REMEDII: Robust Malware Detection with Iterative and Intelligent Adversarial Training

Official code release for our ICISS 2024 paper:

REMEDII: Robust Malware Detection with Iterative and Intelligent Adversarial Training

The published paper is available here:

https://dl.acm.org/doi/10.1007/978-3-031-80020-7_14

REMEDII studies robust malware detection under adversarial malware examples. The repository contains implementations for iterative adversarial training with GAN-based attackers and multiple malware classifiers.

Repository Layout

REMEDII-Malware-Detection/
├── lsgan_max/      # REMEDII with the LSGAN-AT attacker
├── malgan_max/     # REMEDII with the MALGAN attacker
├── requirements.txt
└── README.md

The experiments include classifier-specific scripts for CNN, DNN, decision tree, logistic regression, MLP, random forest, and SVM variants where available.

Installation

git clone https://github.com/cssanchit/REMEDII-Malware-Detection.git
cd REMEDII-Malware-Detection

python3 -m venv ctgan
source ctgan/bin/activate

pip install -r requirements.txt

Running Experiments

LSGAN-AT

cd lsgan_max
bash runcnn.sh

runcnn.sh repeatedly runs the CNN-based LSGAN experiment:

#!/bin/bash
for i in {1..1000}
do
   python3 cnnlsgan.py
done

Similar shell scripts are provided for the other classifiers, for example rundnn.sh, rundt.sh, runlr.sh, runmlp.sh, runrf.sh, and runsvm.sh.

MALGAN

cd malgan_max
bash runcnn.sh

The MALGAN folder follows the same classifier-specific structure.

Input State Files

The experiment scripts read small state/configuration files such as tempdataCNN.txt. These files store:

• Current round
• Counter
• Threshold

Example:

0 0 0.7

This initializes the current round to 0, the counter to 0, and the threshold to 0.7.

Related Attackers

• LSGAN-AT: Wang, J., Chang, X., Wang, Y. et al. LSGAN-AT: enhancing malware detector robustness against adversarial examples. Cybersecurity 4, 38 (2021). https://doi.org/10.1186/s42400-021-00102-9
• MALGAN: Hu, W. and Tan, Y. Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN. https://doi.org/10.1007/978-981-19-8991-9_29

Citation

If you use this code, please cite our paper:

@InProceedings{10.1007/978-3-031-80020-7_14,
  author    = {Gupta, Sanchit and Kumar, Vireshwar},
  editor    = {Patil, Vishwas T. and Krishnan, Ram and Shyamasundar, Rudrapatna K.},
  title     = {REMEDII: Robust Malware Detection with Iterative and Intelligent Adversarial Training},
  booktitle = {Information Systems Security},
  year      = {2025},
  publisher = {Springer Nature Switzerland},
  address   = {Cham},
  pages     = {246--264},
  isbn      = {978-3-031-80020-7}
}

Contact

For questions about this project, please contact:

Sanchit Gupta
cs.sanchit@gmail.com