## 3 Results
### Attacks and Defense Mechanisms  
This section evaluates the performance of JSMA and C&W attacks using the evasion rate. As described in Section 2.3.3, this paper presents two experimental manipulationapproaches that preserve functionality, namely a partially perturbed PE header and a new section of perturbations. The evasion rate measures how many samples evaded the classifier after adversarial examples were previously correctly classified as malicious, as given in Equation (10). \[\textit{Evasion Rate}=\frac{TP_{adv}}{TP} \tag{10}\]  
where \(TP_{adv}\) is the number of \(TP\) samples correctly classified as target labels (\(y^{*}\)). Table 3 shows the evasion rates for adversarial examples generated by JSMA and C&W attacks. An adversarial example generated by \(JSMA_{Header}\) successfully evaded the CNN model with a 63.9% evasion rate while evading the RNN model with a rate of 37.5%. In a \(JSMA_{Section}\) attack, the CNN was evaded with a rate of 49.6%, while the RNN was evaded with a rate of 32.2%. The C&W method had a higher evasion rate than the JSMA method when applied to both CNNs and RNNs. Furthermore, C&W performed better against the CNN rather than the RNN. With the C&\(W_{Header}\) attack, CNN and RNN detection was evaded with rates of 91.06% and 84.60%, respectively, while with the C&\(W_{Section}\) attack, they were evaded with rates of 80.21% and 60.30%, respectively. It can be seen that C&W was less affected by the complexity of the model structure, compared to JSMA, specifically against RNN. Moreover, in C&W attacks, the evasion rate and distortion were found to be oppositely correlated. As distortion increased, the evasion rate decreased. Thus, the size of perturbed headers resulted in a higher evasion rate than the perturbed section. As shown in Table 3, based on our results for both attacks, we demonstrated that the header approach outperformed the section approach against the CNN and the RNN. In this paper, defense mechanisms against adversarial attacks are examined and analyzed. In this section, we examine the ability of these defense mechanisms to strengthen the resistance of DL models to a variety of adversarial attacks compared to other studies [10; 15; 20]. Therefore, we applied two types of mechanisms in response to both attacks, namely training and distillation. Evasion rates before and after defense mechanisms were applied against JSMA and C&W and are shown in Figures 4 and 5. A training defense mechanism reduced the evasion rate of \(JSMA_{Header}\) attacks against the CNN to 1.47%. In the case of \(JSMA_{Section}\) attacks, the training defense reduced the evasion rate to 16.7%. As a result of a distillation defense, the evasion rate of \(JSMA_{Header}\) attacks that evaded CNN detection was reduced to 26.48%, while the evasion rate of \(JSMA_{Section}\) attacks was reduced to 22.41%. As seen from Figure 4, the training defense reported significantly higher effectiveness than distillation against our white-box attacks. In the case of \(JSMA_{Header}\) attacks against the RNN, training defenses reduced the evasion rate to 5.03%. The training defense was able to reduce the evasion rate to 16.7% against the \(JSMA_{Section}\) attacks that evaded the RNN. In a distillation defense mechanism, \(JSMA_{Header}\) attacks against RNN were defended with an 11.3% evasion rate, while \(JSMA_{Section}\) attacks were defended with a 13.34% evasion rate. The training defense mechanism performed better against the \(JSMA_{Section}\) attack than the \(JSMA_{Header}\) attack in both the CNN and RNN models. A distillation defense performed better on the CNN than on the RNN model when defending against the JSMA. Furthermore, the distillation defense performed better against \(JSMA_{Section}\) attacks than against \(JSMA_{Header}\) attacks.