antivirus software engineers

Abstract: Antivirus (AV) signatures encode valuable detection knowledge accumulated through expert analysis, yet repeated black-box queries can expose this knowledge for unauthorized reuse and targeted evasion. We propose Signature Knowledge Shielding (SKS), a design paradigm that protects existing AV rules, termed Protected Signatures (PS), through auxiliary Shielding Signatures (SS). SKS uses AV-supervised importance ranking to discover candidate byte blocks, filters and selects them through negative-sample calibration, and combines SS matches with original AV verdicts through logical OR. SS matching introduces additional positive responses and verdict changes during probing, making detection feedback less directly attributable to PS and increasing the difficulty of localizing signature-related content, while preserving original positive verdicts. Within SKS, we integrate five individually tuned non-learning matching methods and further propose Robust Embedding Matching (REM), a lightweight learned matcher trained with random context and byte perturbations. REM provides stronger and more consistent protection against content modifications and scanning-alignment changes. We develop and open-source a ClamAV-based prototype and evaluate it against five probing methods. With an observed additional test false-positive rate below 0.1%, REM raises the mean query count of state-of-the-art probing to as much as 282.57 times the unprotected baseline, while introducing only 0.67% GPU scanning overhead. These results demonstrate that SKS can substantially increase signature-extraction costs with limited impact on detection utility and scanning efficiency.

Abstract: Existing malware detection approaches heavily rely on handcrafted features derived from static or dynamic analysis of the executable files. These methods require specialized domain expertise, dedicated analysis tools, and time-consuming analysis, which limits their scalability and robustness in the face of the increasing complexity and diversity of modern malware. Consequently, there is a growing interest in approaches that operate directly on raw bytes, which contain rich semantic and structural information. However, capturing long-range dependencies within executable files remains challenging for conventional static and CNN-based methods. This paper presents MalwareFormer, a transformer-based, byte-level malware detection framework that operates directly on raw bytes, without requiring domain knowledge or feature extraction. MalwareFormer achieves an accuracy of 98.35%, a balanced accuracy of 98.32%, a macro-F1 of 98.32%, and a false positive rate of 1.94%, outperforming both baselines across all threshold-dependent classification metrics and demonstrating that transformers provide a powerful and scalable approach for byte-level malware detection.