigi Gallo , Michele Carminati , Mario Polino , Stefano Zanero This is my paper
classification cs.CR
keywords adversarialmachinelearningmalwaredetectionAPIcallsequencesdynamicanalysisproblemspaceattacksrecurrentneuralnetworksgradient-basedattackexecutionnondeterminism
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper builds Tarallo, an end-to-end attack framework that claims to evade machine-learning malware detectors which classify Windows executables by their recorded API call sequences. Its central claim is that a new feature-space algorithm, PS-FGSM, computes evasive sequences far more efficiently than prior gradient-based attacks, requiring a median of only 12–13 injected API calls against two state-of-the-art recurrent-neural-network detectors, and that two problem-space strategies, Longest Known Behavior and Behavior Cascade Optimization, make those evasive sequences survive the nondeterminism of real execution. In the paper's experiments the attack reaches up to 99% success in the feature space and up to roughly 99% in the problem space under favorable conditions, while 89% of modified samples preserve their original malware functionality. The paper stresses that earlier attacks were judged only in the feature space, so their perturbations often failed when the sample was re-run and produced a different API sequence.

What carries the argument

The load-bearing object is PS-FGSM, a gradient-sign attack for discrete sequences. It computes the inverse Jacobian of the model output with respect to the input window, meaning the output-to-input gradients, selects the injection position by the greatest smallest norm (alternating with the greatest absolute norm every four iterations to avoid stagnation), and chooses the injected API call from an allowed arsenal that minimizes the L1 distance between the sign of the modified window and the sign of the Jacobian. Around it, Tarallo adds two problem-space strategies: LKB attacks the longest recorded behavior, while BCO attacks the most malicious behavior and propagates the solution to all other recorded behaviors until every variant is classified benign. The PE patcher then rewrites the malware binary, hijacking selected import calls through a jump table to insert the computed API calls while preserving register, stack, and argument state.

What would settle it

Execute a patched sample many times and count how often the recorded API call sequence matches the adversarial sequence at the planned injection positions; if, on a fresh malware corpus, the share of evasive re-executions falls far below the feature-space success rate, the claim that LKB and BCO handle nondeterminism would be contradicted.

Watch

Extended reading notes

Core claim

The central claim is that behavioral malware detectors built on recurrent neural networks and API call sequences can be evaded with only a handful of injected API calls, provided the attacker selects both the injection position and the injected call from the model's gradient. PS-FGSM works by repeatedly locating the position inside a fixed-size window whose Jacobian norm is largest, injecting the API call whose sign pattern most closely matches the inverse Jacobian, and shifting window boundaries so each injection lands at the most sensitive spot. To make the attack work in the problem space, Tarallo re-executes malware several times, either attacking the longest recorded behavior (LKB) or propagating one window's solution across all recorded behaviors (BCO), so the patched binary is evasive across the range of behaviors nondeterministic execution can produce. The paper reports up to 99% evasion in the feature space, medians of 12–13 injected calls, up to roughly 99% problem-space success in the most favorable configuration, and 89% functionality preservation after re-execution.

Load-bearing premise

The load-bearing premise is that the PE patcher and the sandbox faithfully reproduce the planned API call sequence on re-execution, yet the paper's own 89% functionality-preservation result shows that roughly one modified sample in nine does not behave as intended.

