PaperlayerView exact revision on arXiv

Source-linked AI summary

Phantomware: a Data Augmentation Framework for the Detection of Emerging Malware Campaigns

Antonino Rullo

arXiv:2610.20427v1cs.CR

TL;DR

Small malware families provide few samples for detecting evolving variants, while existing latent-generation methods offer limited control and have not been demonstrated in handful-sample campaigns. Phantomware generates geometry-guided synthetic malware representations, and the paper reports improved generalization to unseen samples.

  • Problem

    Small malware families provide few samples for learning discriminative features, and existing latent-generation approaches have limited location control and unproven effectiveness with only a handful of samples.

    Source: §1 · pp. 1–2

  • Method

    Phantomware synthesizes malware-like latent representations by perturbing representative benign embeddings along malware-discriminative directions for detector finetuning.

    Source: §1 · p. 2

  • Results

    Phantomware generates diverse, representative synthetic malware embeddings that help finetuned detectors generalize to unseen malware samples.

    Source: §5.6 · p. 19

  • Takeaways & Limitations

    Representative augmentation data can be generated even in highly data-scarce scenarios using available goodware and limited malware instances.

    Source: §2.3 · p. 6

    Adversarial generation cannot guarantee a successful evasion sample within finite iterations, and its synthetic set's size and diversity are difficult to control.

    Source: §3 · p. 7

Abstract

from arXiv · show

Detecting unseen malware variants remains a major challenge as malware families continuously evolve. This issue is exacerbated in data-scarce scenarios such as emerging malware campaigns, where only a few samples are available to train robust detectors. A common strategy is to proactively generate malware variants and use them as augmentation data to expose models to a broader range of potential threats. Existing approaches that generate functional malware variants through adversarial manipulation suffer from several important limitations. Generated samples must remain executable and preserve their malicious behavior, requiring costly validation through execution and analysis. Moreover, the adversarial objective provides limited control over the resulting augmentation dataset: it cannot guarantee the generation of sufficiently diverse variants, or even a single successful sample, making the effectiveness of the augmentation process inherently unpredictable. Finally, these approaches typically rely on a well-trained detector to guide generation, an assumption that may not hold in data-scarce scenarios such as early-stage malware campaigns. We formally and empirically demonstrate these limitations and propose Phantomware, a data augmentation framework designed for extreme data scarce scenarios. Phantomware operates entirely in the representation space of a pretrained malware detector, avoiding the costly generation and validation of functional binaries. By exploiting latent-space geometry, it generates synthetic malware representations of a target family in a controlled manner, providing a constructive guarantee on the generation of diverse training samples. Extensive experiments on real malware families demonstrate that Phantomware improves detection of unseen variants and provides robustness against both real and adversarially generated malware samples.

1 Introduction

Evolving malware variants and data-scarce families make it difficult to train detectors for unseen threats. The introduction motivates Phantomware as a geometry-guided alternative to functional or adversarial malware generation, which can be costly and unpredictable.

1 Introduction

  • Adversarial malware generation has not been well studied as a defensive augmentation strategy and can require costly functional checks, fail to produce enough diverse samples, and assume a well-trained detector.Functional variants must remain executable and malicious, typically requiring sandbox validation.Source: §1 · p. 2
  • Existing latent-space generation offers no precise control over sample locations, often concentrates near decision boundaries, and has not been demonstrated with only a handful of malware samples.Prior approaches generally assume tens or hundreds of real samples.Source: §1 · p. 2
  • Phantomware generates malware-like latent representations by perturbing representative benign embeddings along malware-discriminative directions, then uses them to finetune a detector.The synthetic representations are not functional or semantically meaningful executable files.Source: §1 · p. 2
  • The paper formally and empirically assesses adversarial malware generation and finds it cannot guarantee sufficiently diverse, representative samples for improving detector robustness and generalization.Source: §1 · p. 3
  • Phantomware is designed to improve pretrained detector performance with minimal computational effort and malware data, and is evaluated on real families and adversarially generated samples.The authors also make the implementation publicly available.Source: §1 · p. 3

2 Related Work

The section surveys malware generation in problem and feature spaces, then discusses why existing approaches remain constrained for data-scarce, robust detection. It positions Phantomware as an embedding-based augmentation framework using goodware and limited malware samples.

