{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,2]],"date-time":"2026-10-02T10:26:42Z","timestamp":1790936802455,"version":"4.1.0"},"reference-count":143,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2021,11,23]],"date-time":"2021-11-23T00:00:00Z","timestamp":1637625600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key R&D Program of China","doi-asserted-by":"crossref","award":["2020YFB1805503"],"award-info":[{"award-number":["2020YFB1805503"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Jiangsu Province Modern Education Technology Research Project","award":["84365"],"award-info":[{"award-number":["84365"]}]},{"name":"National Vocational Education Teacher Enterprise Practice Base"},{"name":"\u201cIntegration of Industry and Education\u201d Special Project"},{"name":"NSF","award":["#2122631, (#1814825) and #2115134"],"award-info":[{"award-number":["#2122631, (#1814825) and #2115134"]}]},{"name":"ARO","award":["#W911NF-17-1-0566"],"award-info":[{"award-number":["#W911NF-17-1-0566"]}]},{"name":"Colorado State Bill","award":["18-086"],"award-info":[{"award-number":["18-086"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2023,1,31]]},"abstract":"<jats:p>Malicious software (malware) is a major cyber threat that has to be tackled with Machine Learning (ML) techniques because millions of new malware examples are injected into cyberspace on a daily basis. However, ML is vulnerable to attacks known as adversarial examples. In this article, we survey and systematize the field of Adversarial Malware Detection (AMD) through the lens of a unified conceptual framework of assumptions, attacks, defenses, and security properties. This not only leads us to map attacks and defenses to partial order structures, but also allows us to clearly describe the attack-defense arms race in the AMD context. We draw a number of insights, including: knowing the defender\u2019s feature set is critical to the success of transfer attacks; the effectiveness of practical evasion attacks largely depends on the attacker\u2019s freedom in conducting manipulations in the problem space; knowing the attacker\u2019s manipulation set is critical to the defender\u2019s success; and the effectiveness of adversarial training depends on the defender\u2019s capability in identifying the most powerful attack. We also discuss a number of future research directions.<\/jats:p>","DOI":"10.1145\/3484491","type":"journal-article","created":{"date-parts":[[2021,11,23]],"date-time":"2021-11-23T12:36:59Z","timestamp":1637671019000},"page":"1-35","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":37,"title":["Arms Race in Adversarial Malware Detection: A Survey"],"prefix":"10.1145","volume":"55","author":[{"given":"Deqiang","family":"Li","sequence":"first","affiliation":[{"name":"Nanjing University of Science and Technology, Nanjing, Jiangsu, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Qianmu","family":"Li","sequence":"additional","affiliation":[{"name":"Nanjing University of Science and Technology, Nanjing, Jiangsu, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yanfang (Fanny)","family":"Ye","sequence":"additional","affiliation":[{"name":"Case Western Reserve University, Notre Dame, IN, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shouhuai","family":"Xu","sequence":"additional","affiliation":[{"name":"University of Colorado Colorado Springs, Colorado Springs, Colorado, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2021,11,23]]},"reference":[{"key":"e_1_3_2_2_2","doi-asserted-by":"publisher","DOI":"10.5555\/1025118.1025582"},{"key":"e_1_3_2_3_2","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00020"},{"key":"e_1_3_2_4_2","article-title":"Yara","author":"Alvarez Victor M.","year":"2019","unstructured":"Victor M. Alvarez. 2019. Yara. (May 2019). Retrieved May 2, 2019 from http:\/\/virustotal.github.io\/yara\/.","journal-title":"(May 2019). Retrieved May 2, 2019 from http:\/\/virustotal.github.io\/yara\/."},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.1145\/2381896.2381900"},{"key":"e_1_3_2_6_2","unstructured":"Hyrum S. Anderson Anant Kharkar Bobby Filar David Evans and Phil Roth. 2018. Learning to evade static PE machine learning malware models via reinforcement learning. arXiv:1801.08917. Retrieved from https:\/\/arxiv.org\/abs\/1801.08917."