Deep Learning Framework for Adversarial Malware Generation and Detection

Abstract

The escalating sophistication of malware attacks necessitates advanced defense mechanisms capable of anticipating adversarial evasion techniques. This paper presents a novel dual- mode deep learning framework that simultaneously generates adversarial malware samples and enhances detection capabilities through a unified architectural design. The proposed system integrates a Variational Autoencoder-Generative Adversarial Net- work (VAE-GAN) for synthesizing realistic adversarial malware with a Siamese Network architecture optimized for deep metric learning-based detection. The VAE-GAN generator produces adversarial samples that maintain executable integrity while incorporating perturbations designed to challenge conventional detection systems, achieving 92.3% functional preservation with exceptionally low distributional divergence (FID: 0.127, MMD: 0.0043, KL: 0.041). The Siamese Network discriminator learns ro- bust feature embeddings through pairwise comparison, enabling effective identification of both original and adversarially modified malware variants. A comprehensive evaluation of 140,000 mal- ware samples demonstrates superior performance across multiple dimensions: detection accuracy of 99.14% with an AUC-ROC of 0.9967, precision of 98.73%, recall of 99.48%, and F1-score of 99.10%, substantially outperforming traditional machine learn- ing approaches. The framework exhibits exceptional adversarial robustness with 94.11% average accuracy across Fast Gradient Sign Method (94.73%), Projected Gradient Descent (92.16%), and Gaussian noise perturbations (96.45%), while maintaining computational efficiency with 1.2ms inference time and 833 samples/second throughput. The remarkably low false positive rate of 0.86% minimizes operational burden in production envi- ronments. This research establishes a new paradigm for proactive cybersecurity through adversarial learning, demonstrating that unified generation-detection architectures can simultaneously strengthen defensive capabilities while providing realistic threat modeling for security testing and evaluation.