Editorial extensions

If this is right

  • If PS-FGSM is as efficient as reported, an attacker needs no source code and no wrapper library: directly patching the PE bytecode is enough to alter a malware sample's apparent dynamic behavior.
  • A median of roughly a dozen injected calls means low-payload evasion is feasible against this class of recurrent-neural-network detector, which changes what counts as a detectable anomaly in API call traces.
  • Because BCO generally outperforms LKB in the paper's problem-space tests, attacks computed against multiple recorded behaviors are more likely to survive re-execution than attacks computed against a single longest trace.
  • The 89% functionality-preservation rate implies that for about one sample in nine the patched binary does not reproduce the original behavior, so problem-space success is bounded below 100% in practice.
  • The black-box transfer experiments show that an attack computed against one recurrent-neural-network detector can partially transfer to another such detector that uses a different API encoding, with effectiveness up to roughly 63% at thresholds chosen for high true-positive rates.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • One consequence the paper leaves implicit is that the same position-sensitivity principle could be tested against transformer-based and attention-based behavioral detectors, since the paper only evaluates recurrent architectures.
  • A testable extension suggested by the results, not carried out in the paper, is to filter out injected API calls that have no operational effect before classification; the 89% functionality-preservation figure implies some injected calls are semantically inert, so such filtering is a concrete countermeasure to evaluate.
  • The paper's finding that attack effectiveness depends on the size of the available API arsenal implies, beyond what the authors state, that limiting the set of injectable APIs could shrink the feasible evasion surface.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper presents Tarallo, an end-to-end framework for evading behavioral malware detectors that classify API call sequences. It introduces PS-FGSM, a gradient-based feature-space attack for discrete sequential data; two problem-space strategies, Longest Known Behavior (LKB) and Behavior Cascade Optimization (BCO), designed to cope with the nondeterminism of repeated malware executions; and a PE patcher that injects API calls into Windows executables without source access. The evaluation targets two RNN-based detectors, Li et al. [25] in white-box settings and Zhang et al. [54] in black-box transfer settings, reporting high feature-space success, reduced attack overhead relative to Rosenberg et al. [43], and problem-space success rates that the abstract summarizes as 'up to 99%'. The paper also reports 89% functionality preservation for modified samples.

Significance. If fully supported, the work would be a meaningful advance in adversarial machine learning for behavioral malware detection: it explicitly addresses execution nondeterminism, proposes a position-sensitive gradient attack for sequence classifiers, and validates attacks end-to-end in a sandbox rather than only in feature space. The public release of Tarallo is a concrete reproducibility contribution. However, the load-bearing problem-space claims are not yet backed by direct evidence that the injected API calls appear at the intended positions, and the headline 'up to 99%' conflates the most favorable white-box cells with substantially weaker black-box transfer results. The contribution is potentially significant, but the current evidence requires revision before the claims as stated can be accepted.

major comments (4)
  1. [§5.2, Table 2, §4.2] The problem-space success criterion is defined solely by whether re-execution of the modified binary produces an API call sequence misclassified as benign; the paper never verifies that the recorded sequence matches the adversarial sequence computed by PS-FGSM. The functionality-preservation check in §4.2 is set-theoretic (the original behavior must be a subset of the post-modification behavior), so injected calls may be missing, displaced, or altered without being detected. Because the PE patcher's hijacking heuristics are fallible, and the paper itself reports that functionality is preserved in only 89% of cases, the causal link between the computed perturbation and the observed evasion is unmeasured. The 0.9863 effectiveness in the most favorable cell of Table 2 could in part reflect nondeterministic luck rather than the intended injections. The paper should report a trace-fidelity metric, such as the fraction of intended injection positions that actually appear in the re-executed trace, or otherwise qualify the problem-space success claims.
  2. [Abstract, §5.2, §5.3, Table 3] The abstract's claim of 'a success rate up to 99% on both feature and problem space attacks' is not representative of the reported problem-space results. In Table 2, white-box problem-space effectiveness ranges from 0.57 to 0.99 for LKB and 0.65 to 0.91 for BCO, with only a single favorable cell reaching 0.9863. In the black-box transfer setting of Table 3, effectiveness is 0.47 to 0.63 across thresholds for both strategies. The conclusion's statement that 'in both feature and problem spaces, our algorithm achieves up to 99% effectiveness' should be qualified to distinguish feature-space performance, the single favorable white-box problem-space cell, and the substantially weaker black-box transfer results.
  3. [§5.3, RQ4, Table 3] The black-box problem-space results are close to random for LKB (0.4696 to 0.5111) and only moderately better for BCO (0.4863 to 0.6341), yet the introduction and abstract claim that Tarallo 'significantly outperforms previous works in both white and black-box scenarios.' The paper does not compare against any prior black-box attack in the same problem-space setting, so this claim is not demonstrated. A comparison with a black-box baseline, or a revised claim that reflects the observed transfer weakness, is needed.
  4. [§4.1, Algorithm 1, Eq. (1)] The selection of the injection position using the 'greatest smallest norm' and the periodic switch to 'greatest absolute norm' every c=4 iterations is presented as an empirical choice, but no ablation is given to justify that this heuristic, rather than the overall gradient-sign framework, is responsible for the improvement over Rosenberg et al. [43]. Since the central feature-space efficiency claim rests on this design, an ablation varying c and the position-selection rule would strengthen the paper.
minor comments (5)
  1. [§5.1, Figure 2] The text states that 'the approach in [43] has an average overhead of 165' for the Li et al. dataset, but in the previous sentence the sentence is about median overhead. The wording should be corrected to 'median overhead' to match the reported statistic.
  2. [Algorithm 1] The concatenation operator ⊥ is used in the algorithm and in the equations but is only informally explained in the surrounding text. A brief formal definition would improve readability.
  3. [Table 2] The column headers 'Arsenal size (2%, 3%] (2%, 6%] Any' are ambiguous. The text explains that percentages refer to the fraction of the total recorded API calls, but it does not clarify whether '(2%, 6%]' is a cumulative range that includes the '(2%, 3%]' column or an independent interval. This should be clarified in the table caption or text.
  4. [§4.1] The notation in the equations defining N_{w,r}, P^{w,r,*}_1, and P^{w,r,*}_2 is not fully aligned with Algorithm 1 (e.g., the role of U_i and the indexing of windows is not defined precisely). A reader working through the algorithm would benefit from consistent notation.
  5. [§5, RQ1] The 89% functionality-preservation figure is reported without confidence intervals or a breakdown by dataset and strategy. Given that the paper uses this as a lower bound and as evidence of practical viability, reporting the number of samples and variance across the five executions would be useful.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack pipeline computes perturbations from model gradients and evaluates evasion on re-executed samples, with no fitted quantity masquerading as a prediction.

