Phantomware improves detection of new malware with synthetic data
Phantomware: a Data Augmentation Framework for the Detection of Emerging Malware Campaigns
Cryptography and Security
Summary
Detecting new malware is hard because there are often very few examples to learn from. The authors found that creating fake malware variants to train detectors is difficult when those variants must still work like real malware. They developed Phantomware, which makes fake malware data in an abstract space without needing real malicious programs to run. This approach generates diverse examples that help models detect new malware better, even when little real data is available.
What this means in practice
- •For cybersecurity engineers: Improve early detection systems of malware by training with controlled synthetic malware data where few real samples exist.
- •For enterprise security teams: Enhance malware defense readiness during new malware outbreaks by incorporating diverse synthetic variants into detection models.
Authors
Antonino Rullo
Abstract
Detecting unseen malware variants remains a major challenge as malware families continuously evolve. This issue is exacerbated in data-scarce scenarios such as emerging malware campaigns, where only a few samples are available to train robust detectors. A common strategy is to proactively generate malware variants and use them as augmentation data to expose models to a broader range of potential threats. Existing approaches that generate functional malware variants through adversarial manipulation suffer from several important limitations. Generated samples must remain executable and preserve their malicious behavior, requiring costly validation through execution and analysis. Moreover, the adversarial objective provides limited control over the resulting augmentation dataset: it cannot guarantee the generation of sufficiently diverse variants, or even a single successful sample, making the effectiveness of the augmentation process inherently unpredictable. Finally, these approaches typically rely on a well-trained detector to guide generation, an assumption that may not hold in data-scarce scenarios such as early-stage malware campaigns. We formally and empirically demonstrate these limitations and propose Phantomware, a data augmentation framework designed for extreme data scarce scenarios. Phantomware operates entirely in the representation space of a pretrained malware detector, avoiding the costly generation and validation of functional binaries. By exploiting latent-space geometry, it generates synthetic malware representations of a target family in a controlled manner, providing a constructive guarantee on the generation of diverse training samples. Extensive experiments on real malware families demonstrate that Phantomware improves detection of unseen variants and provides robustness against both real and adversarially generated malware samples.