},{"key":"e_1_3_2_7_2","unstructured":"Hyrum S. Anderson Anant Kharkar Bobby Filar and Phil Roth. 2017. Evading machine learning malware detection. Presented at Black Hat USA . Informa PLC 1\u20136."},{"key":"e_1_3_2_8_2","article-title":"Hide android applications in images","author":"Aprville Axelle","year":"2014","unstructured":"Axelle Aprville and Ange Albertini. 2014. Hide android applications in images. (October 2014). Retrieved October, 2014 from https:\/\/www.blackhat.com\/.","journal-title":"https:\/\/www.blackhat.com\/"},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23247"},{"key":"e_1_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-010-5188-5"},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1145\/1128817.1128824"},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241157"},{"key":"e_1_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.5555\/3157382.3157391"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2013.50"},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978422"},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-20248-8_15"},{"key":"e_1_3_2_17_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-02300-7_4"},{"key":"e_1_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.1007\/s13042-010-0007-7"},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2013.57"},{"key":"e_1_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.5555\/3042573.3042761"},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382284"},{"key":"e_1_3_2_23_2","doi-asserted-by":"publisher","DOI":"10.1023\/A:1010933404324"},{"key":"e_1_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_2_26_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23483"},{"key":"e_1_3_2_27_2","doi-asserted-by":"crossref","unstructured":"Anirban Chakraborty Manaar Alam Vishal Dey Anupam Chattopadhyay and Debdeep Mukhopadhyay. 2021. A survey on adversarial attacks and defences. CAAI Transactions on Intelligence Technology 6 1 (2021) 25\u201345.","DOI":"10.1049\/cit2.12028"},{"key":"e_1_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1145\/3134600.3134636"},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.5555\/3382225.3382395"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1109\/EISIC.2017.21"},{"key":"e_1_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.11.007"},{"key":"e_1_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2932228"},{"key":"e_1_3_2_33_2","doi-asserted-by":"publisher","DOI":"10.5555\/3489212.3489344"},{"key":"e_1_3_2_34_2","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/D14-1179"},{"key":"e_1_3_2_35_2","article-title":"CISIO reporter","year":"2018","unstructured":"CISCO. 2018. CISIO reporter. (December 2018). Retrieved December 2, 2018 from https:\/\/www.cisco.com.","journal-title":"(December 2018). Retrieved December 2, 2018 from https:\/\/www.cisco.com."},{"key":"e_1_3_2_36_2","doi-asserted-by":"publisher","DOI":"10.5555\/1953048.2078186"},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133978"},{"key":"e_1_3_2_38_2","volume-title":"Proceedings of the 3rd Italian Conference on Cyber Security","volume":"2315","author":"Demetrio Luca","year":"2019","unstructured":"Luca Demetrio, Battista Biggio, Giovanni Lagorio, Fabio Roli, and Alessandro Armando. 2019. Explaining vulnerabilities of deep learning to adversarial malware binaries. In Proceedings of the 3rd Italian Conference on Cyber Security. Vol. 2315. CEUR-WS.org."},{"key":"e_1_3_2_39_2","doi-asserted-by":"publisher","DOI":"10.1145\/3473039"},{"key":"e_1_3_2_40_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2017.2700270"},{"key":"e_1_3_2_41_2","doi-asserted-by":"publisher","DOI":"10.5555\/3361338.3361361"},{"key":"e_1_3_2_42_2","unstructured":"Dexguard. 2018. Dexguard @ONLINE. (December 2018). Retrieved December 2018 from https:\/\/www.guardsquare.com\/en\/products\/dexguard."},{"key":"e_1_3_2_43_2","doi-asserted-by":"publisher","DOI":"10.1109\/SOSE.2014.52"},{"key":"e_1_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2018.2833292"},{"key":"e_1_3_2_45_2","doi-asserted-by":"publisher","DOI":"10.1145\/2089125.2089126"},{"key":"e_1_3_2_46_2","doi-asserted-by":"publisher","DOI":"10.1145\/3219819.3219862"},{"key":"e_1_3_2_47_2","doi-asserted-by":"publisher","DOI":"10.5555\/3157096.3157279"},{"key":"e_1_3_2_48_2","article-title":"Kaspersky Security Bulletin Overall Statistics for 2016","author":"Garnaeva M.","year":"2016","unstructured":"M. Garnaeva, F. Sinitsyn, Y. Namestnikov, Denis Makrushin, and Alexander Liskin. 