EXE-Bench：对基于人工智能的Windows恶意软件检测器在实际可用性方面的权衡进行排名

中文摘要 AI 辅助

由于缺乏系统评估，我们尚无法确定在生产中部署哪种基于人工智能的Windows恶意软件检测器。现有评估存在问题，如训练和测试数据不同、未考虑时间分析、未进行对抗攻击的安全评估以及忽视部署的计算要求。因此，我们开发了EXE-Bench，一个全面的基于人工智能的Windows恶意软件检测器基准。它评估性能、时间和对抗鲁棒性以及计算开销，并汇总为单一分数以进行直接和公平的模型比较。通过EXE-Bench，我们强调部署后才进行的评估是次优的，无法全面展现性能。特别是通过分析，我们指出特征工程所灌输的领域知识在该领域仍然非常有用，能抵抗时间和对抗攻击，这与大多数仅在部署后表现出色的深度网络形成鲜明对比。

英文摘要

Due to the lack of systematic evaluations, we are not yet able to determine which AI-based Windows malware detector to deploy in production, since existing evaluations (i) differ in terms of data used for both training and testing; (ii) do not consider temporal analysis to showcase whether models withstand the passage of time; (iii) avoid security evaluations with adversarial attacks that could highlight their brittleness against content-injection attacks; and (iv) neglect the computational requirements for deployment, risking slow inference on endpoints. For these reasons, we develop EXE-Bench, a comprehensive benchmark of AI-based Windows malware detectors. EXE-Bench assesses performance, temporal and adversarial robustness, and computational overhead, aggregating them into a single score for direct and fair model comparison. Through EXE-Bench, we highlight how evaluations conducted only after deployment are suboptimal and unable to provide a complete picture of their performance. In particular, through our analysis, we remark how much domain knowledge instilled through feature engineering is still extremely useful in this domain, resisting both time and adversarial attacks, in stark contrast with most of the deep networks that only excel right after deployment.

发表机构

• University of Genova（热那亚大学）
• Artificial Intelligence Research Institute (IIIA-CSIC)（西班牙国家研究委员会人工智能研究所）
• CTU in Prague（布拉格捷克技术大学）
• Sapienza University（罗马大学）
• University of Cagliari（卡利亚里大学）

机构由 AI 辅助整理，请以论文原文为准。