2.1 Problem-space approaches

  • Problem-space methods modify source, assembly, or binary artifacts, but intermediate representations must be mapped back to executables while preserving malware functionality.Approaches may be adversarial or non-adversarial depending on whether they explicitly seek evasion.Source: §2.1 · p. 3

2.1.1 Non-adversarial methods

  • Non-adversarial methods include LLM-assisted source transformations [1] and assembly-level API insertion or equivalent system-call dependency graphs.Source: §2.1.1 · p. 3

2.1.2 Adversarial methods

  • Adversarial methods include GAN-based black-box evasion, JSMA, reinforcement learning, and CFG or gradient-based changes [31].Some GAN approaches train a surrogate discriminator from detector labels; JSMA uses the model Jacobian to select input features for modification.Source: §2.1.2 · p. 4
  • Other adversarial methods mutate code or features through insertions, padding, NOPs, API calls, or explainability- and counterfactual-guided changes [14] [17].Evaluations using the same attack strategies for training and testing leave generalization to unseen attacks unclear; effectiveness and transferability vary across models and datasets [20] [56].Source: §2.1.2 · p. 4

2.2 Feature-space approaches

  • Feature-space approaches train on synthetic malware embeddings rather than functional executables, with prior work using GANs, CycleGANs, diffusion, and latent models.Other methods apply image transformations [8] or derive embeddings from adversarial examples, which still require malware-space generation and thousands of original samples.Source: §2.2 · p. 5

2.3 Discussion

  • Existing approaches face discrete-feature and functionality-preservation constraints, diversity limits, detector dependence, and difficulty representing semantic shifts beyond obfuscation.The discussion also notes that evaluations often focus on evasion rather than whether detectors gain robustness or generalization.Source: §2.3 · pp. 5–6
  • Feature-space methods avoid costly malware-space validation, but adversarial embeddings cluster near decision boundaries and existing approaches still depend on ample representative malware.In data-scarce settings, both problem-space and embedding-based approaches struggle to generate diverse, representative training data.Source: §2.3 · p. 6
  • Phantomware generates synthetic malware representations from goodware samples and limited malware instances to support augmentation in data-scarce scenarios.The discussion contrasts this approach with existing methods that depend on sufficient real malware samples.Source: §2.3 · p. 6

3 A Formal Proof of the Limitations of Problem-space Adversarial Generation Approaches

Problem-space adversarial generation requires a functionality-preserving variant that evades the detector, but neither such a variant’s existence nor an algorithm’s ability to find one within a finite budget is guaranteed.

3 A Formal Proof of the Limitations of Problem-space Adversarial Generation Approaches

  • A functionality-preserving evasion may not exist: the detector can classify every admissible variant as malware, leaving the feasible evasion set empty.Because the perturbation space is discrete and constrained by preserving malicious functionality, no algorithm can produce a successful evasion when the feasible set is empty.Source: §3 · pp. 6–7
  • Even when an evading variant exists, its discovery time can be arbitrarily large, so no finite iteration bound guarantees success for every malware–detector–attack combination.The first successful iteration is infinite when no feasible evasion exists and may be arbitrarily large otherwise.Source: §3 · p. 7
  • Adversarial augmentation can produce zero samples for some malware instances and multiple for others, making the synthetic dataset’s size and diversity difficult to control.This uncertainty is exacerbated when available real malware samples are few and lack diversity.Source: §3 · p. 7

4 The Phantomware Data Augmentation Pipeline

Phantomware generates synthetic malware embeddings in a pretrained detector’s latent space, using benign anchors and malware-discriminative directions, then finetunes the detector’s classifier head. Its design targets data-scarce families and avoids generating and validating functional binaries.