2016. Kaspersky Security Bulletin Overall Statistics for 2016. (December 2006). Retrieved December 2006 from https:\/\/media.kasperskycontenthub.com.","journal-title":"https:\/\/media.kasperskycontenthub.com"},{"key":"e_1_3_2_49_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Gilmer Justin","year":"2018","unstructured":"Justin Gilmer, Luke Metz, Fartash Faghri, Samuel S. Schoenholz, Maithra Raghu, Martin Wattenberg, and Ian Goodfellow. 2018. Adversarial spheres. In Proceedings of the 6th International Conference on Learning Representations. OpenReview.net."},{"key":"e_1_3_2_50_2","doi-asserted-by":"publisher","DOI":"10.5555\/3086952"},{"key":"e_1_3_2_51_2","doi-asserted-by":"publisher","DOI":"10.5555\/2969033.2969125"},{"key":"e_1_3_2_52_2","volume-title":"Proceedings of the 3rd International Conference on Learning Representations","author":"Goodfellow Ian J.","year":"2015","unstructured":"Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. In Proceedings of the 3rd International Conference on Learning Representations. OpenReview.net."},{"key":"e_1_3_2_53_2","unstructured":"Kathrin Grosse Praveen Manoharan Nicolas Papernot Michael Backes and Patrick McDaniel. 2017. On the (Statistical) Detection of Adversarial Examples. arXiv:1702.06280. Retrieved from https:\/\/arxiv.org\/abs\/1702.06280."},{"key":"e_1_3_2_54_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66399-9_4"},{"key":"e_1_3_2_55_2","doi-asserted-by":"publisher","DOI":"10.5555\/2946645.3007062"},{"key":"e_1_3_2_56_2","first-page":"61","volume-title":"Proceedings of the International Conference on Data Mining","author":"Hardy William","year":"2016","unstructured":"William Hardy, Lingwei Chen, Shifu Hou, Yanfang Ye, and Xin Li. 2016. DL4MD: A deep learning framework for intelligent malware detection. In Proceedings of the International Conference on Data Mining. 61."},{"key":"e_1_3_2_57_2","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098026"},{"key":"e_1_3_2_58_2","doi-asserted-by":"publisher","DOI":"10.5555\/3304652.3304750"},{"key":"e_1_3_2_59_2","unstructured":"Weiwei Hu and Ying Tan. 2017. Generating adversarial malware examples for black-box attacks based on GAN. arXiv:1702.05983. Retrieved from https:\/\/arxiv.org\/abs\/1702.05983."},{"key":"e_1_3_2_60_2","first-page":"245","volume-title":"Proceedings of the Workshops of the 32nd AAAI Conference on Artificial Intelligence","author":"Hu Weiwei","year":"2018","unstructured":"Weiwei Hu and Ying Tan. 2018. Black-box attacks against RNN based malware detection algorithms. In Proceedings of the Workshops of the 32nd AAAI Conference on Artificial Intelligence. AAAI Press, 245\u2013251."},{"key":"e_1_3_2_61_2","doi-asserted-by":"publisher","DOI":"10.1145\/2046684.2046692"},{"key":"e_1_3_2_62_2","doi-asserted-by":"publisher","DOI":"10.1145\/3180445.3180449"},{"key":"e_1_3_2_63_2","doi-asserted-by":"publisher","DOI":"10.1145\/3338504.3357341"},{"key":"e_1_3_2_64_2","unstructured":"Jinho Jung Chanil Jeon Max Wolotsky Insu Yun and Taesoo Kim. 2017. AVPASS: Leaking and Bypassing Antivirus Detection Model Automatically. (July 2017). Retrieved July 2017 from https:\/\/www.blackhat.com\/."},{"key":"e_1_3_2_65_2","article-title":"Practical malware analysis","author":"Kendall Kris","year":"2007","unstructured":"Kris Kendall and Chad McMillan. 2007. Practical malware analysis. In Proceedings of the Black Hat Conference. (2007). Online; access at December 2019.","journal-title":"Proceedings of the Black Hat Conference"},{"key":"e_1_3_2_66_2","doi-asserted-by":"publisher","DOI":"10.1145\/3123939.3123972"},{"key":"e_1_3_2_67_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2018.04.092"},{"key":"e_1_3_2_68_2","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/D14-1181"},{"key":"e_1_3_2_69_2","doi-asserted-by":"publisher","DOI":"10.23919\/EUSIPCO.2018.8553214"},{"key":"e_1_3_2_70_2","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2017.7966340"},{"key":"e_1_3_2_71_2","unstructured":"Felix Kreuk Assi Barak Shir Aviv-Reuven Moran Baruch Benny Pinkas and Joseph Keshet. 