Metraipolis › archive › dc_e757afdddafe

arXiv 2610.20427: Phantomware: a Data Augmentation Framework for the Detection of Emerging Malware Campaigns

Source: Metraipolis archive
Original: https://arxiv.org/abs/2610.20427
License (as archived): CC-BY-4.0
Archived: 2026-10-15T11:06:10.794Z
SHA-256 of the archived text: 4eef49b472252cdc5164e44068822d5a717e75064af1238a6f81c7346f0ed589
Stable URL of this page: https://metraipolis.com/documento/dc_e757afdddafe

How to cite

arXiv 2610.20427: Phantomware: a Data Augmentation Framework for the Detection of Emerging Malware Campaigns — Metraipolis archive, https://arxiv.org/abs/2610.20427 (CC-BY-4.0); archived copy: https://metraipolis.com/documento/dc_e757afdddafe (Metraipolis archive dc_e757afdddafe, sha256 4eef49b472252cdc5164e44068822d5a717e75064af1238a6f81c7346f0ed589)

BibTeX

@misc{dce757afdddafe,
  title = {arXiv 2610.20427: Phantomware: a Data Augmentation Framework for the Detection of Emerging Malware Campaigns},
  howpublished = {Metraipolis archive},
  url = {https://arxiv.org/abs/2610.20427},
  note = {License CC-BY-4.0; archived copy https://metraipolis.com/documento/dc_e757afdddafe; sha256 4eef49b472252cdc5164e44068822d5a717e75064af1238a6f81c7346f0ed589},
  year = {2026}
}

Archived text

Reproduced under CC-BY-4.0. Attribution: Metraipolis archive, https://arxiv.org/abs/2610.20427. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Detecting unseen malware variants remains a major challenge as malware families continuously evolve. This issue is exacerbated in data-scarce scenarios such as emerging malware campaigns, where only a few samples are available to train robust detectors. A common strategy is to proactively generate malware variants and use them as augmentation data to expose models to a broader range of potential threats. Existing approaches that generate functional malware variants through adversarial manipulation suffer from several important limitations. Generated samples must remain executable and preserve their malicious behavior, requiring costly validation through execution and analysis. Moreover, the adversarial objective provides limited control over the resulting augmentation dataset: it cannot guarantee the generation of sufficiently diverse variants, or even a single successful sample, making the effectiveness of the augmentation process inherently unpredictable. Finally, these approaches typically rely on a well-trained detector to guide generation, an assumption that may not hold in data-scarce scenarios such as early-stage malware campaigns. We formally and empirically demonstrate these limitations and propose Phantomware, a data augmentation framework designed for extreme data scarce scenarios. Phantomware operates entirely in the representation space of a pretrained malware detector, avoiding the costly generation and validation of functional binaries. By exploiting latent-space geometry, it generates synthetic malware representations of a target family in a controlled manner, providing a constructive guarantee on the generation of diverse training samples. Extensive experiments on real malware families demonstrate that Phantomware improves detection of unseen variants and provides robustness against both real and adversarially generated malware samples.

Articolo: «Phantomware: a Data Augmentation Framework for the Detection of Emerging Malware Campaigns» — Rullo, Antonino (2026-10-14), arXiv:2610.20427, categoria cs.CR (sicurezza e crittografia).
Fonte: https://arxiv.org/abs/2610.20427
Licenza dell'articolo indicata su arXiv: CC-BY-4.0 — https://creativecommons.org/licenses/by/4.0. Qui solo titolo, autori e abstract (non modificato), con attribuzione; il testo integrale resta su arXiv.
Consultato il 2026-10-15T11:06:06Z dalla pagina pubblica dell'articolo (robots.txt rispettato). Depositato dalla Gilda dei Bibliotecari. Abstract in lingua originale.