Avhunter finds exact byte regions that antivirus software checks
Breaking the Black Box: Byte-Level Boundary Inference of Real-World Antivirus Systems
Cryptography and Security
Summary
Antivirus programs decide if files are safe or harmful but keep their detection rules secret, making it hard to understand what triggers an alert. The authors created AVHunter, a tool that can guess which exact parts of a file antivirus products focus on to label it as dangerous or safe, just by testing with the software without knowing its internal workings. They built a large dataset by testing 11 antivirus systems and showed that AVHunter accurately predicts these key file regions. This helps reveal hidden antivirus knowledge and could improve malware detection and evasion studies.
What this means in practice
- •For malware analysts: Identify precise byte areas antivirus software uses for detection to improve malware analysis and evasion research.
- •For security software developers: Use byte-level detection boundaries to design antivirus systems with more transparent and robust signature models.
Authors
Jieshuai Yang, Zhi Wang, Yan Jia, Zhenhua Wu, Jianfei Tang, Chenbin Su, Jingwei Ye, Jianwen Tian, Wanpeng Li
Abstract
Existing approaches for understanding the detection logic of real-world antivirus (AV) software infer only binary malware/benign decisions from black-box queries, providing limited insight into the fine-grained decision-critical regions that govern AV detection. In this paper, we present \textbf{AVHunter}, the first framework for inferring byte-level decision-critical regions of real-world AV products under a black-box threat model. AVHunter constructs the first large-scale Byte-Level AV Boundary Dataset (BABD) by systematically probing 11 real-world AV products, revealing that modern AV detections are largely associated with a small number of compact decision-critical byte regions. Leveraging BABD, AVHunter trains AV-specific models that not only reproduce binary AV decisions, but also localize the decision-critical byte regions underlying these decisions, achieving an average boundary prediction recall of 85.07% while maintaining 97.43% detection agreement with the target AVs. We further validate that the predicted regions capture genuine AV decision knowledge through boundary-guided malware evasion, false-positive induction on benign executables, and a seven-month longitudinal study demonstrating that the inferred regions remain largely stable as AV products evolve. Overall, AVHunter moves beyond conventional binary-label AV modeling by enabling fine-grained boundary-region localization and revealing a new form of AV knowledge leakage with important implications for malware analysis, AV security, and boundary-aware defenses.