2018. Deceiving end-to-end deep learning malware detectors using adversarial examples. In Proceedings of NeurIPS 2018 Workshop on Security in Machine Learning . Retrieved from https:\/\/secml2018.github.io\/malware.pdf."},{"key":"e_1_3_2_72_2","volume-title":"Proceedings of the 5th International Conference on Learning Representations","author":"Kurakin Alexey","year":"2017","unstructured":"Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. 2017. Adversarial machine learning at scale. In Proceedings of the 5th International Conference on Learning Representations. OpenReview.net."},{"key":"e_1_3_2_73_2","unstructured":"Kaspersky Lab. 2018. Kaspersky. (May 2018). Retrieved May 2018 from https:\/\/www.kaspersky.com\/."},{"key":"e_1_3_2_74_2","doi-asserted-by":"publisher","DOI":"10.1038\/nature14539"},{"key":"e_1_3_2_75_2","volume-title":"Proceedings of Machine Learning and Systems","author":"Lei Qi","year":"2019","unstructured":"Qi Lei, Lingfei Wu, Pin-Yu Chen, Alexandros Dimakis, Inderjit Dhillon, and Michael Witbrock. 2019. Discrete adversarial attacks and submodular optimization with applications to text classification. In Proceedings of Machine Learning and Systems. mlsys.org."},{"key":"e_1_3_2_76_2","unstructured":"Bo Li Yevgeniy Vorobeychik and Xinyun Chen. 2016. A General Retraining Framework for Scalable Adversarial Classification. In Proceedings of NeurIPS 2016 Workshop on Adversarial Training . Retrieved from https:\/\/sites.google.com\/site\/nips2016adversarial\/WAT16_paper_2.pdf?attredirects=0."},{"key":"e_1_3_2_77_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.3003571"},{"key":"e_1_3_2_78_2","volume-title":"Proceedings of the AAAI-19 Workshop on Artificial Intelligence for Cyber Security","author":"Li Deqiang","year":"2019","unstructured":"Deqiang Li, Qianmu Li, Yanfang Ye, and Shouhuai Xu. 2019. Enhancing robustness of deep neural networks against adversarial malware samples: Principles, framework, and application to AICS\u20192019 challenge. In Proceedings of the AAAI-19 Workshop on Artificial Intelligence for Cyber Security. Retrieved from http:\/\/arxiv.org\/abs\/1812.08108."},{"key":"e_1_3_2_79_2","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2021.3051354"},{"key":"e_1_3_2_80_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2805680"},{"key":"e_1_3_2_81_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Madry Aleksander","year":"2018","unstructured":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards deep learning models resistant to adversarial attacks. In Proceedings of the 6th International Conference on Learning Representations. OpenReview.net."},{"key":"e_1_3_2_82_2","doi-asserted-by":"publisher","DOI":"10.1145\/3332184"},{"key":"e_1_3_2_83_2","doi-asserted-by":"publisher","DOI":"10.1145\/2484313.2484327"},{"key":"e_1_3_2_84_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101901"},{"key":"e_1_3_2_85_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23353"},{"key":"e_1_3_2_86_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Moosavi-Dezfooli Seyed-Mohsen","year":"2018","unstructured":"Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, Pascal Frossard, and Stefano Soatto. 2018. Robustness of classifiers to universal perturbations: a geometric perspective. In Proceedings of the 6th International Conference on Learning Representations. OpenReview.net."},{"key":"e_1_3_2_87_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2007.21"},{"key":"e_1_3_2_88_2","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140451"},{"key":"e_1_3_2_89_2","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2016.7727508"},{"key":"e_1_3_2_90_2","doi-asserted-by":"publisher","DOI":"10.1145\/1015330.1015435"},{"key":"e_1_3_2_91_2","doi-asserted-by":"publisher","DOI":"10.1145\/1102351.1102430"},{"key":"e_1_3_2_92_2","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"e_1_3_2_93_2","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"e_1_3_2_94_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"e_1_3_2_95_2","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2018.00035"},{"key":"e_1_3_2_96_2","first-page":"5","article-title":"Label sanitization against label flipping poisoning attacks","volume":"11329","author":"Paudice Andrea","year":"2018","unstructured":"Andrea Paudice, Luis Mu\u00f1oz-Gonz\u00e1lez, and Emil