MalARN: An Adversarial Reconstruction Network for Improving Detection of Evolving Malware

Evolving a malware into a family is an effective technique to hinder detection mechanisms. A recent trend exploits generative models to support threat actors in the creation of “mutations” for rapidly preparing malware families. However, artificial intelligence can also be used to develop effective countermeasures. To this end, we propose MalARN, a deep learning-based solution for creating synthetic representations of malware variants to make detectors more robust and facilitate spotting never-seen threats. MalARN takes advantage of a pre-trained large language model to map both malicious and benign binary samples into embeddings. To bypass the requirement for executable binaries, an adversarial reconstruction network is used to operate directly in the embedding space. Evaluated against four real malware families, MalARN outperforms the baseline solution in terms of specific metrics for unbalanced scenarios.