Abstract
With the rise of malware evolution via polymorphism and obfuscation, it has become increasingly complex for traditional signature-based and heuristic defenses to detect malware. The use of machine learning (ML) is increasing for malware detection; however, several fundamental constraints of ML exist. The limitations of these frameworks include insufficient training data, as well as issues of class imbalance and concept drift. New types of malware are continually being created; therefore, this approach for generating artificial versions of malware using generative AI to increase the amount of data available for detectors, thereby enhancing their reliability. The methodology of creating synthetic versions of malware in this research is based on three different approaches to artificial version creation. The approaches are as follows: feature space GANs, code-aware sequence models, and methodologies that preserve semantics when mutating a given piece of code. The detector is trained on both real and synthetic data. The experiment was carried out on a controlled dataset of purely synthetic malware to ensure the participants' safety. As a result of our research, we found that including GAN-generated samples during model training enhanced the model's detection capabilities for rare/unknown malware variants compared to our baseline models. In addition, we evaluated how well our models could handle distributional changes (i.e., shifts in the data distribution) and provided some implications for their application in cyber-defense. Our design of this framework was intended to be safe for researchers and students to use as a scaffold for experimenting with generative techniques to enhance cybersecurity. Our experimental results demonstrate that generative AI can improve the effectiveness of malware defense mechanisms when properly bounded. Furthermore, the framework we developed provides an example of an approach to generate proactive representations of the evolving threat landscape.