## 2 Materials and Methods
### Adversarial Attacks
#### 2.3.3 Preserving Functionality  
Many studies have focused on generating adversarial examples without preserving the malicious files and modifying the PE files [10; 15; 17; 19; 20; 21; 22]. To move forward with the practical approach, we clarify the attack formalization below.  
```
1:Input x, y, F(.), \(\epsilon\)
2:\(x\gets x^{*}\)
3:\(\delta=\frac{1}{2}(tanh(w)+1)-x\)
4:while\(F(x^{*})\
eq y\) and \(argmin\)\((D(x,x+\delta))\)do
5:\(min_{w}|\frac{1}{2}(tanh(w)+1)|_{2}^{2}+c.f(\frac{1}{2}(tanh(w)+1))\)
6:\(f(x^{*})=max(max_{g}(Z(x^{*})_{i})-Z(x_{y^{*}},-k)\),
7:if\(w_{max}\leq 0\)then
8:return Failure
9:endif
10:\(\delta=\epsilon.\frac{1}{2}(tanh(w)+1)-x\)
11:\(x^{*}\gets x+\delta\)
12:endwhile
13:return\(x^{*}\)
```  
**Algorithm 2** Crafting adversarial examples for malware detection with the C&W approach  
A model attempts to classify input \(x\) into one of the dataset labels. The inputs are then passed through a feature extractor, where the attack is carried out. The feature extractor is denoted by the function \(\phi:X\to Z\), where \(Z\) is a feature space denoted by \(Z\subseteq\mathbb{R}^{d}\). This requires the manipulation of the PE without compromising its functionality. In this paper, we denote these manipulations as \(h:Z\times\mathcal{T}\to X\), which causes a return to the functioning program with a different representation. Due to the non-differentiable embedding layer of our models, the attack is applied inside the feature space. Our approach for generating executable adversarial examples consists of three steps.  
1. **Determining the indexes of allowed bytes that can be freely modified without affecting the PE functionality**. These indexes must be cautiously determined due to the byte dependencies and the PE semantics. To achieve this, we identified two areas for modification: 1. The padding bytes of the embedding space are perturbed, and then the perturbation is injected into a PE zone that is not used by the program and has no effect on its functionality. A wide variety of features in the DOS header can be modified without affecting the PE file. A modification to the DOS header requires that neither the MZ magic number nor the value at offset 0x3c is modified. Altering these two fields in the DOS header results in in inexe-cutable programs. 2. The padding bytes in the embedding space are perturbed, and the perturbation is appended to the end of the PE file. The perturbation is injected into a none executable section of the program, generating an executable program.
2. **Performing the C&W and JSMA attacks on the list of indexed bytes generated from the previous step.** The attacks are performed inside the feature space \(Z\subseteq\mathbb{R}^{d}\). We refer to our attacks as \(JSMA_{Header}\), \(JSMA_{Section}\), \(C\&W_{Header}\), and \(C\&W_{Section}\) in this paper.
3. **Mapping back the modified values to the byte value.** To verify the functionality of the adversarial example, we used VirusTotal sandboxes ([[https://www.virrustotal.com/](https://www.virrustotal.com/)]([https://www.virrustotal.com/](https://www.virrustotal.com/)) (accessed on 1 January 2023)). VirusTotal was used to analyze the original \((x)\) and adversarial malware samples \((x^{*})\) and compare their detection scores. Moreover, we verified the executability of the adversarial samples by successfully running them with VirusTotal.