Signature Knowledge Shielding: Protecting Antivirus Detection Knowledge through Robust Embedding Matching

1

Signature Knowledge Shielding: Protecting Antivirus Detection Knowledge through Robust Embedding Matching

arXiv:2610.26207v1 [cs.CR] 19 Oct 2026

Jieshuai Yang, Zhi Wang, Yan Jia, Zhenhua Wu, Jianfei Tang, Chenbin Su, Jingwei Ye, Jianwen Tian, and Wanpeng Li

An adversary can repeatedly modify a detected file and observe binary scanning verdicts to infer detection-relevant content. Prior work has investigated signature inference through such feedback [2], [3]. More recently, AVHunter demonstrates that black-box queries can reveal byte-level decision-critical regions for reproducing AV behavior and guiding targeted evasion [4], complementing findings on malware-classifier and antivirus extraction [5]. Such knowledge leakage creates opportunities for unauthorized reuse of proprietary detection expertise. Bi-Iocane further shows that manipulating AVsensitive bytes can corrupt AV-generated labels and poison downstream learning-based detectors, exposing risks in the AV-to-ML labeling supply chain [6]. Protecting signature knowledge is therefore important not only for safeguarding intellectual assets, but also for resisting evasion and preserving the integrity of downstream detection pipelines. Existing approaches address only part of this problem. Concealing the signature database restricts direct access but does not eliminate knowledge leakage through scanning feedback [3]. Server-enforced query controls can increase extraction costs for remote services [7], but their effectiveness cannot be assumed when adversaries control the local scanning environment. Filiol proposes combinatorial subpatterns and instance-specific Index Terms—Antivirus Software, Malware Detection, Detection detection functions to resist black-box analysis [8]. However, Knowledge Protection. this approach requires reorganizing detection patterns and changing their decision logic, rather than directly protecting I. I NTRODUCTION existing rules in their original form. A key question therefore Signature-based detection remains a core component of remains how AV providers can protect their accumulated modern antivirus (AV) systems [1]. Carefully curated signatures signature rules while preserving the detection knowledge and provide explicit, reproducible matching conditions for detecting matching mechanisms already in place. We propose Signature Knowledge Shielding (SKS), a design known threats with low false-positive rates. These rules distill paradigm that introduces Shielding Signatures (SS) to protect expert analysis into reusable detection knowledge, making existing rules, termed Protected Signatures (PS). While preservproprietary signature collections valuable intellectual assets. ing the original detection mechanism, SKS uses SS matching However, keeping the database confidential does not eliminate to introduce additional positive responses and irregular verdict knowledge leakage through the scanner’s observable behavior. changes during probing. These responses make detection (Corresponding author: Zhi Wang.) feedback harder to attribute to PS, increasing the difficulty Jieshuai Yang, Zhi Wang, Yan Jia, Zhenhua Wu, Jianfei Tang, Chenbin Su, and Jingwei Ye are with the College of Cryptology of localizing signature-related content. Realizing this objective and Cyber Science, Nankai University, Tianjin 300350, China (e- presents two challenges. mail: yjs@mail.nankai.edu.cn; zwang@nankai.edu.cn; jiay@nankai.edu.cn; Challenge #1: Increasing signature-probing complexity. 2120250720@mail.nankai.edu.cn; kid519388073@mail.nankai.edu.cn; chamAn additional exact pattern may become another extraction tarpion.su@mail.nankai.edu.cn; jwye@mail.nankai.edu.cn). Jianwen Tian is with the School of Computing and Information Systems, get, leaving the original rules exposed once removed. Effective Singapore Management University, 80 Stamford Road, Singapore 178902 shielding must complicate probing feedback to substantially (e-mail: jwtian@smu.edu.sg). Wanpeng Li is with the School of Computer Science and Informatics, increase the queries required to localize protected signatures, University of Liverpool, Liverpool, UK (e-mail: wanpeng.li@liverpool.ac.uk). while remaining effective against content modifications and

Abstract—Antivirus (AV) signatures encode valuable detection knowledge accumulated through expert analysis, yet repeated black-box queries can expose this knowledge for unauthorized reuse and targeted evasion. We propose Signature Knowledge Shielding (SKS), a design paradigm that protects existing AV rules, termed Protected Signatures (PS), through auxiliary Shielding Signatures (SS). SKS uses AV-supervised importance ranking to discover candidate byte blocks, filters and selects them through negative-sample calibration, and combines SS matches with original AV verdicts through logical OR. SS matching introduces additional positive responses and verdict changes during probing, making detection feedback less directly attributable to PS and increasing the difficulty of localizing signature-related content, while preserving original positive verdicts. Within SKS, we integrate five individually tuned non-learning matching methods and further propose Robust Embedding Matching (REM), a lightweight learned matcher trained with random context and byte perturbations. REM provides stronger and more consistent protection against content modifications and scanning-alignment changes. We develop and open-source a ClamAV-based prototype and evaluate it against five probing methods. With an observed additional test false-positive rate below 0.1%, REM raises the mean query count of state-of-the-art probing to as much as 282.57× the unprotected baseline, while introducing only 0.67% GPU scanning overhead. These results demonstrate that SKS can substantially increase signature-extraction costs with limited impact on detection utility and scanning efficiency.

2

scanning-alignment changes that adversaries may exploit. evaluation of signature protection, detection utility, and scanning and storage overhead. Challenge #2: Preserving detection reliability. Introducing SS can strengthen protection, but may also cause previously negative inputs to be flagged. AV systems demand highly II. P RELIMINARIES reliable detection. Shielding must therefore preserve original detections while strictly limiting additional false positives, A. Protected Signatures and Shielding Signatures without imposing excessive scanning or storage costs. Signature-based matching provides explicit conditions and Within SKS, we integrate five individually tuned non- efficient detection of known threats [1]. False positives and learning matching methods and further introduce Robust Embed- performance degradation under distribution shifts limit reliance ding Matching (REM), a lightweight learned matcher. The REM- on ML models as the primary defense, so signature matching based pipeline comprises four stages, namely important-block remains central to modern AV systems, with learning-based discovery, matching-model training, SS library construction, methods providing complementary protection [1], [9]. When and online scanning. First, an AV-supervised model identifies learning-based detection is not triggered and verdicts depend and ranks important byte blocks to form candidate pools. To on a few localized byte regions, iterative probing may expose address Challenge #1, REM learns to match reference blocks detection knowledge. AVHunter, DefenderCheck, HDD, and under random context and byte perturbations. It combines its ProbDD- and CDD-based variants demonstrate querytolerance to content and alignment changes with fine-grained, based localization of detection-relevant content [4], [10]–[13], irregular detection responses during probing, making PS-related enabling unauthorized knowledge reuse, targeted evasion, and poisoning of AV-based labeling supply chains [4]–[6]. content harder to isolate. We call existing AV signatures selected for protection To address Challenge #2, SKS uses negative samples from the training and validation sets to filter false-positive-prone Protected Signatures (PS). Common types include file and candidates under the calibrated scanning configuration. Guided section hashes, wildcard byte patterns, and logical signatures by importance rankings, construction proceeds for at most combining multiple conditions [14]. These rules encode knowlR rounds and retains up to k accepted blocks per source edge accumulated through expert analysis and maintenance. sample before global deduplication. During online scanning, We focus on PS depending on localized byte regions, which are SKS combines SS matches with the original AV verdict through often sparse within a file and can be isolated through iterative logical OR, preserving every original positive verdict while probing. Figure 1(a) illustrates such content in a real WannaCry introducing auxiliary matches that complicate signature probing. sample. Global signatures, such as whole-file hashes, lack this The objective is to protect existing signature knowledge rather spatial property. Shielding Signatures (SS) are constructed from selected byte than extend detection to unknown malware. blocks and stored separately as matcher-specific representations, We develop and open-source a ClamAV-based SKS protoincluding REM embeddings and non-learning fingerprints or type and evaluate it against five probing strategies. Using a digests. SKS uses REM and integrates five tuned non-learning configuration with an observed additional test false-positive matchers as alternatives and baselines. SS neither modify PS rate of 0.0891%, REM raises the mean query count of statenor insert bytes into scanned files. Their matches introduce of-the-art probing to as much as 282.57× the unprotected additional positive responses that obscure PS-related feedback baseline and retains a 272.41× query multiplier under random and increase signature-localization costs. scan-grid shifts. This configuration provides SS coverage for 95.73% of training positives, with only 0.67% GPU scanning overhead and a 7.92% storage increase relative to the B. Boundary Points original ClamAV signature database. These results demonstrate A boundary point (BP) is a byte position associated with a protection of signature knowledge through auxiliary matching change in the detection verdict under a specified modification while preserving original detections and keeping additional and probing procedure. Such a position may be identified by false positives and deployment overhead manageable. advancing a masking boundary or by removing a byte from Our contributions are as follows: a reduced input. BPs therefore depend on the modification • A design paradigm for shielding signature knowledge. procedure and the current input state; different probing methods We propose SKS, which substantially increases signature- may locate different BPs in the same sample. Figure 1(b) probing costs through auxiliary SS matching while preserv- illustrates a BP through the loss of a byte required by ing original AV positive verdicts and limiting additional the displayed PS matching branch. An adversary observing false positives. only binary verdicts can iteratively locate such positions and • A learning-based method for SS matching. We introduce examine their surrounding bytes to infer detection-relevant REM, a lightweight matcher trained with random context content. AVHunter validates this connection against ClamAV’s and byte perturbations, providing stronger and more signature database: among samples with recoverable groundconsistent protection under scanning-alignment changes truth matching regions, 97.39% exhibit overlap between these than the evaluated non-learning alternatives. regions and the probed critical bytes [4]. Beyond ClamAV, its • An open-source ClamAV-based prototype. We develop experiments on commercial AV products show that modifying and open-source an SKS prototype integrating REM and inferred boundary regions can enable evasion, while inserting five tuned non-learning matchers, supporting reproducible such regions into benign files can trigger detections, providing

3

From a Real PS Boundary to SS Protection (a) A Real Protected Signature

(b) A Measured Boundary Point

(c) SS Conceals PS Feedback

WannaCry · PE

This Branch Requires the Complete Pattern

Original AV

ClamAV PS · …6313787-0

Without the final e: PS fails

.wnry

…

tasksche.ex

0

Sparse BPs · easier localization

With the final e: PS matches

tasksche.exe

65 = e

0xF4D8–0xF4E3

Final Byte

Sufficient Matching Branch:

.wnry

AND

tasksche.exe

.wnry

…

tasksche.exe

Boundary point: position of the final e Byte offset 0xF4E3

1

SS 1

AV + SS

SS 2

Dense BPs Within SS Blocks Ambiguous feedback hinders PS localization

(a–b) Measured with one original PS; the full database detects 8 rules. Offsets are zero-based; 0/1 denotes negative/positive.

