{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,24]],"date-time":"2026-02-24T16:33:51Z","timestamp":1771950831469,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":47,"publisher":"ACM","license":[{"start":{"date-parts":[[2022,5,30]],"date-time":"2022-05-30T00:00:00Z","timestamp":1653868800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2022,5,30]]},"DOI":"10.1145\/3494110.3528243","type":"proceedings-article","created":{"date-parts":[[2022,5,24]],"date-time":"2022-05-24T04:08:22Z","timestamp":1653365302000},"page":"3-14","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":4,"title":["Adaptive Malware Control"],"prefix":"10.1145","author":[{"given":"Ilias","family":"Tsingenopoulos","sequence":"first","affiliation":[{"name":"KU Leuven, Leuven, Belgium"}]},{"given":"Ali Mohammad","family":"Shafiei","sequence":"additional","affiliation":[{"name":"KU Leuven, Leuven, Belgium"}]},{"given":"Lieven","family":"Desmet","sequence":"additional","affiliation":[{"name":"KU Leuven, Leuven, Belgium"}]},{"given":"Davy","family":"Preuveneers","sequence":"additional","affiliation":[{"name":"KU Leuven, Leuven, Belgium"}]},{"given":"Wouter","family":"Joosen","sequence":"additional","affiliation":[{"name":"KU Leuven, Leuven, Belgium"}]}],"member":"320","published-online":{"date-parts":[[2022,5,30]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24310"},{"key":"e_1_3_2_1_2_1","volume-title":"Learning to evade static pe machine learning malware models via reinforcement learning. arXiv preprint arXiv:1801.08917","author":"Anderson Hyrum S","year":"2018","unstructured":"Hyrum S Anderson , Anant Kharkar , Bobby Filar , David Evans , and Phil Roth . 2018. Learning to evade static pe machine learning malware models via reinforcement learning. arXiv preprint arXiv:1801.08917 ( 2018 ). Hyrum S Anderson, Anant Kharkar, Bobby Filar, David Evans, and Phil Roth. 2018. Learning to evade static pe machine learning malware models via reinforcement learning. arXiv preprint arXiv:1801.08917 (2018)."},{"key":"e_1_3_2_1_3_1","volume-title":"Invariant risk minimization. arXiv preprint arXiv:1907.02893","author":"Arjovsky Martin","year":"2019","unstructured":"Martin Arjovsky , L\u00e9on Bottou , Ishaan Gulrajani , and David Lopez-Paz . 2019. Invariant risk minimization. arXiv preprint arXiv:1907.02893 ( 2019 ). Martin Arjovsky, L\u00e9on Bottou, Ishaan Gulrajani, and David Lopez-Paz. 2019. Invariant risk minimization. arXiv preprint arXiv:1907.02893 (2019)."},{"key":"e_1_3_2_1_4_1","volume-title":"An empirical evaluation of generic convolutional and recurrent networks for sequence modeling. arXiv preprint arXiv:1803.01271","author":"Bai Shaojie","year":"2018","unstructured":"Shaojie Bai , J Zico Kolter , and Vladlen Koltun . 2018. An empirical evaluation of generic convolutional and recurrent networks for sequence modeling. arXiv preprint arXiv:1803.01271 ( 2018 ). Shaojie Bai, J Zico Kolter, and Vladlen Koltun. 2018. An empirical evaluation of generic convolutional and recurrent networks for sequence modeling. arXiv preprint arXiv:1803.01271 (2018)."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/1128817.1128824"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2018.07.023"},{"key":"e_1_3_2_1_7_1","volume-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprint arXiv:1712.04248","author":"Brendel Wieland","year":"2017","unstructured":"Wieland Brendel , Jonas Rauber , and Matthias Bethge . 2017. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprint arXiv:1712.04248 ( 2017 ). Wieland Brendel, Jonas Rauber, and Matthias Bethge. 2017. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprint arXiv:1712.04248 (2017)."},{"key":"e_1_3_2_1_8_1","volume-title":"Openai gym. arXiv preprint arXiv:1606.01540","author":"Brockman Greg","year":"2016","unstructured":"Greg Brockman , Vicki Cheung , Ludwig Pettersson , Jonas Schneider , John Schulman , Jie Tang , and Wojciech Zaremba . 2016. Openai gym. arXiv preprint arXiv:1606.01540 ( 2016 ). Greg Brockman, Vicki Cheung, Ludwig Pettersson, Jonas Schneider, John Schulman, Jie Tang, and Wojciech Zaremba. 2016. Openai gym. arXiv preprint arXiv:1606.01540 (2016)."