C. Lupu. 2018. Label sanitization against label flipping poisoning attacks. In Proceedings of the Joint European Conference on Machine Learning and Knowledge Discovery in Databases. Vol. 11329. Springer, 5\u201315.","journal-title":"Proceedings of the Joint European Conference on Machine Learning and Knowledge Discovery in Databases"},{"key":"e_1_3_2_97_2","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2005.159"},{"key":"e_1_3_2_98_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00073"},{"key":"e_1_3_2_99_2","doi-asserted-by":"publisher","DOI":"10.5555\/1408351"},{"key":"e_1_3_2_100_2","volume-title":"Proceedings of the Workshops at the 32nd AAAI Conference on Artificial Intelligence","author":"Raff Edward","year":"2018","unstructured":"Edward Raff, Jon Barker, Jared Sylvester, Robert Brandon, Bryan Catanzaro, and Charles K. Nicholas. 2018. Malware detection by eating a whole exe. In Proceedings of the Workshops at the 32nd AAAI Conference on Artificial Intelligence. AAAI Press."},{"key":"e_1_3_2_101_2","doi-asserted-by":"crossref","first-page":"490","DOI":"10.1007\/978-3-030-00470-5_23","volume-title":"Research in Attacks, Intrusions, and Defenses","author":"Rosenberg Ishai","year":"2018","unstructured":"Ishai Rosenberg, Asaf Shabtai, Lior Rokach, and Yuval Elovici. 2018. Generic black-box end-to-end attack against state of the art API call based malware classifiers. In Research in Attacks, Intrusions, and Defenses, Michael Bailey. Thorsten Holz, Manolis Stamatogiannakis, and Sotiris Ioannidis (Eds.), Springer, Cham, 490\u2013510."},{"key":"e_1_3_2_102_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.14"},{"key":"e_1_3_2_103_2","doi-asserted-by":"publisher","DOI":"10.1145\/2996758.2996771"},{"key":"e_1_3_2_104_2","doi-asserted-by":"publisher","DOI":"10.1109\/MALWARE.2015.7413680"},{"key":"e_1_3_2_105_2","doi-asserted-by":"publisher","DOI":"10.5555\/3327345.3327409"},{"key":"e_1_3_2_106_2","unstructured":"Alexandru Constantin Serban and Erik Poll. 2018. Adversarial examples - a complete characterisation of the phenomenon. arXiv:1810.01185. Retrieved from https:\/\/arxiv.org\/abs\/1810.01185."},{"key":"e_1_3_2_107_2","first-page":"294","volume-title":"Proceedings of the 2015 International Conference on Computer, Communications, and Control Technology","author":"Shaid Syed Zainudeen Mohd","year":"2015","unstructured":"Syed Zainudeen Mohd Shaid and Mohd Aizaini Maarof. 2015. In memory detection of windows API call hooking technique. In Proceedings of the 2015 International Conference on Computer, Communications, and Control Technology. IEEE, 294\u2013298."},{"key":"e_1_3_2_108_2","doi-asserted-by":"publisher","DOI":"10.5555\/2621980"},{"key":"e_1_3_2_109_2","article-title":"VirusTotal","author":"Sistemas Hispasec","year":"2019","unstructured":"Hispasec Sistemas. 2019. VirusTotal. (May 2019). Retrieved May 2, 2019 from https:\/\/www.virustotal.com.","journal-title":"(May 2019). Retrieved May 2, 2019 from https:\/\/www.virustotal.com."},{"key":"e_1_3_2_110_2","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420987"},{"key":"e_1_3_2_111_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23078"},{"key":"e_1_3_2_112_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-89862-7_1"},{"key":"e_1_3_2_113_2","doi-asserted-by":"publisher","DOI":"10.5555\/2627435.2670313"},{"key":"e_1_3_2_114_2","first-page":"1","volume-title":"Proceedings of the 20th Annual Network & Distributed System Security Symposium","author":"\u0160rndi\u0107 Nedim","year":"2013","unstructured":"Nedim \u0160rndi\u0107 and Pavel Laskov. 2013. Detection of malicious pdf files based on hierarchical document structure. In Proceedings of the 20th Annual Network & Distributed System Security Symposium. The Internet Society, 1\u201316."},{"key":"e_1_3_2_115_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.20"},{"key":"e_1_3_2_116_2","doi-asserted-by":"publisher","DOI":"10.1186\/s13635-016-0045-0"},{"key":"e_1_3_2_117_2","doi-asserted-by":"publisher","DOI":"10.5555\/3294996.3295110"},{"key":"e_1_3_2_118_2","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2019.00015"},{"key":"e_1_3_2_119_2","doi-asserted-by":"publisher","DOI":"10.5555\/3277203.3277301"},{"key":"e_1_3_2_120_2","doi-asserted-by":"publisher","DOI":"10.1023\/A:1018628609742"},{"key":"e_1_3_2_121_2","volume-title":"Proceedings of the 2nd International Conference on Learning Representations","author":"Szegedy Christian","year":"2014","unstructured":"Christian Szegedy, Wojciech Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus. 2014. Intriguing properties of neural networks. In Proceedings of the 2nd International Conference on Learning Representations. OpenReview.net."