Fig. 1. PS, BP, (c) and SS illustrated with anot real WannaCry sample. (a) are TheSSstrings .wnry and jointly a matching branch of a ClamAV Conceptual BP distribution, a measured trace. Blue blocks matching regions withtasksche.exe internal BPs; red marks satisfy denote PS-related locations. signature (PS). (b) Without the final “e,” this branch fails to match, illustrating a BP at that byte position. (c) SS protection is shown schematically: dense BPs within SS blocks obscure PS-related feedback and complicate signature localization.

evidence of their association with AV decisions [4]. These findings support using BPs and surrounding context to construct and validate candidate byte-pattern rules. C. Threat Model We focus on protecting AV signatures used for static detection of Windows PE files. We consider an adversary with black-box query access to an AV scanner protected by SKS. The adversary can obtain detected PE samples, submit modified inputs, and observe scanning responses. All reported detections are treated as positive outcomes, while no detection is treated as a negative outcome. The adversary can adaptively replace, mask, truncate, insert, or delete bytes based on previous responses and retain query histories to isolate detection-relevant content. Queried inputs need not remain valid PE files. We allow knowledge of the SKS design and matching procedure, but assume no direct access to the PS or SS libraries and no ability to modify the scanner’s decision logic. The adversary aims to localize PS-related content and recover static detection knowledge. We evaluate its progress under a bounded query budget to approximate time and resource constraints. Our scope concerns static signatures rather than behavioral detection during program execution. D. Motivation and Protection Objective

that generate numerous BPs to protect existing static detection signatures. Our objective is to increase the query costs of localizing and extracting PS in the Windows PE setting, hindering largescale knowledge extraction under practical time and resource constraints. Protection should preserve existing detections while limiting additional false positives. We also evaluate scanning latency and storage overhead. SKS aims to make extraction more costly, without assuming that all extraction attempts can be prevented. III. A PPROACH SKS protects existing PS by introducing SS whose matching responses obscure PS-related probing feedback. Figure 2 presents its four stages. Important-block discovery produces ranked candidate pools under AV supervision. Matching model training uses these blocks to learn REM, which tolerates surrounding context and content modifications. SS library construction then applies REM to filter candidates through multiple rounds of selection, accumulating suitable blocks from each sample. Online scanning reuses the trained matcher and the resulting SS library, combining SS matches with the original AV verdict. By introducing additional positive responses and fragmented, irregular boundaries, SKS makes PS-related content harder to isolate and increases signaturelocalization queries. The following stages describe the REMbased implementation; non-learning alternatives retain their native representations and acceptance rules.

Under the threat model described in Section II-C, existing probing methods progressively localize and modify detectiontriggering regions in PE samples, enabling efficient knowledge A. Important-Block Discovery SKS first identifies byte blocks associated with the target extraction when relatively few BPs are encountered. We observe that statistical and learned approximate matching rules can pro- AV’s detection behavior. We train an importance model using duce numerous BPs during input modification. This motivates binary labels supplied by the AV, guiding candidate discovery constructing dedicated SS matched using these techniques: their without requiring access to the underlying PS. matches introduce additional positive responses and boundaries, The importance model is a shallow multilayer perceptron. making PS-related feedback harder to isolate, as illustrated It maps an 80-dimensional representation of byte frequencies schematically in Figure 1(c). Building on this idea, we propose and hashed byte bigrams through layers of 128 and 64 units, SKS, a design paradigm that combines candidate discovery, followed by a linear scoring head. Following a multiplecalibrated SS library construction, and matching techniques instance learning formulation [15], [16], we treat each file

4

SKS: Signature Knowledge Shielding 1 Important-Block Discovery

Samples

2 Matching Model Training

3 SS Library Construction

REM: Learned Matching

Next Candidate per Source Sample Until k Accepted or Pool Empty

AV supervision 0/1

Cosine

Importance model

Locate regions and extract fixed-size blocks

Random Context + Byte Perturbations

0.91

0.48

0.85

Ranked candidates per sample

Robustness training

Train + Val Negatives

Pass: Retain up to k / Source Update Sample Coverage

Maximize queries under an FPR constraint

Fragmentation obscures PS boundaries

PS

Input Sliding Windows

SS matching

×

False Positive: Discard; Try Next Round

SS Library Merge and Deduplicate

SS region

Original AV: PS matching

4 Online Scanning

REM-Based Negative Calibration

Similarity ≥ τ

Non-Learning Baselines

SS region

1 Block

Up to R Rounds

SimHash ssdeep TLSH LZJD sdhash

Illustrative importance scores 0.32

Matching model

Ranked Candidates

OR

Verdict 0/1

PS preserved Probing feedback obscured

Fig. 2. SKS overview. (1) AV-supervised important-block discovery. (2) REM training with context and byte perturbations; five tuned non-learning matchers provide alternatives. (3) Negative calibration and source-match checks retain up to k ranked blocks per sample over at most R rounds. (4) Sliding-window SS matches are OR-combined with AV verdicts, preserving detections while complicating PS localization.

as a bag of byte blocks and use max pooling to aggregate normalized 128-dimensional embeddings. Local convolution block scores into a file-level prediction supervised by AV captures ordered byte patterns, while pooling and randomlabels. The resulting block scores guide candidate ranking. We context training reduce dependence on absolute positions. choose this lightweight architecture because this stage primarily Unlike fixed statistical representations, REM can learn tolerance requires an informative ordering of candidate blocks under file- to positional changes and content modifications. This compact level supervision. Its low computational cost supports scoring architecture supports protective matching while limiting addilarge candidate pools and retaining alternatives for subsequent tional scanning overhead. filtering. We draw reference blocks from the training candidate pools For each AV-positive training sample x, the model ranks and pair them with perturbed views. Random prefix and suffix candidate blocks of length L. Basic filtering removes unsuitable context totaling ∆ bytes places an L-byte reference block at blocks, and identical candidates within the sample are consol- varying positions within an L + ∆-byte view. Random byte idated. The resulting pool Cx preserves importance ordering replacements additionally simulate content modifications. Foland retains alternatives for later selection. lowing the principle of representation consistency across augThese pools connect discovery to the next two stages. Their mented views [20], training combines contrastive cross-entropy blocks provide reference content for REM training, while with squared hinge penalties enforcing positive-similarity floors, their rankings guide SS selection after the matcher is trained. a positive–hard-negative margin, and a negative-similarity Importance alone does not establish suitability: a highly ranked ceiling. A variance regularizer discourages embedding collapse. block may also match negative content. Such candidates are Negatives include mined hard windows, randomly sampled identified using REM during library construction. negative windows, and padded negative views from AV-negative training files. B. Matching Model Training REM compares an input block b and reference block s using REM learns how to match candidate content under modifica- cosine similarity: tion. Its encoder fθ is trained separately from the importance fθ (b)⊤ fθ (s) simθ (b, s) = . (1) model: importance ranking determines which blocks to consider, ∥fθ (b)∥2 ∥fθ (s)∥2 whereas REM determines whether input content sufficiently The similarity in Equation 1 is converted into a block-level resembles a reference block. REM uses a lightweight byte-sequence encoder, drawing decision using a unified threshold τ : on byte-level convolutional modeling [17], [18] and attentionAREM (b, s; Γ) = 1[simθ (b, s) ≥ τ ] , (2) based pooling [16], [19]. It comprises 8-dimensional byte embeddings, a 32-channel local convolution with kernel size 8 where Γ contains the trained encoder and matching configand stride 1, one residual feed-forward module, and attention uration. The acceptance rule in Equation 2 is fixed before pooling with two learned queries. A projection head produces SS selection and reused during online scanning, ensuring that