4 The Phantomware Data Augmentation Pipeline

  • Phantomware operates in a pretrained detector’s representation space, avoiding binary manipulation, execution, and validation while requiring as few as one malware sample.It leverages goodware diversity and is described as model-independent across machine-learning malware detectors.Source: §4 · p. 7

4.1 Problem formulation

  • The augmentation objective is to enrich a small target-family dataset with diverse synthetic representations that help classify its unseen variants, rather than merely increasing sample count.The approach generates latent vectors directly because these are the representations used by the detector for classification.Source: §4.1 · p. 7

4.2 Geometry-guided embedding generation

  • Synthetic embeddings move representative benign anchors along malware-discriminative directions, targeting benign-adjacent regions where challenging malware may be sparse.Unlike approaches that perturb scarce malware samples, Phantomware uses benign samples to characterize latent regions where future evasive malware may emerge.Source: §4.2 · p. 8

4.2.1 Goodware anchor selection

  • Boundary anchors lie near target-family malware, while frontier anchors occupy peripheral regions of the benign distribution; together they cover decision-interface and low-density areas.Boundary anchors are ranked by proximity to malware, and frontier anchors are selected from extreme projections along principal components.Source: §4.2.1 · pp. 8–9

4.2.2 Synthetic embedding generation

  • The malware-discriminative direction weights signed per-dimension centroid displacements between malware and goodware embeddings by normalized, sharpened importance scores favoring large class separation and low intra-class variability.Source: §4.2.2 · p. 9
  • The generation procedure guarantees synthetic embeddings by design and remains usable with a single malware sample, unlike adversarial generation, which cannot guarantee even one successful evasion.Generated samples populate the benign-manifold vicinity and regions beyond the decision boundary.Source: §4.2.2 · p. 10

4.3 Finetuning procedure

  • Finetuning freezes the pretrained feature extractor and updates only the classifier head using real binaries and synthetic malware embeddings labeled as malware.The synthetic-embedding loss increases the classifier’s malware probability for generated representations, encouraging the decision boundary away from benign regions.Source: §4.3 · p. 10

5 Experiments

The evaluation compares Phantomware with adversarial augmentation on real-world Windows PE malware and goodware, using the BODMAS dataset and a filtered set of malware families.

5 Experiments

  • Experiments use real-world Windows Portable Executable malware and goodware files, targeting the format commonly used by modern malware detection systems.The evaluation is restricted to Windows PE files.Source: §5 · p. 11

5.1 Dataset

  • BODMAS contains 57,293 PE malware samples across 582 families; retaining only families with at least 100 samples yields 57 families and 51,974 samples.The samples were collected from multiple sources between August 2019 and September 2020.Source: §5.1 · p. 11
  • The goodware pool comes from 86,812 legitimate Windows files, of which a random 50% is included to limit class imbalance.The source dataset includes files from Windows 7 and later.Source: §5.1 · p. 11

5.2 MalConv vs small malware families

With only five target-family training samples, MalConv’s detection of the ten most recent variants varied across families and missed 10.5% overall.

5.2 MalConv vs small malware families

  • Each emerging-campaign simulation trained MalConv with five target-family samples and tested on the ten most recent samples, rotating the target across all 57 families.Earlier target-family samples were excluded from training; training used 30 epochs and averaged approximately 44.5K malware samples across experiments.Source: §5.2 · p. 11
  • 10.5% of newly introduced variants were missed overall; MalConv detected all ten test variants for 34 of 57 target families (60%).For each of the other 23 families, it missed between one and nine of ten variants; these families were selected for the augmentation evaluation.Source: §5.2 · p. 11

5.3 Evaluation of Phantomware

MalConvP ha improves target-family detection over MalConv, while increasing false positives on goodware. The results also show that a compact set of diverse synthetic embeddings can suffice for augmentation.

5.3 Evaluation of Phantomware

  • Figure 2’s Vflooder projection shows synthetic embeddings spanning beyond original training samples toward malware test samples and frontier goodware.The visualization is a 2D t-SNE projection of embeddings in MalConv’s latent space.Source: Figure 2 · p. 12, §5.3 · p. 12
  • Finetuning uses 50 synthetic representations per target family, alongside 1,000 hard samples and 1,000 centroid representatives.The synthetic embeddings perturb goodware boundary and frontier anchors along malware-discriminative dimensions; embeddings are 128-dimensional.Source: §5.3 · pp. 11–12
  • 0.89 to 0.98 detection rate: MalConvP ha detects 558 of 570 target-family test samples, compared with 510 for MalConv, improving performance in 20 of 23 families.Figure 3 reports detection rates across the 10 test samples in each target family.Source: §5.3 · p. 12, Figure 3 · p. 13
  • 1%–8% FPR for MalConvP ha, versus MalConv’s consistently below 1%; MalConvP ha’s FNR is lower than its FPR, reversing MalConv’s order-of-magnitude gap.The authors attribute the higher goodware misclassification to shifting the decision boundary closer to benign regions.Source: §5.3 · pp. 12–13, Figure 4 · p. 13
  • 500 synthetic embeddings yield performance comparable to 50, suggesting diversity, rather than quantity, matters more for this augmentation.The authors report that increasing the number tenfold provided no additional benefit because the added embeddings were redundant.Source: §5.3 · p. 13
  • For Vflooder, λ values above 1 detect all target-family test samples; increasing λ also raises FPR and lowers FNR across the test set.The authors explain that higher λ emphasizes classifying synthetic embeddings as malware, shifting the boundary toward goodware.Source: §5.3 · p. 13, Figure 5 · p. 14

