## 1 Introduction  
As Internet technologies have grown and improved, malicious activities and threats have also increased, and consequently, defensive approaches are facing increasing challenges. One of the advantages of deep learning (DL) approaches is the ability to automatically extract features from raw data such as malware binary files, which helps in building byte-based malware classification models. Despite the success of DL in several fields, recent studies have proven that adversarial examples are effective against DL models [1, 2, 3, 4, 5, 6]. For instance, by using X-Adv, [PERSON] et al. created physically printable metals capable of deceiving X-ray detectors when placed inside luggage [7] and [PERSON] et al. proposed a novel structured-light attack against structured-light-based 3D face recognition [8]. Moreover, when adversarial examples are attacked, this can also compromise the stability and reliability of cyber-physical systems (CPS), causing malfunctions or failures in critical systems or operations. Furthermore, according to [9], small perturbations added to any waveform can attack voice recognition systems. In the literature, many approaches have been developed to generate adversarial examples (\(x^{*}\)), such as fast gradient sign method (FGSM), L-BFGS, Carlini and Wagner (C&W), and Jacobian-based saliency map attack (JSMA). These studies open the door to investigating the effectiveness of adversarial attacks against malware classifiers by considering domain-specific characteristics in the malware domain. For instance, binary adversarial examples were generated for Android [10], and portable executable (PE) [11, 12, 13, 14]. Because of the semantic structure of PE and the independence of bytes introducing another factor in generating crafted samples, few empirical studies have successfully generated executable PE adversarial examples as shown in Table 1. Most adversarial attacks against malware detection systems have been exclusively carried out through continuous features such as pixels in malware images. Meanwhile, perturbing different types of features (e.g., API, string, URL) in cybersecurity has varying difficulty levels. For instance, perturbing pixels have the same difficulty level, as the binary itself is not modified, only its intensity. These attacks on malware images cannot preserve malware functionality. Therefore, attackers need effective adversarial attack techniques to perturb malware samples while preserving the PE binary file functionalities. To perturb malware files, an attacker must apply practical manipulations on the input x without breaking the binary files' semantics. We denoted practical manipulations by a \(h:Z\times\mathcal{T}\to X\), which is the output, which is an executable program without losing its malicious functionality. Here, \(x\in X\) is an input program and a vector \(\tau\in\mathbb{T}\), indicating the function \(h\)'s parameters. As a result, we determine how likely the adversarial example \(x^{*}\) is classified to the target label \(y^{*}\) from a labeled space \(Y=\{0,1,2,\ldots n\}\) where \(Z\subseteq\mathbb{R}^{d}\) represents the feature space. The function \(f:Z\to\mathbb{R}\) is used for prediction. This function provides a probability of the input sample being classified as malware family \(y^{*}\). However, previous studies have primarily concentrated on the FGSM approach, although FGSM is a random starter attack that modifies a large portion of input features [11; 12; 15]. To design robust models, several practical countermeasures have been proposed, including training [1], distillation [16], and feature squeezing [17]. However, to date, none of these countermeasures can be treated as a one-stop solution. Due to the nonlinear nature of DL models, it is difficult to prove these countermeasures theoretically. Moreover, these proposed countermeasures are not adaptive to all types of attacks that use adversarial examples (\(x^{*}\)). Each mechanism has shown various impacts on different attack types.