5

candidate filtering evaluates the same matching behavior used below; alternative matchers use native representations and at deployment. comparison rules. For an input x of length n, windows start at offset zero with SKS also integrates five non-learning approximate matchers based on statistical features and hand-designed matching rules, stride ∆ and length ℓ = L + ∆. Following the configuration including SimHash [21], ssdeep [22], TLSH [23], LZJD [24], analysis in Section IV-D1, we set L = 1,024 bytes and and sdhash [25]. Each retains its native representation and ∆ = 128 bytes, yielding ℓ = 1,152-byte scanning windows. comparison rule and is tuned for PS protection under constraints Setting ℓ = L + ∆ ensures that any complete L-byte region is on additional false positives, serving as both an alternative fully contained in at least one scanning window despite grid matcher and a comparison baseline. Exact byte matching serves misalignment. Equation 3 defines the window set, including incomplete tail windows right-padded with 0x90: as a control.
bi = Pad0x90 x[i : min(i + ℓ, n)], ℓ , (3) C. SS Library Construction W(x) = {bi | i = j∆ < n, j ∈ N0 }. This stage takes the ranked candidate pools and the trained REM matcher as inputs and constructs the SS library S. Its objective is to provide broad sample coverage and retain multiple suitable protective blocks while limiting additional false positives. Coverage is the proportion of AV-positive training samples matched by at least one SS under the online scanning configuration. Starting from an empty library, construction proceeds for at most R rounds, retaining up to k accepted blocks per source sample. In each round, we select the highest-ranked, untried candidate from every sample that has remaining candidates and fewer than k accepted blocks. Samples already covered by the current library remain eligible for selection. Thus, R limits the number of candidates examined per sample, whereas k limits the number retained before global deduplication. Each selected block is evaluated as a reference SS against negative files from the training and validation sets. This check uses REM with the calibrated configuration, including the similarity threshold, window extraction, and padding policy. A block is discarded if it matches any calibration negative. Otherwise, it is accepted only if it matches a scanning window of its source file. Accepted blocks are added to S, and coverage is updated. A rejected candidate does not count toward the k-block limit; the sample advances to its next highest-ranked candidate in the following round. Rejected blocks are never reintroduced. Selection continues for each sample until k blocks are accepted, its candidate pool is exhausted, or the R-round limit is reached. Continuing selection for covered samples provides additional protective matches, reducing dependence on a single SS. Finally, identical accepted blocks are deduplicated globally, and their normalized REM embeddings are stored as the deployed SS library. Raw reference byte blocks are not included in the reported deployment storage. The resulting Top-k library therefore retains up to k eligible blocks per source sample before deduplication, rather than necessarily retaining its first k candidates. The encoder and calibration configuration remain fixed throughout construction. The resulting library is frozen before evaluation, and test samples are not used for candidate selection or filtering. D. Online Scanning Online scanning applies the frozen SS library and calibrated matching configuration. We describe REM-based scanning

Retaining tail windows preserves opportunities to match protective content remaining after truncation. This robustness design in SKS mitigates the risk that truncation-based probing, such as DefenderCheck, leaves important content in incomplete tail windows that would otherwise be skipped. Padding affects only SS matching and leaves the original AV input unchanged. REM encodes the windows in Equation 3 in batches and compares their normalized embeddings with cached SS embeddings. Local convolutional features can be reused across overlapping windows to reduce repeated computation. Equation 4 defines a file-level SS match whenever at least one window satisfies the block-level acceptance rule in Equation 2: M (x, s; Γ) = 1[∃b ∈ W(x) : AREM (b, s; Γ) = 1] .

(4)

SS matching stops once any match is found; an empty window set or SS library produces no protective match. The original AV evaluates x using its existing PS, and Equation 5 combines its verdict with SS matches through logical OR: _ DSKS (x) = DAV (x) ∨ M (x, s; Γ). (5) s∈S

The composition in Equation 5 preserves every original positive verdict, while negative-sample calibration limits additional false positives. SS matches make detection feedback harder to attribute to PS. During modification, an SS may maintain a positive verdict independently of PS, while learned similarities can repeatedly cross the matching threshold and introduce irregular BPs. These responses intermingle with PS-related boundaries, requiring more probing to distinguish origins and isolate PS-related content. IV. E VALUATION We evaluate our ClamAV-based SKS prototype’s protection of signature knowledge against black-box probing. We examine REM and five individually tuned non-learning matchers across five probing strategies, without and with scan-grid shifts. We investigate protective coverage, additional false positives, scanning and matching configurations, robustness design, distinct BP counts, and deployment overhead, including how design choices affect SS library storage. Our evaluation addresses four research questions: • RQ1: Signature Protection Effectiveness. To what extent does SKS increase probing queries across different probing

6

TABLE I DATASET PARTITIONS WITH C LAM AV- DERIVED LABELS .

Label Training Validation Test Total Positive 69,474 8,684 8,682 86,840 Negative 73,470 8,723 7,859 90,052 Total 142,944 17,407 16,541 176,892

strategies, and how does REM compare with tuned nonlearning matchers without and with scan-grid shifts? • RQ2: Detection Utility and Additional False Positives. How effectively does SKS cover known detected samples while preserving original positive verdicts and limiting additional false positives on test negatives? • RQ3: Design Choices and Boundary Point Counts. How do reference-block length and scanning stride balance protection, coverage, and overhead? How do matching thresholds and block-retention limits affect additional false positives? Does robustness design increase probing costs, and how does SS matching affect distinct BP counts within budget? • RQ4: Runtime and Storage Overhead. What additional scanning and storage overhead does SKS introduce across matchers, and how do vector precision and block selection affect SS library storage while maintaining coverage and limiting additional false positives? A. Evaluation Setup 1) Datasets: Our dataset comprises 176,892 PE files primarily from SOREL-20M, BODMAS, and VirusShare [26]– [28]. We demonstrate signature protection using ClamAV and assign samples its binary labels, as our objective is to protect existing AV signature knowledge rather than learn more generalizable malware-detection knowledge. Motivated by findings on temporal evaluation bias and concept drift [29]– [31], we sort each label class by PE COFF timestamp and chronologically split it into approximately 80% training, 10% validation, and 10% test data. Table I reports partition sizes. Training samples support importance-model training and candidate block extraction. Training and validation negatives calibrate the SS library and matching parameters to constrain additional false positives, which the test set measures relative to ClamAV verdicts. 2) SS Matching Methods and Calibration: SKS supports REM and non-learning SS matchers based on statistical features and heuristic similarity measures. SimHash compares binary fingerprints using Hamming distance [21]; ssdeep compares context-triggered piecewise hashes [22]; TLSH measures distances between digests of local byte statistics [23]; LZJD estimates Jaccard similarity between Lempel–Ziv substring sets [24]; and sdhash compares Bloom-filter digests constructed from statistically discriminative features [25]. Exact requires identical byte content and serves as a basic control. REM instead compares normalized embeddings produced by an encoder trained with random context and byte perturbations. We tune the non-learning matchers for PS protection with a target additional false-positive rate below 0.2%, calibrating their

acceptance rules against training and validation negatives and reporting the resulting test-set false-positive rates separately. The selected SimHash configuration uses 256-bit fingerprints, a maximum matching radius of 80, and a calibration margin of 16 relative to the nearest negative fingerprint. The other configurations use ssdeep scores of at least 95, TLSH distances of at most 15, LZJD similarity of at least 0.92, and sdhash scores of at least 92. These methods serve as comparison baselines and potential alternatives for lightweight SKS deployments. 3) Probing Methods and Protocol: We evaluate five probing methods: AVHunter, which locates verdict-changing byte positions through boundary search [4]; DefenderCheck [10], which recursively splits inputs to identify detection-triggering bytes; HDD [11], which hierarchically reduces inputs while preserving a positive verdict; and HDD variants incorporating probabilistic subset selection from ProbDD [12] or counterbased subset selection from CDD [13]. For all methods, we apply a common strategy to handle repeated BPs: when the same BP is repeatedly reported, we mask surrounding bytes and progressively expand the masked region until probing advances to another BP, avoiding infinite loops at the same position. Probing stops at the query budget or when the target AV labels the cumulatively masked input negative. We emphasize defending against methods requiring fewer queries against the unprotected scanner, as their lower extraction cost makes them more attractive choices for resource-constrained adversaries. 4) Evaluation Metrics: We use the following metrics to evaluate protection effectiveness, boundary behavior, detection utility, and overhead. • Probing Queries measures total queries (Qtot ) consumed by each probing run. Runs reaching the query budget are included at the cap. Higher counts indicate greater probing costs. • Distinct Boundary Points measures the number of distinct BPs reported within the query budget, characterizing the boundary behavior encountered during probing. • Coverage and Additional False-Positive Rate measure the fraction of AV-positive samples matched by at least one SS and the fraction of AV-negative samples additionally flagged by SS, respectively. Additional FPR is relative to ClamAV verdicts, rather than independently verified benign ground truth. • Scanning and Storage Overhead measures additional scanning latency relative to unmodified ClamAV and SS library storage, with relative storage increases including the shared REM model where applicable. 5) Experimental Setup: All experiments run on Windows 11 with an NVIDIA GeForce RTX 4080 SUPER GPU and an Intel Core i7-14700K CPU. We develop and evaluate SKS on ClamAV 1.3.1, whose open-source implementation and publicly available signature database facilitate inspection and validation, providing a reference implementation of knowledge protection for closed-source AV vendors. We freeze main.cvd, daily.cvd, and bytecode.cvd at versions 62, 27366, and 335, respectively. The importance model trains on blocks from AV-positive and AV-negative training files with file-level AV supervision for 10 epochs, retaining the checkpoint with the lowest validation loss. REM learns from reference blocks and views augmented with

7

TABLE II M EAN TOTAL PROBING QUERIES WITHOUT AND WITH RANDOM SCAN - GRID SHIFTS .