full rationale

Tarallo's derivation chain is not circular. PS-FGSM selects injection positions and API-call types from the inverse Jacobian of the oracle (Algorithm 1 and Section 4.1), and the feature-space effectiveness is then measured on API call sequences that are actually submitted to the target model. The problem-space attack is evaluated by re-executing modified malware and checking whether the resulting recorded sequence evades the detector (Section 5.2, Table 2); this success criterion is the attack's operational goal, not an input used to construct the perturbation. The black-box experiments use a surrogate oracle (Li et al. [25]) and a different target model (Zhang et al. [54]), so the target labels are not used in the optimization. Hand-picked constants such as c=4 and the number of executions b are algorithm choices, not parameters fit to the dependent variable. The reported 89% functionality preservation is an empirical measurement with an acknowledged nondeterminism caveat; it does not reduce to a fitted prediction, and the paper explicitly reports it as a lower bound rather than using it to define success. Citations to the authors' own prior work appear only for datasets, tools, and related analyses, and none of these citations supplies the central effectiveness result. No equation in the paper is equivalent to its own output by construction, and no self-cited theorem is invoked to force the chosen strategy. The skeptical concern about trace fidelity is a real external-validity limitation, but it is not an instance of circular reasoning under the criteria used here.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central claim rests on standard gradient-based optimization, the domain assumption that API call traces are the discriminative signal, and several hand-picked algorithm parameters (c=4, b=5) plus evaluation thresholds. No new physical or conceptual entities are introduced; PS-FGSM, LKB, and BCO are algorithms, not entities.

free parameters (3)
  • norm-switch period c = 4
    Algorithm 1 alternates between L1 norm and L-1 norm for position selection every c iterations, with c set to 4 'in our experiments' (Section 4.1). The attack efficiency depends on this hand-picked period.
  • number of executions b = 5
    LKB and BCO collect behaviors from b executions; experiments run each sample 5 times (Section 5.2). The robustness claims about nondeterminism depend on this choice.
  • black-box thresholds = FP rate 0.100 to 0.325
    Section 5.3 tests the Zhang et al. detector at thresholds yielding TPR 0.958-0.992 instead of the originally recommended FPR 0.1%, and effectiveness varies across these choices.
assumptions (5)
  • standard math Gradient-based optimization using the sign of the inverse Jacobian is valid for discrete sequences when API calls are embedded.
    Algorithm 1 computes gradients from output to input through the embedding layer; this is standard backpropagation.
  • domain assumption The target detector classifies solely from the API call sequence (and optionally call arguments) recorded by Cuckoo.
    Section 3 threat model states the only assumption is that the target model employs API call sequences as features; Sections 5.2 and 5.3 evaluate by re-execution.
  • domain assumption The attacker may only insert API calls, never delete or modify existing ones.
    Section 3: 'An attacker can only add extra API calls to the original sequence; in fact, deleting or modifying existing ones would compromise its original functionality.'
  • ad hoc to paper The position with the greatest smallest (or greatest absolute) Jacobian norm is the most impactful injection position.
    Section 4.1: 'We have empirically verified that this works generally better...' No formal justification is given.
  • ad hoc to paper LKB and BCO strategies maximize evasion probability under nondeterminism.
    Section 4.1 'Dealing with nondeterminism': these strategies are based on the intuition that lower confidence in the malicious class increases success; no proof is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Tarallo: Evading Behavioral Malware Detectors in the Problem Space." pith.science (2026). https://pith.science/paper/QJ6F2PAI