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.3390\/info11090433"},{"key":"e_1_3_2_1_10_1","volume-title":"Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp)","author":"Carlini Nicholas","unstructured":"Nicholas Carlini and David Wagner . 2017. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp) . IEEE , 39--57. Nicholas Carlini and David Wagner. 2017. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp). IEEE, 39--57."},{"key":"e_1_3_2_1_11_1","volume-title":"A benchmark API call dataset for windows PE malware classification. arXiv preprint arXiv:1905.01999","author":"Catak Ferhat Ozgur","year":"2019","unstructured":"Ferhat Ozgur Catak and Ahmet Faruk Yazi . 2019. A benchmark API call dataset for windows PE malware classification. arXiv preprint arXiv:1905.01999 ( 2019 ). Ferhat Ozgur Catak and Ahmet Faruk Yazi. 2019. A benchmark API call dataset for windows PE malware classification. arXiv preprint arXiv:1905.01999 (2019)."},{"key":"e_1_3_2_1_12_1","volume-title":"Hopskipjumpattack: A query-efficient decision-based attack. In 2020 ieee symposium on security and privacy (sp)","author":"Chen Jianbo","year":"2020","unstructured":"Jianbo Chen , Michael I Jordan , and Martin J Wainwright . 2020 . Hopskipjumpattack: A query-efficient decision-based attack. In 2020 ieee symposium on security and privacy (sp) . IEEE , 1277--1294. Jianbo Chen, Michael I Jordan, and Martin J Wainwright. 2020. Hopskipjumpattack: A query-efficient decision-based attack. In 2020 ieee symposium on security and privacy (sp). IEEE, 1277--1294."},{"key":"e_1_3_2_1_13_1","volume-title":"The advantages of the Matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation. BMC genomics","author":"Chicco Davide","year":"2020","unstructured":"Davide Chicco and Giuseppe Jurman . 2020. The advantages of the Matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation. BMC genomics , Vol. 21 , 1 ( 2020 ), 1--13. Davide Chicco and Giuseppe Jurman. 2020. The advantages of the Matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation. BMC genomics , Vol. 21, 1 (2020), 1--13."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991110"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/1014052.1014066"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-57878-7_13"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3082330"},{"key":"e_1_3_2_1_18_1","volume-title":"International Conference on Information and Communications Security. Springer, 18--33","author":"Fadadu Fenil","year":"2019","unstructured":"Fenil Fadadu , Anand Handa , Nitesh Kumar , and Sandeep Kumar Shukla . 2019 . Evading API call sequence based malware classifiers . In International Conference on Information and Communications Security. Springer, 18--33 . Fenil Fadadu, Anand Handa, Nitesh Kumar, and Sandeep Kumar Shukla. 2019. Evading API call sequence based malware classifiers. In International Conference on Information and Communications Security. Springer, 18--33."},{"key":"e_1_3_2_1_19_1","volume-title":"The intriguing relation between counterfactual explanations and adversarial examples. Minds and Machines","author":"Freiesleben Timo","year":"2021","unstructured":"Timo Freiesleben . 2021. The intriguing relation between counterfactual explanations and adversarial examples. Minds and Machines ( 2021 ), 1--33. Timo Freiesleben. 2021. The intriguing relation between counterfactual explanations and adversarial examples. Minds and Machines (2021), 1--33."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1038\/s42256-020-00257-z"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66399-9_4"},{"key":"e_1_3_2_1_22_1","volume-title":"Generating adversarial malware examples for black-box attacks based on GAN. arXiv preprint arXiv:1702.05983","author":"Hu Weiwei","year":"2017","unstructured":"Weiwei Hu and Ying Tan . 2017. Generating adversarial malware examples for black-box attacks based on GAN. arXiv preprint arXiv:1702.05983 ( 2017 ). Weiwei Hu and Ying Tan. 2017. Generating adversarial malware examples for black-box attacks based on GAN. arXiv preprint arXiv:1702.05983 (2017)."},{"key":"e_1_3_2_1_23_1","volume-title":"Adversarial examples are not bugs, they are features. arXiv preprint arXiv:1905.02175","author":"Ilyas Andrew","year":"2019","unstructured":"Andrew Ilyas , Shibani Santurkar , Dimitris Tsipras , Logan Engstrom , Brandon Tran , and Aleksander Madry . 