Summary
Detecting harmful software on Windows computers often uses complex systems combining rules and machine learning. The authors studied how these systems handle trade-offs between catching malware accurately, running quickly, and resisting tricks from hackers. They created new ways to test how attackers with different knowledge levels might try to fool the whole system, instead of just parts of it. Their experiments showed it’s possible to make detection faster and less resource-heavy while keeping it nearly as accurate, but this comes with some risk to security. The findings help people who build and use these systems choose the best setup for their needs.
Windows malwarecompound AI systemmachine learningstatic analysisdynamic analysisadversarial attacksdetection accuracycomputational efficiencythreat modelingsystem robustness
Authors
Andrea Ponte, Luca Demetrio, Luca Oneto, Battista Biggio, Fabio Roli
Abstract
Industrial Windows malware detectors are commonly described as Compound AI Systems composed of multiple heterogeneous components, including rule-based mechanisms as well as machine-learning-based static and dynamic analyses. However, due to industrial secrecy and limited public disclosure, the internal architectures of these systems can only be inferred, rendering systematic evaluations of detection accuracy, computational costs, and adversarial robustness largely infeasible. In contrast, academic research provides reproducible and transparent evaluation methodologies, but typically investigates individual detection components in isolation. To bridge the gap between academic research and industrial practice, and inspired by state-of-the-art industrial architectures for Windows malware detection, we propose a novel methodology that (i) explicitly balances the trade-off among detection performance, computational requirements, and robustness, and introduces (ii) system-level threat models that capture how attackers exploit different degrees of knowledge to evade the entire Compound AI System rather than isolated detectors. Experiments conducted on real-world data demonstrate that the Compound AI System training time can be reduced and responsiveness improved while incurring only a marginal loss in detection performance. Leveraging our threat modeling, we show that increasingly knowledgeable attackers craft more effective adversarial examples, revealing the system's strengths and weaknesses, degrading its responsiveness, and exposing a direct trade-off between efficiency and robustness. Finally, we translate these trade-offs into take-home messages and deployment guidelines, helping practitioners to select the system that best matches their operational constraints.