@misc{pith2026250602660,
  author       = {Pith},
  title        = {Pith review of: Tarallo: Evading Behavioral Malware Detectors in the Problem Space},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QJ6F2PAI}},
  note         = {Machine review of arXiv:2506.02660}
}
read the original abstract

Machine learning algorithms can effectively classify malware through dynamic behavior but are susceptible to adversarial attacks. Existing attacks, however, often fail to find an effective solution in both the feature and problem spaces. This issue arises from not addressing the intrinsic nondeterministic nature of malware, namely executing the same sample multiple times may yield significantly different behaviors. Hence, the perturbations computed for a specific behavior may be ineffective for others observed in subsequent executions. In this paper, we show how an attacker can augment their chance of success by leveraging a new and more efficient feature space algorithm for sequential data, which we have named PS-FGSM, and by adopting two problem space strategies specially tailored to address nondeterminism in the problem space. We implement our novel algorithm and attack strategies in Tarallo, an end-to-end adversarial framework that significantly outperforms previous works in both white and black-box scenarios. Our preliminary analysis in a sandboxed environment and against two RNN-based malware detectors, shows that Tarallo achieves a success rate up to 99% on both feature and problem space attacks while significantly minimizing the number of modifications required for misclassification.

Figures

Figures reproduced from arXiv: 2506.02660 by the authors.

Figure 1
Figure 1. The workflow of the Tarallo framework. features. The algorithm relies on an oracle with known architecture and param￾eters. It can either work in a white-box mode, in which the oracle is the target model, or in a full black-box manner. As a variation of the Fast Gradient Sign Method [33,18], the algorithm we present in this work relies on the sign of the inverse Jacobian of the model’s output with respect to its inp… view at source ↗
Figure 2
Figure 2. Box plot of the overhead distribution for the feature-level attack against Li et al. [25], using both the proposed PS-FGSM and Rosenberg et al. [43]. comprising 5474 PE files. Of these, 4917 are 32-bit PEs, and 557 are x86-64 PE files. Finally, Dataset n.290 from VirusShare is used, consisting of 7651 PE files. Among these, 7636 are 32-bit and 15 are 64-bit, all collected in May 2017. Functionality Preservation (RQ1… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

54 extracted references · 44 canonical work pages

  1. [25]

    Computers & Security116, 102686 (2022)

    Li, C., Lv, Q., Li, N., Wang, Y., Sun, D., Qiao, Y.: A novel deep framework for dynamic malware detection based on api sequence intrinsic features. Computers & Security116, 102686 (2022)

    work page 2022

  2. [54]

    In: Proceedings of the AAAI conference on artificial intelli- gence

    Zhang, Z., Qi, P., Wang, W.: Dynamic malware analysis with feature engineering and feature learning. In: Proceedings of the AAAI conference on artificial intelli- gence. vol. 34, pp. 1210–1217 (2020)

    work page 2020

  3. [43]

    In: Research in Attacks, Intrusions, and Defenses: 21st International Symposium, RAID 2018, Heraklion, Crete, Greece, September 10-12, 2018, Proceedings 21

    Rosenberg, I., Shabtai, A., Rokach, L., Elovici, Y.: Generic black-box end-to-end attack against state of the art api call based malware classifiers. In: Research in Attacks, Intrusions, and Defenses: 21st International Symposium, RAID 2018, Heraklion, Crete, Greece, September 10-12, 2018, Proceedings 21. pp. 490–510. Springer (2018)

    work page 2018

  4. [1]