5.4 Evaluation of adversarial approaches

Across malware families, adversarial augmentation yields inconsistent results: its coverage and detection gains vary with the attack and family, and larger sample counts do not ensure better performance.

5.4 Evaluation of adversarial approaches

  • Across families, the 11 attack techniques produce between 2 and 155 adversarial samples per family, with highly variable counts.The standard setting produces one adversarial example per real malware sample; the evaluation applied attacks to five samples in each of 57 families, then focused comparisons on 23 families MalConv misclassified.Source: §5.4 · pp. 14–15, Figure 6 · p. 16
  • Only 3 of 11 attacks generate at least one adversarial sample for every real sample; combined attacks average 1.383 synthetic samples per real instance, and no attack covers every family.Even GAMMA_sectionShift misses Padodor.Source: §5.4 · p. 15, Table 1 · p. 16, Figure 6 · p. 16
  • For Mira and Vflooder, a few diverse adversarial samples can outperform larger, less diverse sets, while combining attacks adds volume without further detection gains.The finetuning procedure updates the classifier head using adversarial embeddings while keeping the feature extractor frozen.Source: §5.4 · pp. 15–17, Table 2 · p. 17
  • For Vflooder, some adversarial samples lie farther from the original malware embeddings, while numerous GAMMA_SectionShift samples cluster in a restricted latent-space region.The more dispersed attacks improve detection of previously missed instances; the restricted cluster adds limited information.Source: §5.4 · p. 17, Figure 7 · p. 17
  • GAMMA_sectionShift's effect varies by family: five examples enable detection of all Mira test samples, but 49 examples do not enable detection of all Vflooder test samples.The results support the authors' claim that effectiveness depends on the malware samples used to generate variants.Source: §5.4 · p. 17
  • Across 23 families, MalConvAdv performs comparably to MalConvPhantomware except for five families where Phantomware performs better.Those families are Urelas, Lunam, Fuerboos, Upatre, and Tofsee.Source: §5.4 · p. 18, Figure 8 · p. 18
  • On the complete test set, MalConvAdv's FNR is about one order of magnitude lower than pretrained MalConv's for most families, but FPR rises and average performance is slightly below Phantomware.MalConvAdv's FPR exceeds 10% for Gepys, Blocker, and Vobfus.Source: §5.4 · p. 18, Figure 9 · p. 18

5.5 Execution times

Phantomware's reported generation time is dominated by selecting goodware anchors, while adversarial generation takes substantially longer and excludes functional validation.

5.5 Execution times

  • Phantomware's synthetic embedding generation takes negligible time compared with anchor selection, so its cost primarily scales with the goodware training-set size.In the reported setting, anchor selection takes approximately six minutes.Source: §5.5 · p. 18
  • Individual adversarial attacks take 7.5 to 153 minutes, and the reported times exclude sandbox validation of whether variants preserve malicious functionality.The authors note that validation would further increase adversarial generation time.Source: §5.5 · pp. 18–19
  • Approximately 655 minutes are required to run all 11 adversarial attacks, versus about six minutes for Phantomware's anchor selection, with synthetic embedding generation negligible by comparison.The Phantomware cost is dominated by selecting anchors from a goodware training set of approximately 45K samples.Source: §5.5 · p. 18, Figure 10 · p. 19

5.6 Results discussion

The discussion emphasizes that augmentation quality depends on diversity and representativeness, and contrasts adversarial generation's unpredictable coverage with Phantomware's controlled embeddings for extreme data scarcity.

