Dynamic Programming-based Adversarial Windows Payload Generator

Abstract

This work presents a behavior preserving Adversarial payload framework against static Windows malware scanners.The framework uses Dynamic Programming to decide on the sequence of static code transformation actions to transform a Windows payload to its adversarial state. In an empirical evaluation with Windows payloads from Metasploit Framework in a black-box settings, static machine learning based and majority of commercial antivirus scanners can still be evaded by these transformations. The potency of these generated Adversarial payload capable of breaching commercial antivirus on users’ devices was demonstrated. The experimental results show a generated Adversarial Backdoor Trojan evade static and also evade its offline dynamic detector and establish a backdoor on the users’ device.