Setting

Without scan-grid shifts

With random scan-grid shifts

Method / Configuration

AVHunter

DefenderCheck

HDD

HDD+ProbDD

HDD+CDD

Average

Unprotected Exact SimHash [21] ssdeep [22] TLSH [23] LZJD [24] sdhash [25]

54.34 332.08 13,687.54 264.48 58.52 209.94 749.66

357.54 1,491.18 18,636.96 1,070.16 364.60 478.20 1,923.26

4,480.66 27,061.82 45,000.20 29,856.14 5,293.06 9,404.18 31,084.16

1,069.82 18,578.50 34,939.68 12,021.88 1,196.68 3,983.76 11,900.90

1,018.44 12,685.68 33,682.48 11,239.44 1,103.98 3,427.02 10,319.14

1,396.16 12,029.85 29,189.37 10,890.42 1,603.37 3,500.62 11,195.42

REM (τ = 0.95, Top3) REM (τ = 0.91, Top3) REM (τ = 0.90, Top7)

7,358.02 15,354.86 20,467.02

9,464.84 16,686.44 20,956.72

41,013.16 41,609.24 43,000.28

24,060.94 28,788.36 33,741.54

25,688.14 29,551.46 34,526.58

21,517.02 26,398.07 30,538.43

Unprotected Exact SimHash [21] ssdeep [22] TLSH [23] LZJD [24] sdhash [25]

54.34 332.08 2,038.76 98.62 57.66 121.82 675.24

357.54 1,491.18 2,884.10 514.06 364.30 396.00 1,560.72

4,480.66 27,061.82 15,589.48 16,250.48 5,737.64 6,185.20 29,587.42

1,069.82 18,578.50 7,751.56 3,296.30 1,297.70 2,593.82 8,133.20

1,018.44 12,685.68 7,630.48 3,714.30 1,199.16 2,267.64 7,174.08

1,396.16 12,029.85 7,178.88 4,774.75 1,731.29 2,312.90 9,426.13

REM (τ = 0.95, Top3) REM (τ = 0.91, Top3) REM (τ = 0.90, Top7)

6,798.10 14,802.56 19,816.10

8,665.48 15,982.94 20,355.00

40,111.84 41,770.28 43,000.28

22,630.34 28,426.94 33,254.96

24,336.68 29,616.06 33,474.68

20,508.49 26,119.76 29,980.20

Entries report mean total queries over the same 500 samples covered by all evaluated SS libraries before shifts. Each shifted sample uses a fixed random scan-grid offset of 1–1,024 bytes, shared across methods; file content is unchanged. Average is the arithmetic mean across five probing methods. Budget-reaching runs count as 50,000 queries. REM (τ = 0.95, Top3), REM (τ = 0.91, Top3), and REM (τ = 0.90, Top7) target additional FPR budgets of 0.05%, 0.10%, and 0.20%, respectively.

random context and byte perturbations, producing normalized 128-dimensional embeddings after 16 initial epochs and three 8-epoch continuation stages. We evaluate (τ, k) = (0.95, 3), (0.91, 3), and (0.90, 7) for target additional FPR budgets of 0.05%, 0.10%, and 0.20%, respectively, where τ is the similarity threshold and k caps accepted blocks per source sample before deduplication. We set the construction-round limit to R = k throughout the experiments. The three primary REM configurations share the same trained models, and SS libraries are frozen before probing evaluation. B. RQ1: Signature Protection Effectiveness We evaluate signature protection using five probing methods on 500 samples jointly covered by the SS libraries of all evaluated SKS matching configurations, ensuring that every configuration provides protective matches before scan-grid shifts. Each run is capped at 50,000 queries. Given the substantial runtime of probing under protection, we choose this sample size and query budget to complete the experiments within a manageable time frame, while allowing a query volume that we consider a substantial probing burden. Table II reports the mean total queries without and with scan-grid shifts, including runs that reach the budget. a) Protection without scan-grid shifts.: The upper part of Table II shows that REM provides the strongest overall protection: the (τ = 0.90, k = 7) configuration achieves the highest average query count and leads on three of the five probing methods. Non-learning matchers also provide protection, particularly SimHash, which achieves the highest

query counts against HDD and HDD+ProbDD. These results show that both learned and non-learning matching can increase probing costs when scanning alignment remains unchanged. b) Protection under scan-grid shifts.: Prior research studied functionality-preserving adversarial transformations against malware detectors, highlighting the importance of evaluating robustness to realizable input modifications [32]–[35]. An attacker aware of the matching algorithm may shift section data through header padding and corresponding PE headerfield updates while preserving functionality [36]. Minor offset differences may also occur across versions of the same sample. Such changes alter the alignment between file content and scanning windows, potentially weakening alignment-sensitive SS matching. To evaluate alignment sensitivity, SS windows start at a fixed random offset of 1–1,024 bytes per sample, shared across methods, with unchanged stride. Window-based SS matching skips the preceding prefix, while PS scanning receives the full input. This simulates section-relocationinduced alignment changes without modifying PE files. The lower part of Table II shows that REM’s advantage becomes more pronounced under shifts. Its strongest configuration leads against all five probing methods, whereas several non-learning matchers, especially SimHash and ssdeep, lose substantial protection. REM maintains protection more consistently across scanning alignments. All evaluations in RQ2–RQ4 use the same offset policy on their respective sample sets. c) Magnitude of protection.: Figure 3 summarizes query multipliers relative to unprotected detection. The strongest REM configuration increases average probing queries to 21.87× the baseline without shifts and 21.47× with shifts, with

8

With Random Scan-Grid Shifts

1.15 1.08

18.7

21.5

6.8

5.1

3.4

1.66 2.2

1.81 1.24 1.06

1

Ex ac t

sh 0. 95 /T op RE 3 M 0. 91 /T op RE 3 M 0. 90 /T op 7

JD

6.1

5

RE M

RE M

Si m H

sd ha

LZ

p

SH TL

ss de e

Si m H

as h

1

10

12.4 14.7

sh 0. 95 /T op RE 3 M 0. 91 /T op RE 3 M 0. 90 /T op 7

3.9 2.5

8.6

JD

4.9

37.5

50

sd ha

6.1

21.9

8.0

7.8

5

18.9

LZ

10

13.8 15.4

125.1

SH

20.9

8.6

364.7

100

p

50

AVHunter 272.4

TL

135.4

100

Average 500

ss de e

282.6

251.9

376.6

as h

AVHunter

Query multiplier (×, log scale)

Average 500

Ex ac t

Query multiplier (×, log scale)

Without Scan-Grid Shifts

Fig. 3. Probing-query multipliers relative to unprotected detection, without scan-grid shifts (left) and with random scan-grid shifts (right). Each method uses average total queries across five probing strategies and AVHunter separately. Larger values indicate higher probing costs. The vertical axis uses a logarithmic scale. TABLE III SS COVERAGE AND ADDITIONAL TEST FALSE - POSITIVE RATES OF REM AND NON - LEARNING MATCHING BASELINES .

Method / Configuration

Training SS Coverage (%)

Validation SS Coverage (%)

Test SS Coverage (%)

Additional Test FPR (%)

SimHash [21] ssdeep [22] TLSH [23] LZJD [24] sdhash [25]

98.52 88.11 29.36 41.95 85.44

5.54 5.30 3.94 1.60 6.11

1.83 1.22 0.51 0.63 1.13

0.1272 0.0254 0.0000 0.0000 0.0127

REM (τ = 0.95, Top3) REM (τ = 0.91, Top3) REM (τ = 0.90, Top7)

94.19 95.73 96.66

10.01 14.47 16.69

1.37 1.65 2.66

0.0254 0.0891 0.1909

SS coverage is the fraction of ClamAV-positive files matching any SS across the full dataset. Additional test FPR is the fraction of ClamAV-negative test files flagged by SS. Logical OR preserves original positive verdicts. All methods use identical splits and scanning-window policies with their respective frozen SS libraries and matching configurations.

corresponding AVHunter multipliers of 376.65× and 364.67×. Its mean query count decreases by only 1.83% under shifts, compared with 75.41% for SimHash (Table II). These results demonstrate a substantial and persistent increase in probing costs, although higher query consumption alone does not imply that signature extraction is prevented. Answer to RQ1. SKS substantially increases signatureprobing costs. Within the SKS framework, non-learning matchers provide some protection in non-adversarial settings where scanning alignment remains unchanged. REM achieves the strongest protection and maintains effectiveness under adversarial scan-grid shifts, providing stronger protection against probing.