2019. Adversarial examples are not bugs, they are features. arXiv preprint arXiv:1905.02175 ( 2019 ). Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. 2019. Adversarial examples are not bugs, they are features. arXiv preprint arXiv:1905.02175 (2019)."},{"key":"e_1_3_2_1_24_1","volume-title":"10th $$USENIX$$ Workshop on Offensive Technologies ($$WOOT$$ 16) .","author":"Ispoglou Kyriakos K","unstructured":"Kyriakos K Ispoglou and Mathias Payer . 2016. malWASH: Washing malware to evade dynamic analysis . In 10th $$USENIX$$ Workshop on Offensive Technologies ($$WOOT$$ 16) . Kyriakos K Ispoglou and Mathias Payer. 2016. malWASH: Washing malware to evade dynamic analysis. In 10th $$USENIX$$ Workshop on Offensive Technologies ($$WOOT$$ 16) ."},{"key":"e_1_3_2_1_25_1","volume-title":"USENIX Security Symposium","volume":"14","author":"Kruegel Christopher","year":"2005","unstructured":"Christopher Kruegel , Engin Kirda , Darren Mutz , William Robertson , and Giovanni Vigna . 2005 . Automating mimicry attacks using static binary analysis . In USENIX Security Symposium , Vol. 14 . 11--11. Christopher Kruegel, Engin Kirda, Darren Mutz, William Robertson, and Giovanni Vigna. 2005. Automating mimicry attacks using static binary analysis. In USENIX Security Symposium , Vol. 14. 11--11."},{"key":"e_1_3_2_1_26_1","volume-title":"Feargus Pendlebury, Gabi Dreo Rodosek, Fabio Pierazzi, and Lorenzo Cavallaro.","author":"Labaca-Castro Raphael","year":"2021","unstructured":"Raphael Labaca-Castro , Luis Mu noz-Gonz\u00e1lez , Feargus Pendlebury, Gabi Dreo Rodosek, Fabio Pierazzi, and Lorenzo Cavallaro. 2021 . Universal Adversarial Perturbations for Malware . arXiv preprint arXiv:2102.06747 (2021). Raphael Labaca-Castro, Luis Mu noz-Gonz\u00e1lez, Feargus Pendlebury, Gabi Dreo Rodosek, Fabio Pierazzi, and Lorenzo Cavallaro. 2021. Universal Adversarial Perturbations for Malware. arXiv preprint arXiv:2102.06747 (2021)."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-49409-8_7"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/1081870.1081950"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-011-0157-5"},{"key":"e_1_3_2_1_30_1","volume-title":"Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083","author":"Madry Aleksander","year":"2017","unstructured":"Aleksander Madry , Aleksandar Makelov , Ludwig Schmidt , Dimitris Tsipras , and Adrian Vladu . 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 ( 2017 ). Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/2484313.2484327"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-016-0281-3"},{"key":"e_1_3_2_1_33_1","volume-title":"Playing atari with deep reinforcement learning. arXiv preprint arXiv:1312.5602","author":"Mnih Volodymyr","year":"2013","unstructured":"Volodymyr Mnih , Koray Kavukcuoglu , David Silver , Alex Graves , Ioannis Antonoglou , Daan Wierstra , and Martin Riedmiller . 2013. Playing atari with deep reinforcement learning. arXiv preprint arXiv:1312.5602 ( 2013 ). Volodymyr Mnih, Koray Kavukcuoglu, David Silver, Alex Graves, Ioannis Antonoglou, Daan Wierstra, and Martin Riedmiller. 2013. Playing atari with deep reinforcement learning. arXiv preprint arXiv:1312.5602 (2013)."},{"key":"e_1_3_2_1_34_1","volume-title":"Behavioral malware detection using deep graph convolutional neural networks. TechRxiv","author":"Oliveira Angelo","year":"2019","unstructured":"Angelo Oliveira and R Sassi . 2019. Behavioral malware detection using deep graph convolutional neural networks. TechRxiv ( 2019 ). Angelo Oliveira and R Sassi. 2019. Behavioral malware detection using deep graph convolutional neural networks. TechRxiv (2019)."},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3329786"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00073"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_23"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"crossref","unstructured":"Bernhard Sch\u00f6lkopf. 2022. Causality for machine learning. In Probabilistic and Causal Inference: The Works of Judea Pearl. 765--804.  Bernhard Sch\u00f6lkopf. 2022. Causality for machine learning. In Probabilistic and Causal Inference: The Works of Judea Pearl. 