    Cuckoo (2024), https://github.com/cuckoosandbox/cuckoo

    work page 2024

  5. [2]

    ACM Comput

    Afianian, A., Niksefat, S., Sadeghiyan, B., Baptiste, D.: Malware dynamic anal- ysis evasion techniques: A survey. ACM Comput. Surv.52(6) (nov 2019). https://doi.org/10.1145/3365001, https://doi.org/10.1145/3365001

    doi:10.1145/3365001 2019

  6. [3]

    In: 2018 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

    Agrawal, R., Stokes, J.W., Marinescu, M., Selvaraj, K.: Neural sequential malware detection with parameters. In: 2018 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp. 2656–2660. IEEE (2018)

    work page 2018

  7. [4]

    arXiv preprint arXiv:1804.04637 (2018)

    Anderson, H.S., Roth, P.: Ember: an open dataset for training static pe malware machine learning models. arXiv preprint arXiv:1804.04637 (2018)

    arXiv 2018

  8. [5]

    In: Ndss

    Arp, D., Spreitzenbarth, M., Hubner, M., Gascon, H., Rieck, K., Siemens, C.: Drebin: Effective and explainable detection of android malware in your pocket. In: Ndss. vol. 14, pp. 23–26 (2014)

    work page 2014

Show all 54 references
  1. [6]

    Information10(4), 122 (2019) Tarallo: Evading Behavioral Malware Detectors in the Problem Space 19

    Berman, D.S., Buczak, A.L., Chavis, J.S., Corbett, C.L.: A survey of deep learning methods for cyber security. Information10(4), 122 (2019) Tarallo: Evading Behavioral Malware Detectors in the Problem Space 19

    2019

  2. [7]

    PeerJ Computer Science 6, e285 (2020)

    Catak, F.O., Yazı, A.F., Elezaj, O., Ahmed, J.: Deep learning based sequential model for malware analysis using windows exe api calls. PeerJ Computer Science 6, e285 (2020)

    2020

  3. [8]

    In: 2010 IEEE Symposium on Security and Privacy

    Comparetti, P.M., Salvaneschi, G., Kirda, E., Kolbitsch, C., Kruegel, C., Zanero, S.: Identifying dormant functionality in malware programs. In: 2010 IEEE Symposium on Security and Privacy. pp. 61–76. IEEE (2010)

    2010

  4. [9]

    IEEE signal processing mag- azine35(1), 53–65 (2018)

    Creswell, A., White, T., Dumoulin, V., Arulkumaran, K., Sengupta, B., Bharath, A.A.: Generative adversarial networks: An overview. IEEE signal processing mag- azine35(1), 53–65 (2018)

    2018

  5. [10]

    In: Proceedings of the 16th ACM Workshop on Artificial Intelli- gence and Security

    D’Onghia, M., Di Cesare, F., Gallo, L., Carminati, M., Polino, M., Zanero, S.: Lookin’out my backdoor! investigating backdooring attacks against dl-driven mal- ware detectors. In: Proceedings of the 16th ACM Workshop on Artificial Intelli- gence and Security. pp. 209–220 (2023)

    2023

  6. [11]

    Computers & Security119, 102775 (2022)

    D’Onghia, M., Salvadore, M., Nespoli, B.M., Carminati, M., Polino, M., Zanero, S.: Ap ´ ıcula: Static detection of api calls in generic streams of bytes. Computers & Security119, 102775 (2022)

    2022

  7. [12]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Xiao, C., Prakash, A., Kohno, T., Song, D.: Robust physical-world attacks on deep learning visual clas- sification. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 1625–1634 (2018)

    2018

  8. [13]

    In: Information Se- curity and Privacy: 22nd Australasian Conference, ACISP 2017, Auckland, New Zealand, July 3–5, 2017, Proceedings, Part II 22

    Fang, Y., Yu, B., Tang, Y., Liu, L., Lu, Z., Wang, Y., Yang, Q.: A new malware classification approach based on malware dynamic analysis. In: Information Se- curity and Privacy: 22nd Australasian Conference, ACISP 2017, Auckland, New Zealand, July 3–5, 2017, Proceedings, Part ...