C. RQ2: Detection Utility and Additional False Positives We evaluate whether SKS can protect known samples while limiting its impact on the original detector. Table III reports SS

coverage and additional false-positive rates. SKS aims to protect existing signature knowledge rather than extend detection to unknown malware. a) Protection of known samples.: REM achieves 94.19– 96.66% coverage on training positives, providing protective matches for most samples used in SS construction. SimHash also achieves high training coverage, at 98.52%. Coverage is lower on validation and test positives, but detecting unknown malware is not the objective of SS, and the original signature library may fail to detect such malware. b) Additional false positives on unseen samples.: A key requirement is that protective matching should minimize additional positive verdicts on negative samples unseen during model training and candidate filtering. The test partition originates from the latest 10% of timestamp-ordered samples within each label class. On 7,859 ClamAV-negative test files, the three REM configurations produce additional FPRs of only 0.0254%, 0.0891%, and 0.1909%, respectively, all below their corresponding target budgets. The strictest configuration covers 94.19% of training positives while introducing an additional

9

CPU (%, left axis)

(a) Queries

40 ×103

34.70

100 %

90

12.88

94.76

17.02

20 9.17

1.07 0.08

80

256 512 1024 2048

40 ×103

0

0.67

256 512 1024 2048

20 1

24.83

GPU (%, right axis)

(e) Coverage

(f) Overhead

100 %95.73 95.73

30.83

25.60 26.12

2

84.13

256 512 1024 2048

(d) Queries

29.57

96.70

14.67

0

CPU (%, left axis)

(c) Overhead 40

95.73

26.12

20

GPU (%, right axis)

(b) Coverage

95.73

26.26

94.76

90

40

33.25

20

2.20

0

80

32 64 128 256 512

20.40

0.36

87.03

0

17.02

0

32 64 128 256 512

0.67

32 64 128 256 512

Reference-block length (Bytes)

Scanning stride (Bytes)

(a)-(c): Vary reference-block length; fixed stride = 128 Bytes

(d)-(f): Vary scanning stride; fixed reference block = 1,024 Bytes

2 1 0

Fig. 4. Effects of reference-block length and scanning stride on probing cost, coverage, and overhead.

0.85

0.853

1.578

2.367

3.054

3.563

0.86

0.496

0.840

1.323

1.692

1.896

0.87

0.318

0.509

0.738

0.853

0.942

0.88

0.216

0.280

0.369

0.407

0.420

0.89

0.191

0.229

0.267

0.293

0.293

0.90

0.102

0.102

0.115

0.140

0.140

0.91

0.0891

0.0891

0.0891

0.115

0.115

0.92

0.0763

0.0763

0.0763

0.102

0.102

0.93

0.0763

0.0763

0.0763

0.102

0.102

0.94

0.0763

0.0763

0.0763

0.102

0.102

0.95

0.0254

0.0254

0.0254

0.0509

0.0509

Top2

Top3

Top4

Top5

Top1

Selected blocks per source

(b) Top-k extension: FPR budgets 0.250

τ = 0.90

τ = 0.91

0.225

Historical test FPR (%)

Similarity threshold τ

(a) Threshold sweep: historical test FPR (%)

0.20% budget

0.200 0.175 Top7: 0.1909% 0.150 0.125

0.10% budget

0.100 0.075

Top3: 0.0891% 1

2

3

4

5

6

7

8

9

10

Selected blocks per source (Top-k)

Fig. 5. Matching threshold and block-selection exploration. (a) Historical test FPR across thresholds and Top-k settings. (b) Extended Top-k comparisons at τ = 0.90 and 0.91. Highlighted configurations represent FPR budgets of 0.05%, 0.10%, and 0.20%.

test FPR of only 0.0254%. These results show that broad protection of known samples can coexist with a very low observed additional false-positive rate on temporally later ClamAV-negative samples. Since this partition also supports configuration exploration, the rates describe the explored partition rather than independent held-out validation. Answer to RQ2. SKS protects known samples while preserving the original detector’s positive verdicts. REM covers most SS construction samples while maintaining low observed additional false-positive rates on temporally later ClamAV-negative samples unseen during training.

the original level. Further increasing it to 2,048 bytes yields only a 32.85% query increase, while substantially increasing CPU scanning overhead and improving coverage by only 0.97 percentage points. We therefore choose 1,024-byte reference blocks and then examine scanning stride. Smaller strides increase CPU overhead without improving coverage, whereas larger strides reduce coverage. A 128-byte stride provides a favorable balance between protection, coverage, and scanning overhead, yielding a 1,152-byte scanning window.

2) Matching Threshold and Block Selection: The similarity threshold τ and the maximum number of accepted blocks per source sample k jointly control the trade-off between protection and additional false positives. Lowering τ or increasing k generally increases probing costs but may also introduce D. RQ3: Design Choices and Boundary Point Counts more false positives. We therefore select REM configurations We examine the choice of reference-block length and through a two-stage exploration. First, we explore thresholds scanning stride, the trade-off between matching configurations from 0.85 to 0.95 across different Top-k settings, identifying and additional false positives, the contribution of robustness (τ, k) = (0.95, 3) for the 0.05% additional FPR budget design to probing costs, and the number of distinct BPs (Figure 5(a)). This exploration also identifies τ = 0.90 and 0.91 as promising thresholds for balancing protection and false encountered during probing. 1) Reference-Block Length and Scanning Stride: Figure 4 positives. We then explore Top1–Top10 at these two thresholds, presents the measured trade-offs, with REM (τ = 0.91, selecting (τ, k) = (0.91, 3) and (0.90, 7) for the 0.10% and Top3; observed additional FPR < 0.1%) as the reference 0.20% budgets, respectively (Figure 5(b)). The exploration uses configuration. Increasing reference-block length from 512 to the same temporally later negative test partition reported in RQ2. 1,024 bytes raises probing queries to approximately 1.78× The three selected configurations yield observed additional

10

TABLE IV AVERAGE NUMBER OF DISTINCT BP S REPORTED WITHIN A 50,000- QUERY BUDGET.

Protection Method

AVHunter

DefenderCheck

HDD

HDD+ProbDD

HDD+CDD

Unprotected Exact SimHash [21] ssdeep [22] TLSH [23] LZJD [24] sdhash [25]

2.72 16.34 97.58 4.90 2.88 5.90 33.28

2.56 15.04 31.80 4.34 2.66 3.20 11.08

2.46 8.74 4.28 3.82 2.62 2.78 3.34

2.32 13.70 10.50 3.96 2.46 3.24 7.54

2.46 15.68 12.74 4.94 2.60 3.42 8.28

REM (τ = 0.95, Top3) REM (τ = 0.91, Top3) REM (τ = 0.90, Top7)

330.54 724.92 979.32

91.02 162.24 207.72

2.44 3.16 3.62

25.20 41.94 52.94

28.46 40.94 49.84

TABLE V ROBUSTNESS - DESIGN COMPARISON UNDER RANDOM SCAN - GRID SHIFTS .

Configuration

Model Variant

AVHunter

DefenderCheck

HDD

HDD+ProbDD

HDD+CDD

Average

REM (τ = 0.95, Top3)

Full design Without robustness

6,798.10 4,360.74

8,665.48 5,446.62

40,111.84 37,974.52

22,630.34 20,131.12

24,336.68 20,916.60

20,508.49 17,765.92

REM (τ = 0.91, Top3)

Full design Without robustness

14,802.56 9,442.38

15,982.94 10,720.34

41,770.28 42,428.80

28,426.94 27,858.90

29,616.06 28,645.10

26,119.76 23,819.10

REM (τ = 0.90, Top7)

Full design Without robustness

19,816.10 16,364.06

20,355.00 16,703.74

43,000.28 43,008.00

33,254.96 33,109.72

33,474.68 33,927.72

29,980.20 28,622.65

FPRs of 0.0254%, 0.0891%, and 0.1909%, all below their corresponding budgets on this partition. 3) Ablation of Robustness Design: Table V compares the full REM design with a variant that removes random-context and byte-perturbation training and skips incomplete tail windows, using the same 500 samples as RQ1 and fixed random scangrid shifts. The full design increases average probing queries by 15.44%, 9.66%, and 4.74% for (τ, k) = (0.95, 3), (0.91, 3), and (0.90, 7), respectively. Gains are most pronounced for AVHunter and DefenderCheck, whereas HDD-based methods show smaller or mixed differences. These results support retaining the combined robustness design. Since the variants use separately trained models and their frozen SS libraries, the comparison reflects overall configuration differences rather than the isolated effect of training augmentation.

Answer to RQ3. The configuration analysis supports our parameter choices. Matching thresholds and blockretention limits support configurations with different additional-FPR budgets. Robustness design consistently increases average probing costs across the three REM configurations. REM also substantially increases reported BP counts for most probing methods, supporting the use of auxiliary matching to complicate PS-related feedback.

E. RQ4: Runtime and Storage Overhead

We evaluate the scanning and storage overhead of SKS, focusing on how key design choices, including vector precision and block selection, affect SS library storage. 1) Scanning and Storage Overhead: Table VI reports the 4) Distinct Boundary Point Counts: Table IV reports the additional scanning latency and storage overhead of SKS. mean number of distinct BPs within the 50,000-query budget. REM uses a learned encoder and a vector-based SS library, Unprotected probing reports only 2.32–2.72 BPs, whereas REM introducing 16.44%–17.81% CPU overhead. Its SS libraries increases BP counts for four of the five methods. The (τ = and shared model add 7.92%–17.84% storage relative to the 0.90, k = 7) configuration reaches 979.32 BPs for AVHunter 223.91 MiB ClamAV signature database. Given its consistent and 207.72 for DefenderCheck, exceeding all non-learning protection across probing methods and alignment settings, baselines. We hypothesize that the numerous BPs generated by we consider this an acceptable trade-off. In GPU-equipped learned SS matching, whose relation to byte-pattern rules is environments, additional scanning overhead is only 0.67%– difficult to interpret, make PS recovery less likely. Even without 1.48%. For latency-sensitive CPU-only deployments, nonoverlapping SS regions, PS-related BPs may be difficult to learning methods remain alternatives. SimHash, for example, distinguish from SS-induced ones, complicating analysis of adds only 1.14% CPU overhead and 0.95% storage, although genuine signature knowledge. HDD requires many queries per its protection weakens under scan-grid shifts. BP, so fewer reported BPs do not imply ineffective protection. Figure 6 estimates cumulative serial probing time for 10,000 More BPs generally accompany higher probing costs, with samples by multiplying the mean query counts under scan-grid exceptions reflecting localization costs. shifts by the average ClamAV latency of 379.81 ms. Using

11

TABLE VI A DDITIONAL SCANNING LATENCY AND STORAGE OVERHEAD OF SKS RELATIVE TO UNMODIFIED C LAM AV.

