Demystifying the Role of Rule-based Detection in AI Systems for Windows Malware Detection
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2025
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866909735790313472 |
|---|---|
| author | Ponte, Andrea Demetrio, Luca Oneto, Luca Ogbu, Ivan Tesfai Biggio, Battista Roli, Fabio |
| author_facet | Ponte, Andrea Demetrio, Luca Oneto, Luca Ogbu, Ivan Tesfai Biggio, Battista Roli, Fabio |
| contents | Malware detection increasingly relies on AI systems that integrate signature-based detection with machine learning. However, these components are typically developed and combined in isolation, missing opportunities to reduce data complexity and strengthen defenses against adversarial EXEmples, carefully crafted programs designed to evade detection. Hence, in this work we investigate the influence that signature-based detection exerts on model training, when they are included inside the training pipeline. Specifically, we compare models trained on a comprehensive dataset with an AI system whose machine learning component is trained solely on samples not already flagged by signatures. Our results demonstrate improved robustness to both adversarial EXEmples and temporal data drift, although this comes at the cost of a fixed lower bound on false positives, driven by suboptimal rule selection. We conclude by discussing these limitations and outlining how future research could extend AI-based malware detection to include dynamic analysis, thereby further enhancing system resilience. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2508_09652 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Demystifying the Role of Rule-based Detection in AI Systems for Windows Malware Detection Ponte, Andrea Demetrio, Luca Oneto, Luca Ogbu, Ivan Tesfai Biggio, Battista Roli, Fabio Cryptography and Security Artificial Intelligence Malware detection increasingly relies on AI systems that integrate signature-based detection with machine learning. However, these components are typically developed and combined in isolation, missing opportunities to reduce data complexity and strengthen defenses against adversarial EXEmples, carefully crafted programs designed to evade detection. Hence, in this work we investigate the influence that signature-based detection exerts on model training, when they are included inside the training pipeline. Specifically, we compare models trained on a comprehensive dataset with an AI system whose machine learning component is trained solely on samples not already flagged by signatures. Our results demonstrate improved robustness to both adversarial EXEmples and temporal data drift, although this comes at the cost of a fixed lower bound on false positives, driven by suboptimal rule selection. We conclude by discussing these limitations and outlining how future research could extend AI-based malware detection to include dynamic analysis, thereby further enhancing system resilience. |
| title | Demystifying the Role of Rule-based Detection in AI Systems for Windows Malware Detection |
| topic | Cryptography and Security Artificial Intelligence |
| url | https://arxiv.org/abs/2508.09652 |