    2017

  9. [14]

    Forensics, C.: Virusshare (2023), http://virusshare.com/

    2023

  10. [15]

    (ed.): SIMD (Single Instruction Multiple Data Processing), pp

    Furht, B. (ed.): SIMD (Single Instruction Multiple Data Processing), pp. 817–819. Springer US, Boston, MA (2008). https://doi.org/10.1007/978−0−387−78414− 4220,https://doi.org/10.1007/978−0−387−78414−4 220

    2008 doi

  11. [16]

    Computers & Security113, 102550 (2022)

    Galloro, N., Polino, M., Carminati, M., Continella, A., Zanero, S.: A systematical and longitudinal study of evasive behaviors in windows malware. Computers & Security113, 102550 (2022)

    2022

  12. [17]

    In: Recent Advances in Intrusion Detection: 9th International Symposium, RAID 2006 Hamburg, Germany, September 20-22, 2006 Proceedings 9

    Giffin, J.T., Jha, S., Miller, B.P.: Automated discovery of mimicry attacks. In: Recent Advances in Intrusion Detection: 9th International Symposium, RAID 2006 Hamburg, Germany, September 20-22, 2006 Proceedings 9. pp. 41–60. Springer (2006)

    2006

  13. [18]

    arXiv preprint arXiv:1412.6572 (2014)

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

    2014 arXiv

  14. [19]

    In: Cyber Security Cryptography and Machine Learning: 5th International Sympo- sium, CSCML 2021, Be’er Sheva, Israel, July 8–9, 2021, Proceedings 5

    Hariom, Handa, A., Kumar, N., Kumar Shukla, S.: Adversaries strike hard: Ad- versarial attacks against malware classifiers using dynamic api calls as features. In: Cyber Security Cryptography and Machine Learning: 5th International Sympo- sium, CSCML 2021, Be’er Sheva, Israel,...

    2021

  15. [20]

    In: 2017 IEEE Symposium Series on Computational Intelligence (SSCI)

    Hassen, M., Carvalho, M.M., Chan, P.K.: Malware classification using static analy- sis based features. In: 2017 IEEE Symposium Series on Computational Intelligence (SSCI). pp. 1–7. IEEE (2017)

    2017

  16. [21]

    arXiv preprint arXiv:1705.08131 (2017)

    Hu, W., Tan, Y.: Black-box attacks against rnn based malware detection algo- rithms. arXiv preprint arXiv:1705.08131 (2017)

    2017 arXiv

  17. [22]

    In: Data Mining and Big Data: 7th International Conference, DMBD 2022, Beijing, China, November 21–24, 2022, Proceedings, Part II

    Hu, W., Tan, Y.: Generating adversarial malware examples for black-box attacks based on gan. In: Data Mining and Big Data: 7th International Conference, DMBD 2022, Beijing, China, November 21–24, 2022, Proceedings, Part II. pp. 409–423. Springer (2023) 20 Digregorio et al

    2023

  18. [23]

    In: 2018 26th European signal processing conference (EUSIPCO)

    Kolosnjaji, B., Demontis, A., Biggio, B., Maiorca, D., Giacinto, G., Eckert, C., Roli, F.: Adversarial malware binaries: Evading deep learning for malware detection in executables. In: 2018 26th European signal processing conference (EUSIPCO). pp. 533–537. IEEE (2018)

    2018

  19. [24]

    arXiv preprint arXiv:1802.04528 (2018)

    Kreuk, F., Barak, A., Aviv-Reuven, S., Baruch, M., Pinkas, B., Keshet, J.: Deceiv- ing end-to-end deep learning malware detectors using adversarial examples. arXiv preprint arXiv:1802.04528 (2018)

    2018 arXiv

  20. [26]

    In: Proceedings of the Twenty-Third ACM Symposium on Operating Systems Principles

    Liu, T., Curtsinger, C., Berger, E.D.: Dthreads: efficient deterministic multithread- ing. In: Proceedings of the Twenty-Third ACM Symposium on Operating Systems Principles. pp. 327–336 (2011)

    2011

  21. [27]