},{"key":"e_1_3_2_122_2","doi-asserted-by":"publisher","DOI":"10.1145\/2623330.2623342"},{"key":"e_1_3_2_123_2","doi-asserted-by":"publisher","DOI":"10.5555\/3361338.3361359"},{"key":"e_1_3_2_124_2","doi-asserted-by":"publisher","DOI":"10.5555\/3454287.3454814"},{"key":"e_1_3_2_125_2","doi-asserted-by":"publisher","DOI":"10.5555\/2986916.2987018"},{"key":"e_1_3_2_126_2","first-page":"255","article-title":"Deepmalnet: Evaluating shallow and deep networks for static PE malware detection","author":"Vinayakumar R.","year":"2018","unstructured":"R. Vinayakumar and K. P. Soman. 2018. Deepmalnet: Evaluating shallow and deep networks for static PE malware detection. ICT Express 4, 4 (2018), 255\u2013258.","journal-title":"ICT Express"},{"key":"e_1_3_2_127_2","volume-title":"Proceedings of the 5th International Conference on Learning Representations","author":"Wang Beilun","year":"2017","unstructured":"Beilun Wang, Ji Gao, and Yanjun Qi. 2017. A Theoretical Framework for Robustness of (Deep) Classifiers against Adversarial Samples. In Proceedings of the 5th International Conference on Learning Representations. OpenReview.net."},{"key":"e_1_3_2_128_2","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098158"},{"key":"e_1_3_2_129_2","doi-asserted-by":"publisher","DOI":"10.5555\/3277203.3277323"},{"key":"e_1_3_2_130_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2014.2353996"},{"key":"e_1_3_2_131_2","first-page":"5283","volume-title":"Proceedings of the 35th International Conference on Machine Learning","volume":"80","author":"Wong Eric","year":"2018","unstructured":"Eric Wong and J. Zico Kolter. 2018. Provable defenses against adversarial examples via the convex outer adversarial polytope. In Proceedings of the 35th International Conference on Machine Learning. Vol. 80. PMLR, 5283\u20135292."},{"key":"e_1_3_2_132_2","unstructured":"AICS workshop. 2018. AICS 2019 Workshop Challenge Problem. (December 2018). Retrieved December 2018 from http:\/\/www-personal.umich.edu\/arunesh\/AICS2019\/challenge.html."},{"key":"e_1_3_2_133_2","doi-asserted-by":"publisher","DOI":"10.5555\/3045118.3045298"},{"key":"e_1_3_2_134_2","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2014.6997494"},{"key":"e_1_3_2_135_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23115"},{"key":"e_1_3_2_136_2","doi-asserted-by":"publisher","DOI":"10.1145\/2806416.2806548"},{"key":"e_1_3_2_137_2","doi-asserted-by":"publisher","DOI":"10.1145\/3134600.3134642"},{"key":"e_1_3_2_138_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-008-0108-y"},{"key":"e_1_3_2_139_2","doi-asserted-by":"publisher","DOI":"10.1145\/3073559"},{"key":"e_1_3_2_140_2","doi-asserted-by":"publisher","DOI":"10.1109\/BWCCA.2010.85"},{"key":"e_1_3_2_141_2","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2018.2886017"},{"key":"e_1_3_2_142_2","doi-asserted-by":"publisher","DOI":"10.1109\/TCYB.2015.2415032"},{"key":"e_1_3_2_143_2","doi-asserted-by":"publisher","DOI":"10.5555\/2381019"},{"key":"e_1_3_2_144_2","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978304"}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3484491","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3484491","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3484491","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T16:17:14Z","timestamp":1750177034000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3484491"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,11,23]]},"references-count":143,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2023,1,31]]}},"alternative-id":["10.1145\/3484491"],"URL":"https:\/\/doi.org\/10.1145\/3484491","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,11,23]]},"assertion":[{"value":"2020-06-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2021-08-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2021-11-23","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}