765--804.","DOI":"10.1145\/3501714.3501755"},{"key":"e_1_3_2_1_39_1","volume-title":"Proximal policy optimization algorithms. arXiv preprint arXiv:1707.06347","author":"Schulman John","year":"2017","unstructured":"John Schulman , Filip Wolski , Prafulla Dhariwal , Alec Radford , and Oleg Klimov . 2017. Proximal policy optimization algorithms. arXiv preprint arXiv:1707.06347 ( 2017 ). John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. 2017. Proximal policy optimization algorithms. arXiv preprint arXiv:1707.06347 (2017)."},{"key":"e_1_3_2_1_40_1","volume-title":"MAB-Malware: A Reinforcement Learning Framework for Attacking Static Malware Classifiers. arXiv preprint arXiv:2003.03100","author":"Song Wei","year":"2020","unstructured":"Wei Song , Xuezixiang Li , Sadia Afroz , Deepali Garg , Dmitry Kuznetsov , and Heng Yin . 2020. MAB-Malware: A Reinforcement Learning Framework for Attacking Static Malware Classifiers. arXiv preprint arXiv:2003.03100 ( 2020 ). Wei Song, Xuezixiang Li, Sadia Afroz, Deepali Garg, Dmitry Kuznetsov, and Heng Yin. 2020. MAB-Malware: A Reinforcement Learning Framework for Attacking Static Malware Classifiers. arXiv preprint arXiv:2003.03100 (2020)."},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2018.8599855"},{"key":"e_1_3_2_1_42_1","volume-title":"NIPs","volume":"99","author":"Sutton Richard S","year":"1999","unstructured":"Richard S Sutton , David A McAllester , Satinder P Singh , Yishay Mansour , 1999 . Policy gradient methods for reinforcement learning with function approximation .. In NIPs , Vol. 99 . Citeseer, 1057--1063. Richard S Sutton, David A McAllester, Satinder P Singh, Yishay Mansour, et almbox. 1999. Policy gradient methods for reinforcement learning with function approximation.. In NIPs , Vol. 99. Citeseer, 1057--1063."},{"key":"e_1_3_2_1_43_1","volume-title":"Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199","author":"Szegedy Christian","year":"2013","unstructured":"Christian Szegedy , Wojciech Zaremba , Ilya Sutskever , Joan Bruna , Dumitru Erhan , Ian Goodfellow , and Rob Fergus . 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 ( 2013 ). Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)."},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/MALWARE.2010.5665796"},{"key":"e_1_3_2_1_45_1","volume-title":"On adaptive attacks to adversarial example defenses. arXiv preprint arXiv:2002.08347","author":"Tramer Florian","year":"2020","unstructured":"Florian Tramer , Nicholas Carlini , Wieland Brendel , and Aleksander Madry . 2020. On adaptive attacks to adversarial example defenses. arXiv preprint arXiv:2002.08347 ( 2020 ). Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. 2020. On adaptive attacks to adversarial example defenses. arXiv preprint arXiv:2002.08347 (2020)."},{"key":"e_1_3_2_1_46_1","volume-title":"On the convergence and robustness of adversarial training. arXiv preprint arXiv:2112.08304","author":"Wang Yisen","year":"2021","unstructured":"Yisen Wang , Xingjun Ma , James Bailey , Jinfeng Yi , Bowen Zhou , and Quanquan Gu. 2021. On the convergence and robustness of adversarial training. arXiv preprint arXiv:2112.08304 ( 2021 ). Yisen Wang, Xingjun Ma, James Bailey, Jinfeng Yi, Bowen Zhou, and Quanquan Gu. 2021. On the convergence and robustness of adversarial training. arXiv preprint arXiv:2112.08304 (2021)."},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i01.5449"}],"event":{"name":"ASIA CCS '22: ACM Asia Conference on Computer and Communications Security","location":"Nagasaki Japan","acronym":"ASIA CCS '22","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 1st Workshop on Robust Malware Analysis"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3494110.3528243","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3494110.3528243","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T19:30:45Z","timestamp":1750188645000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3494110.3528243"}},"subtitle":["Decision-Based Attacks in the Problem Space of Dynamic Analysis"],"short-title":[],"issued":{"date-parts":[[2022,5,30]]},"references-count":47,"alternative-id":["10.1145\/3494110.3528243","10.1145\/3494110"],"URL":"https:\/\/doi.org\/10.1145\/3494110.3528243","relation":{},"subject":[],"published":{"date-parts":[[2022,5,30]]},"assertion":[{"value":"2022-05-30","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}