    In: Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security

    Lucas, K., Sharif, M., Bauer, L., Reiter, M.K., Shintre, S.: Malware makeover: Breaking ml-based static analysis by modifying executable bytes. In: Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security. pp. 744–758 (2021)

    2021

  22. [28]

    ACM Computing Surveys (CSUR)55(1), 1–38 (2021)

    Machado, G.R., Silva, E., Goldschmidt, R.R.: Adversarial machine learning in im- age classification: A survey toward the defender’s perspective. ACM Computing Surveys (CSUR)55(1), 1–38 (2021)

    2021

  23. [29]

    Microsoft: Programming reference for the win32 api (2024), https://learn.microsoft.com/en-us/windows/win32/api/

    2024

  24. [30]

    Journal of Computer Virology and Hacking Techniques13, 193–207 (2017)

    Ming, J., Xin, Z., Lan, P., Wu, D., Liu, P., Mao, B.: Impeding behavior-based malware analysis via replacement attacks to malware specifications. Journal of Computer Virology and Hacking Techniques13, 193–207 (2017)

    2017

  25. [31]

    In: Twenty-third annual computer security applications conference (ACSAC 2007)

    Moser, A., Kruegel, C., Kirda, E.: Limits of static analysis for malware detection. In: Twenty-third annual computer security applications conference (ACSAC 2007). pp. 421–430. IEEE (2007)

    2007

  26. [32]

    ACM Computing Surveys (CSUR)52(5), 1–48 (2019)

    Or-Meir, O., Nissim, N., Elovici, Y., Rokach, L.: Dynamic malware analysis in the modern era—a state of the art survey. ACM Computing Surveys (CSUR)52(5), 1–48 (2019)

    2019

  27. [33]

    In: MILCOM 2016-2016 IEEE Military Communications Conference

    Papernot, N., McDaniel, P., Swami, A., Harang, R.: Crafting adversarial input sequences for recurrent neural networks. In: MILCOM 2016-2016 IEEE Military Communications Conference. pp. 49–54. IEEE (2016)

    2016

  28. [34]

    In: Detection of Intrusions and Malware, and Vulner- ability Assessment: 13th International Conference, DIMV A 2016, San Sebasti´ an, Spain, July 7-8, 2016, Proceedings 13

    Pawlowski, A., Contag, M., Holz, T.: Probfuscation: an obfuscation approach using probabilistic control flows. In: Detection of Intrusions and Malware, and Vulner- ability Assessment: 13th International Conference, DIMV A 2016, San Sebasti´ an, Spain, July 7-8, 2016, Proceedin...

    2016

  29. [35]

    In: 2020 IEEE symposium on security and privacy (SP)

    Pierazzi, F., Pendlebury, F., Cortellazzi, J., Cavallaro, L.: Intriguing properties of adversarial ml attacks in the problem space. In: 2020 IEEE symposium on security and privacy (SP). pp. 1332–1349. IEEE (2020)

    2020

  30. [36]

    In: Detection of Intrusions and Malware, and Vulnerability Assessment: 14th Interna- tional Conference, DIMV A 2017, Bonn, Germany, July 6-7, 2017, Proceedings 14

    Polino, M., Continella, A., Mariani, S., D’Alessio, S., Fontana, L., Gritti, F., Zanero, S.: Measuring and defeating anti-instrumentation-equipped malware. In: Detection of Intrusions and Malware, and Vulnerability Assessment: 14th Interna- tional Conference, DIMV A 2017, Bonn...

    2017

  31. [37]

    In: Detection of Intrusions and Malware, and Vulnerability Assessment: 12th International Conference, DIMV A 2015, Milan, Italy, July 9-10, 2015, Proceedings 12

    Polino, M., Scorti, A., Maggi, F., Zanero, S.: Jackdaw: Towards automatic reverse engineering of large datasets of binaries. In: Detection of Intrusions and Malware, and Vulnerability Assessment: 12th International Conference, DIMV A 2015, Milan, Italy, July 9-10, 2015, Procee...