Method / Configuration

Additional CPU Latency (ms)

CPU Overhead (%)

Additional GPU Latency (ms)

GPU Overhead (%)

SS Library Storage (MiB)

Storage Increase (%)

SimHash [21] ssdeep [22] TLSH [23] LZJD [24] sdhash [25]

4.32 4.23 4.05 8.16 32.60

1.14 1.11 1.07 2.15 8.58

8.53 — — — —

2.25 — — — —

2.13 4.93 4.91 130.27 9.22

0.95 2.20 2.19 58.18 4.12

REM (τ = 0.95, Top3) REM (τ = 0.91, Top3) REM (τ = 0.90, Top7)

62.45 64.65 67.64

16.44 17.02 17.81

5.62 2.54 2.80

1.48 0.67 0.74

17.60 17.60 39.81

7.92 7.92 17.84

Latency averages paired end-to-end measurements across the full dataset, excluding loading and file reads; overhead is normalized to the pooled 379.81 ms ClamAV baseline. Storage increases areEstimated relative to theSerial 223.91 MiB frozen Time ClamAVfor database. SS Samples storage includes matching representations and metadata, Probing 10,000 excluding raw blocks. REM uses FP16 storage and FP32 computation; its storage increase includes the 0.134 MiB shared model. Random scan-grid shifts

(a) Mean across five methods

(b) AVHunter

61.37

Unprotected

2.39

Unprotected 901.54

REM: τ = 0.95, Top3

1,148.21

REM: τ = 0.91, Top3

1,317.91

REM: τ = 0.90, Top7 0

500

298.84

REM: τ = 0.95, Top3

1,000

650.71

REM: τ = 0.91, Top3

871.11

REM: τ = 0.90, Top7

1,500

0

500

Estimated cumulative time (days)

1,000

1,500

Estimated cumulative time (days)

379.81 ms/query; additional SS latency excluded. Query-budget caps retained. Arithmetic projection, not measured attack time or time to guaranteed successful extraction. Fig. 6. Estimated serial probing time for 10,000 samples under random scan-grid shifts, comparing unprotected ClamAV with three REM configurations using mean queries across five probing methods and AVHunter alone.

TABLE VII E FFECT OF VECTOR PRECISION ON TRAINING COVERAGE , ADDITIONAL TEST FALSE POSITIVES , AND SS STORAGE .

REM Configuration

Vector Precision

Covered Training Positives

Training Coverage (%)

Additional Test FPR (%)

SS Library Storage (MiB)

REM (τ = 0.95, Top3)

FP32 FP16 FP8

65,436 65,436 65,385

94.1878 94.1878 94.1143

0.0254 0.0254 0.0254

34.65 17.60 8.93

REM (τ = 0.91, Top3)

FP32 FP16 FP8

66,508 66,508 66,503

95.7308 95.7308 95.7236

0.0891 0.0891 0.0891

34.65 17.60 8.93

REM (τ = 0.90, Top7)

FP32 FP16 FP8

67,151 67,151 67,150

96.6563 96.6563 96.6549

0.1909 0.1909 0.1909

78.40 39.81 20.21

Coverage is evaluated on 69,474 training positives, and additional FPR on 7,859 test negatives. Encoding and similarity computation use FP32 for all variants.

the mean across five methods, the estimate increases from 61.37 days without protection to 901.54–1,317.91 days with REM. Even for AVHunter, the most query-efficient evaluated method in these settings, it increases from 2.39 days to 298.84– 871.11 days. These estimates illustrate how modest detection overhead can accompany substantially higher probing costs, making large-scale extraction of AV knowledge more difficult under practical time and resource constraints.

and additional test FPR across all three REM configurations. FP8 further reduces storage by approximately 49% relative to FP16 and preserves the observed additional test FPR, but slightly decreases training coverage, with up to 51 fewer covered samples. We therefore use FP16 as the default storage format, substantially reducing storage without an observed loss in coverage or change in additional false positives.

3) Effect of Model-Based Block Selection: Figure 7 com2) Matching-Vector Precision: Table VII compares SS pares model-based selection with file-uniform random selection. vector storage precisions while keeping encoding and similarity All other construction, filtering, matching, and storage policies computation in FP32. FP16 reduces library storage by approx- remain identical. Importance-guided selection reduces SS imately 49% relative to FP32, with identical training coverage storage by 39.64%–56.09%, with only a 0.17–1.36 percentage-

12

−39.64%

75 50 25

65.95

−56.09%

40.08

17.60

−56.09%

40.08

39.81

17.60

0 τ = 0.95 Top3

τ = 0.91 Top3

τ = 0.90 Top7

File-uniform random

(b) Protective coverage 96.71

97 96

95.55

96.66 95.73

95 94

96.83

94.19

τ = 0.95 Top3

τ = 0.91 Top3

τ = 0.90 Top7

Additional test FPR (%)

(a) Storage

Training coverage (%)

SS library storage (MiB)

Model-based

(c) Additional false positives

0.2290

0.25 0.20

0.1400

0.15 0.10 0.05

0.0382 0.0254

0.1909

0.0891

0.00 τ = 0.95 Top3

τ = 0.91 Top3

τ = 0.90 Top7

Fig. 7. Effect of model-based and file-uniform random block selection on (a) SS library storage, (b) training-sample coverage, and (c) additional test false-positive rates. Percentages above the bars in (a) indicate storage reductions achieved by model-based selection.

point decrease in training coverage. This suggests that the Bi-Iocane further manipulates AV-sensitive bytes to corrupt model favors blocks shared across samples, enabling a smaller AV-generated labels and poison downstream ML detectors [6]. SS library to achieve comparable protective coverage. It also These studies motivate protecting detection knowledge against yields lower observed additional test FPRs across all three extraction, reuse, and exploitation. configurations. These results support our choice of importanceguided selection, which substantially reduces storage requirements with only a small coverage loss while limiting additional C. Approximate Matching and Knowledge Protection false positives. SimHash [21], ssdeep [22], TLSH [23], LZJD [24], and sdhash [25] use statistical features or compact digests to Answer to RQ4. SKS supports practical deployment with measure content similarity. Prior work emphasizes accuracy, different resource constraints. REM achieves low additional robustness, and efficiency, with limited attention to protecting scanning latency in GPU-equipped environments, while existing signatures. Filiol [8] resists black-box analysis through lightweight non-learning matchers offer alternatives for Boolean detection patterns and combinatorial, probabilistic deployments with stringent detection-efficiency requirescanning, requiring changes to detection patterns and scanning ments. FP16 storage preserves the observed coverage and logic. SKS preserves PS and their detection logic, integrating false-positive rates, and importance-guided block selection five tuned non-learning matchers as alternatives and baselines substantially reduces storage with only a small coverage for auxiliary protection. REM explores learned matching to loss while reducing additional false positives. increase probing costs while limiting additional false positives. V. R ELATED W ORK A. Signature-based Antivirus Detection Signature matching remains central to modern AV systems, while learning-based detection faces practical reliability challenges [1], [9]. Symantec, Trend Micro, and ESET retain signature and pattern matching [37]–[39]; Kaspersky, FortiSandbox, and Bitdefender support YARA [40]–[42]. ClamAV is integrated into Cisco Secure Endpoint on Linux, selected Barracuda appliances, and OPSWAT MetaDefender [43]–[45]. Its supported signatures include file and section hashes, wildcard byte patterns, logical signatures, and YARA rules [14]. These rules encode accumulated expertise, but localized matching can expose detection-relevant content through scanning feedback. B. Extraction and Exploitation of Antivirus Knowledge Hamlen et al. [2] investigate signature inference through AV interfaces, while Wressnegger et al. [3] extract approximate signatures to induce false positives. DefenderCheck and ThreatCheck locate detection-triggering bytes through input splitting [10], [46], with delta debugging and HDD providing related reduction strategies [11], [47]. Rigaki and Garcia [5] study surrogate-model extraction and evasion under low-falsepositive conditions. AVHunter [4] infers byte-level decisioncritical regions to reproduce AV behavior and guide evasion.

VI. D ISCUSSION A. Deployment Considerations and Adaptive Adversaries a) Why SS complement rather than replace PS: SS protect PS rather than improve detection generalization. The importance model uses file-level AV supervision, REM learns from reference blocks and augmented views, and filtering excludes candidates matching calibration negatives. SS thus inherit existing detection knowledge rather than independently validated knowledge of new threats. Their coverage concentrates on construction samples, whereas PS may detect other samples satisfying the same signature conditions. Replacing PS could therefore lose detections. SS matches may also fail while PS-related content remains intact, and do not inherently reproduce detection names or rule-specific conditions [14]. SKS therefore retains PS and uses SS for auxiliary protection. b) When to use non-learning matchers: SimHash offers a lightweight SKS alternative, adding only 1.14% CPU overhead and 0.95% storage, with 98.52% training coverage and an observed additional test FPR of 0.1272%, below the 0.20% budget. Although protection weakens under scan-grid shifts, it still substantially increases probing costs, supporting deployments requiring low overhead, broad known-sample coverage, and limited additional false positives.

