Hybrid scanner finds malicious AI agent skills with fewer false positives
The full pipeline detects 68 of 80 malicious skills and cuts false positives from 40 to five versus Cisco's LLM mode.
Stories per day · 30 days
2 RSS
Relatedadversarial-ml1adversarial-robustness1agent-skills1antivirus1arxiv1backdoor1benchmark1botnet-detection1bugfix1cisco-skill-scanner1clamav1clean-label1data-augmentation1dataset1elf1ember1evasion1gan1
25 stories, newest first · one card per story
Stories tagged #malware-detection
TrafficInstruct dataset and benchmark for instruction tuning on network traffic released
55,000 structured records support 10 detection tasks with task-specific LoRA adapters improving performance.
YARA-X 1.22.1 bugfix released alongside YARA 4.6.0
YARA 4.6.0 does not add the YARA-X 64-bit integer readers int64, int64be, uint64, and uint64be.
Mal-AAEGAN generates adversarial malware in a continuous latent space
It matches or beats three binary-space GAN baselines against eight detectors on two API-feature datasets.
Q-MALDetect study measures evasion of a quantum malware detector
The hybrid detector reached 97.2% training accuracy, but the strongest feature-space attack succeeded 78.7% of the time.
Paper proposes shielding antivirus signatures from black-box extraction
On a ClamAV prototype, Robust Embedding Matching raised probing queries by up to 282.57 times with under 0.1% added false positives.
Trigger Value Selection in Clean-Label Malware Backdoors: An Effectiveness-Detectability Analysis
Researchers show trigger-value choice changes success and detectability of clean-label backdoors in malware classifiers.
Phantomware: a Data Augmentation Framework for the Detection of Emerging Malware Campaigns
Phantomware augments scarce malware training data in latent space to detect unseen variants.
Power, Performance, and Area of HPC-Based Malware Detectors: An FPGA and Open-PDK ASIC Study
FPGA and ASIC study finds tree-based HPC malware detectors use far less area and energy than function-based models.
Pareto-optimal quantum kernel selection for unsupervised anomaly detection on real malware beaconing data
Pareto quantum-kernel selection on real malware beaconing slightly beats a classical one-class SVM baseline.
YARA-X 1.21.0 Release, (Sat, Oct 3rd)
YARA-X 1.21.0 adds five improvements and four bugfixes, including stdin support for --scan-list.
A Hybrid Approach to Malware Detection: Integrating Few-Shot Model-Agnostic Meta-Learning with Autoencoders
A hybrid autoencoder and MAML model detects ransomware from as few as one labeled sample.
A Structured State Space Sequence Model for Multi-Class Classification of Malware
Researchers apply a Structured State Space model to classify IoT malware from long-range execution dependencies.
Weaponizing Ground Truth: Data Poisoning Attacks by Exploiting Boundary Misalignment Between Antivirus Software and Learning-Based Detectors
Bi-Iocane poisons ML malware detectors by flipping antivirus labels with tiny byte edits.
RAMP: Reversing Adversarial Perturbations to Strengthen Clean-Label Backdoor Attacks against Malware Detectors
RAMP uses reversed adversarial perturbations to strengthen clean-label backdoors against malware detectors.
Weekly Update 522: Live From Oslo with Scott Helme
Troy Hunt and Scott Helme discuss detecting malware-infected machines via CSP reporting and a surge of malicious browser extensions found with a local LLM.
SAGEGAN: Style-Based Anomaly Detection with Gaussian Embeddings using Generative Adversarial Networks
SAGEGAN detects malware by reconstructing portable-executable images with GANs trained only on benign files.
HYDRA: Proactive Android Malware Drift Adaptation via Hierarchical Graph Contrastive Learning
HYDRA uses hierarchical Android app graphs and contrastive learning to adapt malware detectors to concept drift with far fewer labels.
Partition-Matched Evaluation of Community Features under Distribution Shift in Android Malware Function-Call Graphs
Study finds Android malware graph communities add little shift-stable signal beyond random partitions.
Residual Community Prototypes Under-Reject Held-Out Malware Families in FCG-MFD
Study finds Louvain community features fail to stably reject held-out malware families in FCG-based open-set recognition versus simple uncertainty.
Name2Pkg: Lightweight One-Class Android Malware Screening via Name-Package Correspondence Modeling
Name2Pkg flags Android malware from app-name and package-name mismatch, with ROC-AUC 0.982.
Temporal Generalization and Explanation Stability of Control Flow Graph Neural Networks for Malware Detection
Message-passing choice decides whether Windows malware-detection graph networks survive a later-year sample shift.
Delphi Scanner: efficient and interpretable static malware detection via API sequence modeling
Researchers introduce Delphi Scanner, a 1.53 MB CNN-based static malware detector for Windows PE files using API sequences, achieving 95.35% accuracy.
Windows Malware Detector as a Compound AI System: Trade-Offs in Accuracy, Efficiency, and Adversarial Robustness
Researchers model industrial Windows malware detection as a Compound AI System, quantifying trade-offs between detection accuracy, efficiency, and adversarial robustness under tiered attacker knowledge.