    2015

  32. [38]

    In: Workshops at the thirty-second AAAI conference on artificial intelligence (2018)

    Raff, E., Barker, J., Sylvester, J., Brandon, R., Catanzaro, B., Nicholas, C.K.: Malware detection by eating a whole exe. In: Workshops at the thirty-second AAAI conference on artificial intelligence (2018)

    2018

  33. [39]

    Journal of computer security19(4), 639–668 (2011)

    Rieck, K., Trinius, P., Willems, C., Holz, T.: Automatic analysis of malware be- havior using machine learning. Journal of computer security19(4), 639–668 (2011)

    2011

  34. [40]

    Rosenberg, I., Meir, S.: Bypassing ngav for fun and pro t (2020)

    2020

  35. [41]

    In: 2020 international joint conference on neural networks (IJCNN)

    Rosenberg, I., Meir, S., Berrebi, J., Gordon, I., Sicard, G., David, E.O.: Generating end-to-end adversarial examples for malware classifiers using explainability. In: 2020 international joint conference on neural networks (IJCNN). pp. 1–10. IEEE (2020)

    2020

  36. [42]

    In: Annual Computer Security Appli- cations Conference

    Rosenberg, I., Shabtai, A., Elovici, Y., Rokach, L.: Query-efficient black-box attack against sequence-based malware classifiers. In: Annual Computer Security Appli- cations Conference. pp. 611–626 (2020)

    2020

  37. [44]

    In: 9th USENIX security symposium (USENIX security 00) (2000)

    Somayaji, A., Forrest, S.: Automated response using{System-Call}delay. In: 9th USENIX security symposium (USENIX security 00) (2000)

    2000

  38. [45]

    In: 2019 IEEE Security and Privacy Workshops (SPW)

    Suciu, O., Coull, S.E., Johns, J.: Exploring adversarial examples in malware de- tection. In: 2019 IEEE Security and Privacy Workshops (SPW). IEEE (2019)

    2019

  39. [46]

    In: Proceedings 2002 IEEE Symposium on Security and Privacy

    Tan, K., Maxion, R.: ”why 6?” defining the operational limits of stide, an anomaly- based intrusion detector. In: Proceedings 2002 IEEE Symposium on Security and Privacy. pp. 188–201 (2002). https://doi.org/10.1109/SECPRI.2002.1004371

    2002 arXiv

  40. [47]

    In: 2010 5th international conference on malicious and unwanted software

    Tian, R., Islam, R., Batten, L., Versteeg, S.: Differentiating malware from clean- ware using behavioural analysis. In: 2010 5th international conference on malicious and unwanted software. pp. 23–30. Ieee (2010)

    2010

  41. [48]

    Computers & Security81, 123–147 (2019)

    Ucci, D., Aniello, L., Baldoni, R.: Survey of machine learning techniques for mal- ware analysis. Computers & Security81, 123–147 (2019)

    2019

  42. [49]

    In: 2014 International conference on advances in computing, communications and informatics (ICACCI)

    Uppal, D., Sinha, R., Mehra, V., Jain, V.: Malware detection and classification based on extraction of api sequences. In: 2014 International conference on advances in computing, communications and informatics (ICACCI). IEEE (2014)

    2014

  43. [50]

    In: Proceedings 2001 IEEE Symposium on Security and Privacy

    Wagner, D., Dean, R.: Intrusion detection via static analysis. In: Proceedings 2001 IEEE Symposium on Security and Privacy. S&P 2001. pp. 156–168. IEEE (2000)

    2000

  44. [51]

    In: Proceedings of the 9th ACM Conference on Computer and Communications Security

    Wagner, D., Soto, P.: Mimicry attacks on host-based intrusion detection systems. In: Proceedings of the 9th ACM Conference on Computer and Communications Security. pp. 255–264 (2002)

    2002

  45. [52]

    In: Proceedings of the 1999 IEEE symposium on security and privacy (Cat

    Warrender, C., Forrest, S., Pearlmutter, B.: Detecting intrusions using system calls: Alternative data models. In: Proceedings of the 1999 IEEE symposium on security and privacy (Cat. No. 99CB36344). pp. 133–145. IEEE (1999)

    1999

  46. [53]

    In: 2010 In- ternational Conference on Broadband, Wireless Computing, Communication and Applications

    You, I., Yim, K.: Malware obfuscation techniques: A brief survey. In: 2010 In- ternational Conference on Broadband, Wireless Computing, Communication and Applications. pp. 297–300 (2010). https://doi.org/10.1109/BWCCA.2010.85

    2010 doi

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.