13

c) Protection against informed adversaries: Adversaries may know the SKS design and matching procedure, but cannot directly access PS or SS libraries or modify scanner logic. Protection does not rely on algorithm secrecy, although informed adversaries may disrupt SS matches while preserving PS-related content. Scan-grid-shift experiments show stronger protection from REM than the evaluated non-learning alternatives, but other adaptive strategies require evaluation [48], [49]. Our ClamAV-based implementation provides an optional feature that prioritizes blocks containing PS-matching regions for Topk selection after negative-sample filtering, offering a possible strategy against adaptive attacks. We encourage researchers to build on this implementation to further investigate defenses against such attacks [35], [50]. B. Limitations and Future Work a) Scalability: Our evaluation covers 176,892 PE files, with latency measured across the full dataset. Larger sample collections may require larger SS libraries, increasing matching time and storage. Since REM represents SS as vectors, partitionbased indexing [51], graph-based approximate retrieval [52], and vector quantization [53]–[55] offer potential optimization directions. Approximate retrieval may miss SS matches and thereby alter protection effectiveness; future work must evaluate this trade-off to balance efficiency and protective coverage. b) Additional False Positives: Even low additional falsepositive rates remain a concern. Calibration and validation negatives may not adequately represent future inputs under distribution shifts [31], [56], [57]. Expanding their scale and diversity, particularly with newer samples, may improve generalization and enable stronger protection under the same false-positive budget. This benefit must be balanced against possible SS coverage losses from more extensive filtering. c) Protection Scope: SKS protects static detection signatures for Windows PE files, excluding dynamic behavioral monitoring and cloud-based analysis. Future work can extend the shielding principle to these mechanisms and to Android and Linux, adapting candidate selection and matching to their file structures and detection mechanisms. VII. C ONCLUSION We presented SKS, a design paradigm that protects existing antivirus signature knowledge through auxiliary SS matching. SKS combines AV-supervised block discovery, calibrated SS construction, and auxiliary matching to complicate signature probing while preserving original positive verdicts. Within this framework, we integrated five tuned non-learning matchers and introduced REM, a lightweight learned matcher trained with random context and byte perturbations. Evaluation of our open-source ClamAV-based prototype, which serves as a reference for knowledge protection in closed-source AV products, shows that SKS substantially increases probing costs while limiting additional false positives. REM provides stronger and more consistent protection under scan-grid shifts with low GPU scanning overhead, while non-learning alternatives support lightweight deployments. These results demonstrate the potential of auxiliary matching to protect existing detection

knowledge. Future work will investigate broader adaptive attacks and improve scalability while maintaining protective coverage and low additional false-positive rates. VIII. DATA AVAILABILITY We provide a ClamAV-based SKS reference implementation for protecting signature knowledge in closed-source AV products, with SS libraries for the three evaluated configurations, at https://anonymous.4open.science/r/SKS-CBF7/. The repository includes model checkpoints, experiment configurations, evaluation scripts, reproduction instructions, and SHA-256 manifests for the 176,892-file dataset and 500-sample probing cohort. Researchers may request samples by providing their affiliation and research purpose, subject to data-sharing restrictions. Upon acceptance, these artifacts will be publicly released under the same access policy, with samples available by request. R EFERENCES [1] M. Botacin, F. D. Domingues, F. Ceschin, R. Machnicki, M. A. Z. Alves, P. L. de Geus, and A. Grégio, “Antiviruses under the microscope: A hands-on perspective,” Computers & Security, vol. 112, p. 102500, 2022. [2] K. W. Hamlen, V. Mohan, M. M. Masud, L. Khan, and B. Thuraisingham, “Exploiting an antivirus interface,” Computer Standards & Interfaces, vol. 31, no. 6, pp. 1182–1189, 2009. [Online]. Available: https://doi.org/10.1016/j.csi.2009.04.004 [3] C. Wressnegger, K. Freeman, F. Yamaguchi, and K. Rieck, “Automatically inferring malware signatures for anti-virus assisted attacks,” in Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, ser. ASIA CCS ’17. Association for Computing Machinery, 2017, pp. 587–598. [Online]. Available: https://doi.org/10.1145/3052973.3053002 [4] J. Yang, Z. Wang, Y. Jia, Z. Wu, J. Tang, C. Su, J. Ye, J. Tian, and W. Li, “Breaking the black box: Byte-level boundary inference of real-world antivirus systems,” 2026. [Online]. Available: https://arxiv.org/abs/2609.31012 [5] M. Rigaki and S. Garcia, “Stealing and evading malware classifiers and antivirus at low false positive conditions,” Computers & Security, vol. 129, p. 103192, 2023. [6] J. Yang, Z. Wang, Y. Jia, Z. Wu, J. Tang, C. Su, J. Ye, J. Tian, and W. Li, “Weaponizing ground truth: Data poisoning attacks by exploiting boundary misalignment between antivirus software and learning-based detectors,” 2026. [Online]. Available: https://arxiv.org/abs/2609.31003 [7] A. Dziedzic, M. A. Kaleem, Y. S. Lu, and N. Papernot, “Increasing the cost of model extraction with calibrated proof of work,” in International Conference on Learning Representations, 2022. [Online]. Available: https://arxiv.org/abs/2201.09243 [8] E. Filiol, “Malware pattern scanning schemes secure against black-box analysis,” Journal in Computer Virology, vol. 2, no. 1, pp. 35–50, 2006. [Online]. Available: https://doi.org/10.1007/s11416-006-0009-x [9] L. Cavallaro, J. Kinder, F. Pendlebury, and F. Pierazzi, “Are machine learning models for malware detection ready for prime time?” IEEE Security & Privacy, vol. 21, no. 2, pp. 53–56, 2023. [10] matterpreter, “DefenderCheck,” https://github.com/matterpreter/Defender Check, public software repository. Accessed: 2026-09-06. [11] G. Misherghi and Z. Su, “HDD: Hierarchical delta debugging,” in Proceedings of the 28th International Conference on Software Engineering, 2006, pp. 142–151. [12] G. Wang, R. Shen, J. Chen, Y. Xiong, and L. Zhang, “Probabilistic delta debugging,” in Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. Association for Computing Machinery, 2021, pp. 881–892. [13] M. Zhang, Z. Xu, Y. Tian, X. Cheng, and C. Sun, “Toward a better understanding of probabilistic delta debugging,” in 2025 IEEE/ACM 47th International Conference on Software Engineering (ICSE). IEEE, 2025, pp. 2024–2035. [14] ClamAV, “Signatures,” https://docs.clamav.net/manual/Signatures.html, clamAV Documentation. Accessed: 2026-09-06.

14

[15] M.-A. Carbonneau, V. Cheplygina, E. Granger, and G. Gagnon, “Multiple instance learning: A survey of problem characteristics and applications,” Pattern Recognition, vol. 77, pp. 329–353, 2018. [16] M. Ilse, J. Tomczak, and M. Welling, “Attention-based deep multiple instance learning,” in Proceedings of the 35th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, vol. 80. PMLR, 2018, pp. 2127–2136. [Online]. Available: https://proceedings.mlr.press/v80/ilse18a.html [17] E. Raff, J. Barker, J. Sylvester, R. Brandon, B. Catanzaro, and C. Nicholas, “Malware detection by eating a whole EXE,” 2017. [Online]. Available: https://arxiv.org/abs/1710.09435 [18] E. Raff, W. Fleshman, R. Zak, H. S. Anderson, B. Filar, and M. McLean, “Classifying sequences of extreme length with constant memory applied to malware detection,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 35, no. 11, 2021, pp. 9386–9394. [Online]. Available: https://ojs.aaai.org/index.php/AAAI/article/view/17131 [19] J. Lee, Y. Lee, J. Kim, A. Kosiorek, S. Choi, and Y. W. Teh, “Set Transformer: A framework for attention-based permutationinvariant neural networks,” in Proceedings of the 36th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, vol. 97. PMLR, 2019, pp. 3744–3753. [Online]. Available: https://proceedings.mlr.press/v97/lee19d.html [20] T. Chen, S. Kornblith, M. Norouzi, and G. Hinton, “A simple framework for contrastive learning of visual representations,” in Proceedings of the 37th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, vol. 119. PMLR, 2020, pp. 1597–1607. [Online]. Available: https://proceedings.mlr.press/v119/chen20j.html [21] M. S. Charikar, “Similarity estimation techniques from rounding algorithms,” in Proceedings of the Thirty-Fourth Annual ACM Symposium on Theory of Computing. ACM, 2002, pp. 380–388. [22] J. Kornblum, “Identifying almost identical files using context triggered piecewise hashing,” Digital Investigation, vol. 3, no. Supplement, pp. 91–97, 2006. [23] J. Oliver, C. Cheng, and Y. Chen, “TLSH: A locality sensitive hash,” in 2013 Fourth Cybercrime and Trustworthy Computing Workshop. IEEE, 2013, pp. 7–13. [24] E. Raff and C. Nicholas, “Lempel-ziv jaccard distance, an effective alternative to Ssdeep and Sdhash,” Digital Investigation, 2018. [25] V. Roussev, “Data fingerprinting with similarity digests,” in Advances in Digital Forensics VI. Springer, 2010, pp. 207–226. [26] R. Harang and E. M. Rudd, “Sorel-20m: A large scale benchmark dataset for malicious pe detection,” arXiv preprint arXiv:2012.07634, 2020. [27] L. Yang, A. Ciptadi, I. Laziuk, A. Ahmadzadeh, and G. Wang, “Bodmas: An open dataset for learning based temporal analysis of pe malware,” in 2021 IEEE Security and Privacy Workshops (SPW). IEEE, 2021, pp. 78–84. [28] VirusShare, “VirusShare,” https://virusshare.com/, 2002–2026, accessed: 2026-06-29. [29] F. Pendlebury, F. Pierazzi, R. Jordaney, J. Kinder, and L. Cavallaro, “TESSERACT: Eliminating experimental bias in malware classification across space and time,” in 28th USENIX Security Symposium (USENIX Security 19). USENIX Association, 2019, pp. 729–746. [Online]. Available: https://www.usenix.org/conference/usenixsecurity19/presentat ion/pendlebury [30] D. Arp, E. Quiring, F. Pendlebury, A. Warnecke, F. Pierazzi, C. Wressnegger, L. Cavallaro, and K. Rieck, “Dos and don’ts of machine learning in computer security,” in 31st USENIX Security Symposium (USENIX Security 22). USENIX Association, 2022, pp. 3971–3988. [Online]. Available: https://www.usenix.org/conference/usen ixsecurity22/presentation/arp [31] Y. Chen, Z. Ding, and D. Wagner, “Continuous learning for android malware detection,” in 32nd USENIX Security Symposium (USENIX Security 23). USENIX Association, 2023, pp. 1127–1144. [Online]. Available: https://www.usenix.org/conference/usenixsecurity23/presentat ion/chen-yizheng [32] F. Pierazzi, F. Pendlebury, J. Cortellazzi, and L. Cavallaro, “Intriguing properties of adversarial ML attacks in the problem space,” in 2020 IEEE Symposium on Security and Privacy (SP). IEEE, 2020, pp. 1332–1349. [33] L. Demetrio, B. Biggio, G. Lagorio, F. Roli, and A. Armando, “Functionality-preserving black-box optimization of adversarial Windows malware,” IEEE Transactions on Information Forensics and Security, vol. 16, pp. 3469–3478, 2021. [34] K. Lucas, S. Pai, W. Lin, L. Bauer, M. K. Reiter, and M. Sharif, “Adversarial training for Raw-Binary malware classifiers,” in 32nd USENIX Security Symposium (USENIX Security 23). USENIX Association, 2023, pp. 1163–1180. [Online]. Available: https: //www.usenix.org/conference/usenixsecurity23/presentation/lucas

