Breaking Windows Malware Detection: A Comprehensive Evaluation of Problem-Space Adversarial Robustness

A large-scale evaluation tested 8 Windows malware detectors (7 open-source, 1 commercial) with 9 problem-space evasion attacks while maintaining executability. Vulnerability depends strongly on both model representation and attack type: raw-byte detectors are especially susceptible to multiple types of manipulation, but no detector family is robust to all attacks; two complementary attacks can cover about 99% of the adversarial examples of the remaining attacks. Adversarial hardening is highly dependent on attack and model, and improvements often do not transfer across attacks.