In Progress · 2026
Adaptive Malware Evolution Framework for EDR/XDR Resilience Evaluation
An adaptive malware framework where a persistent implant on an EDR-protected host exfiltrates telemetry to a C2 server, which replicates the target environment in VMs running the same EDR to serve as a black-box optimization oracle. A hybrid approach combining memetic algorithms for behavioral strategy search and GNN-based CFG mutation for structural variation evolves command execution sequences that evade detection, converging within the window between EDR content updates. The core contribution is demonstrating that malware can autonomously discover and exploit blind spots in ML-based behavioral detection through closed-loop optimization — formally defining the behavioral mutation space, characterizing the sim-to-real transfer gap between lab VMs and live targets, measuring re-evolution cost after EDR updates, and evaluating cross-vendor transferability to determine whether evasion variants exploit fundamental weaknesses in behavioral ML or product-specific gaps.
↳ Targeting SCI-indexed journals & IEEE S&P / USENIX Security