[35] S. He, C. Fu, H. Hu, J. Chen, J. Lv, and S. Jiang, “MalwareTotal: Multi-faceted and sequence-aware bypass tactics against static malware detection,” in Proceedings of the 46th IEEE/ACM International Conference on Software Engineering, ser. ICSE ’24. Association for Computing Machinery, 2024. [36] L. Demetrio, S. E. Coull, B. Biggio, G. Lagorio, A. Armando, and F. Roli, “Adversarial EXEmples: A survey and experimental evaluation of practical attacks on machine learning for Windows malware detection,” ACM Transactions on Privacy and Security, vol. 24, no. 4, 2021. [37] Broadcom, “Symantec Endpoint Security: Product brief,” https://docs.b roadcom.com/doc/endpoint-security-en, accessed: 2026-10-01. [38] Trend Micro, “Antivirus components,” https://docs.trendmicro.com/en-u s/documentation/article/trend-micro-apex-one-patch-6-online-help-ant ivirus-components, trend Micro Apex One Documentation. Accessed: 2026-10-01. [39] ESET, “ThreatSense,” https://help.eset.com/eea/13/en-US/idh_config_t hreat_sense.html, eSET Endpoint Antivirus 13 Online Help. Accessed: 2026-10-01. [40] Kaspersky, “YARA: Running YARA scan,” Kaspersky Endpoint Security for Windows 12.9 Documentation, accessed: 2026-09-28. [Online]. Available: https://support.kaspersky.com/help/KESWin/12.9/en-US/2959 46.htm [41] Fortinet, “YARA rules,” FortiSandbox 4.4.6 Administration Guide, accessed: 2026-09-28. [Online]. Available: https://docs.fortinet.com/docu ment/fortisandbox/4.4.6/administration-guide/690723/yara-rules [42] G. Nocoń, “Introducing YARA rules to enhance threat-hunting capabilities,” https://www.bitdefender.com/en-us/blog/businessinsights/introd ucing-yara-rules-to-enhance-threat-hunting-capabilities, Dec. 2024, bitdefender. Published December 19, 2024. Accessed: 2026-10-01. [43] Cisco, “Cisco Secure Endpoint Linux Primer,” Cisco Technical Documentation, accessed: 2026-09-28. [Online]. Available: https: //www.cisco.com/c/en/us/support/docs/security/amp-endpoints/21555 4-amp-for-endpoints-linux-primer.pdf [44] Barracuda Networks, “Barracuda’s Antivirus Technology,” White Paper, accessed: 2026-09-28. [Online]. Available: https://assets.barracuda.com/a ssets/docs/dms/Barracuda_Email_Security_Gateway_WP_Antivirus_T echnology_US.pdf [45] OPSWAT, “OPSWAT Introduces Max Package for MetaDefender Linux,” Sep. 2023, published September 7, 2023. Accessed: 2026-09-28. [Online]. Available: https://www.opswat.com/blog/opswat-introduces-m ax-package-for-metadefender-linux [46] rasta-mouse, “ThreatCheck,” https://github.com/rasta-mouse/ThreatChe ck, public software repository. Accessed: 2026-09-06. [47] A. Zeller and R. Hildebrandt, “Simplifying and isolating failure-inducing input,” IEEE Transactions on Software Engineering, vol. 28, no. 2, pp. 183–200, 2002. [Online]. Available: https://doi.org/10.1109/32.988498 [48] F. Tramèr, N. Carlini, W. Brendel, and A. Madry, “On adaptive attacks to adversarial example defenses,” in Advances in Neural Information Processing Systems, vol. 33. Curran Associates, Inc., 2020, pp. 1633– 1645. [Online]. Available: https://proceedings.neurips.cc/paper_files/pap er/2020/hash/11f38f8ecd71867b42433548d1078e38-Abstract.html [49] R. Feng, A. Hooda, N. Mangaokar, K. Fawaz, S. Jha, and A. Prakash, “Stateful defenses for machine learning models are not yet secure against black-box attacks,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. Association for Computing Machinery, 2023, pp. 786–800. [50] X. Ling, Z. Wu, B. Wang, W. Deng, J. Wu, S. Ji, T. Luo, and Y. Wu, “A wolf in sheep’s clothing: Practical black-box adversarial attacks for evading learning-based windows malware detection in the wild,” in 33rd USENIX Security Symposium (USENIX Security 24). USENIX Association, 2024, pp. 7393–7410. [Online]. Available: https://www.usenix.org/conference/usenixsecurity24/presentation/ling [51] Y. Xu, H. Liang, J. Li, S. Xu, Q. Chen, Q. Zhang, C. Li, Z. Yang, F. Yang, Y. Yang, P. Cheng, and M. Yang, “SPFresh: Incremental in-place update for billion-scale vector search,” in Proceedings of the 29th Symposium on Operating Systems Principles. Association for Computing Machinery, 2023, pp. 545–561. [52] H. Ootomo, A. Naruse, C. Nolet, R. Wang, T. Feher, and Y. Wang, “CAGRA: Highly parallel graph construction and approximate nearest neighbor search for GPUs,” in 2024 IEEE 40th International Conference on Data Engineering (ICDE). IEEE, 2024, pp. 4236–4247. [53] C. Aguerrebere, I. S. Bhati, M. Hildebrand, M. Tepper, and T. Willke, “Similarity search in the blink of an eye with compressed indices,” Proceedings of the VLDB Endowment, vol. 16, no. 11, pp. 3433–3446, 2023. [54] J. Gao and C. Long, “RaBitQ: Quantizing high-dimensional vectors with a theoretical error bound for approximate nearest neighbor search,”

15

Proceedings of the ACM on Management of Data, vol. 2, no. 3, pp. 1–27, 2024. [55] J. Gao, Y. Gou, Y. Xu, Y. Yang, C. Long, and R. C.-W. Wong, “Practical and asymptotically optimal quantization of high-dimensional vectors in euclidean space for approximate nearest neighbor search,” Proceedings of the ACM on Management of Data, vol. 3, no. 3, pp. 1–26, 2025. [56] L. Yang, W. Guo, Q. Hao, A. Ciptadi, A. Ahmadzadeh, X. Xing, and G. Wang, “CADE: Detecting and explaining concept drift samples for security applications,” in 30th USENIX Security Symposium (USENIX Security 21). USENIX Association, 2021, pp. 2327–2344. [Online]. Available: https://www.usenix.org/conference/usenixsecurity21/presentat ion/yang-limin [57] A. S. Li, A. Iyengar, A. Kundu, and E. Bertino, “Revisiting concept drift in windows malware detection: Adaptation to real drifted malware with minimal samples,” in Proceedings of the Network and Distributed System Security Symposium (NDSS). Internet Society, 2025.

Related documents

• Efficient signatures of knowledge and DAA in the standard model#326529
• Cutting the Fuse: Actionable APT Attack Blocking in Provenance-based IDS#1389094
• Trigger Value Selection in Clean-Label Malware Backdoors: An Effectiveness-Detectability Analysis#1356605
• Trigger Value Selection in Clean-Label Malware Backdoors: An Effectiveness-Detectability Analysis#1348781
• Athena: Vulnerability-Affected Library Identification via Knowledge Graph Completion#627605