5.6 Results discussion

  • Augmentation effectiveness depends more on sample diversity and representativeness than quantity, but adversarial generation guarantees neither and remains unpredictable across attack–family combinations.In the experiments, achieving successful adversarial augmentation required 11 attack techniques, with no guarantee that any would succeed.Source: §5.6 · p. 19
  • Phantomware generates a diverse, representative set of synthetic malware embeddings with minimal computational effort, helping the detector reshape its decision boundary toward unexplored latent-space regions.The authors report improved generalization to unseen malware samples.Source: §5.6 · p. 19
  • The adversarial experiments use five real malware samples per family, while Phantomware is designed to generate augmentation data even when only one malware instance is available.Phantomware derives synthetic-embedding diversity primarily from the goodware distribution rather than the number of available malware samples.Source: §5.6 · p. 19

5.7 Transfer attacks against Phantomware

Against transfer attacks crafted using MalConv, Phantomware-trained MalConvPhantomware detects 96% of adversarial samples; the discussion contrasts broad latent-space coverage with approaches tied to specific evasion patterns.

5.7 Transfer attacks against Phantomware

  • Transfer attacks are adversarial samples optimized against one detector and evaluated against another, a setting relevant to black-box attacks.The passage notes that transfer is more likely when source and target detectors use similar models and datasets.Source: §5.7 · pp. 19–20
  • MalConvPhantomware detects 1,886 of 1,961 transfer-attack samples, a 96% detection rate.The samples were crafted using MalConv as the source detector and tested against MalConvPhantomware.Source: Figure 11 · p. 20, §5.7 · p. 20
  • EXE-scanner's evaluation uses the same attacks for training and testing, leaving its effectiveness against other attacks unclear; Li and Li's attack diversity does not explicitly maximize distribution coverage.The cited discussion distinguishes optimizing attack strength from explicitly maximizing synthetic malware size, diversity, or coverage.Source: §5.7 · p. 20
  • Adversarial training based on specific attack mechanisms may not generalize to different adversarial strategies or semantic evolutions of malware variants.The authors argue that small malware corpora also constrain the diversity of adversarial training sets.Source: §5.7 · p. 20
  • Phantomware instead enriches the latent malware distribution with diverse embeddings, which the authors associate with robustness against adversarial and non-adversarial variants.The paper reports high detection performance against the transfer attacks evaluated here.Source: §5.7 · pp. 20–21

5.8 Ablation study

The ablations find that combining boundary and frontier benign anchors improves target-family detection and lowers FNR, though with higher FPR. Target-family-specific perturbation directions also outperform unrelated-family directions in most tested cases.

5.8 Ablation study

  • The ablation tests whether geometry-aware benign-anchor selection and malware-discriminative perturbation direction contribute to Phantomware’s performance.Boundary anchors capture classification ambiguity, while frontier anchors cover unexplored latent-space regions.Source: §5.8 · p. 21
  • Combining boundary and frontier anchors achieved the lowest FNR and consistently improved target-family detection, but at the cost of a higher FPR.The comparison included random, boundary-only, frontier-only, and combined Phantomware anchor selection.Source: §5.8 · p. 21
  • 14 of 23 cases achieved higher detection rates with target-family-specific perturbation directions than with directions from unrelated malware families.The comparison used a randomly selected non-target family for each target family.Source: §5.8 · p. 22

6 Conclusions

The conclusion presents Phantomware as geometry-guided augmentation in a pretrained detector’s latent space, designed for unseen variants of small malware families. It reports controlled generation from few samples and improved robustness, and proposes Android malware as future work.

6 Conclusions

  • Phantomware operates in a pretrained detector’s latent space and guarantees controlled synthetic augmentation from only a handful of malware samples.The paper contrasts this with adversarial generation, which may require many real samples and cannot guarantee diverse or even one successful functional sample.Source: §6 · p. 22
  • Experiments indicate that augmentation diversity, rather than quantity, determines effectiveness, and latent-space samples are more effective downstream than problem-space approaches.The reported goal is robustness against unseen variants of small malware families.Source: §6 · p. 22
  • Future work will extend Phantomware to Android malware, where threats evolve rapidly and emerging families have limited samples.Source: §6 · p. 22

Related papers

Loading 2610.20427v1…