## 3 Materials and Methods
### Attack Methods
#### 3.2.1 White-Box Attack Methods  
White-box attack methods basically work as described in [5]. First, they generate an initial raw byte-level perturbation of Windows PE malware by applying practical PE format- and functionality-preserving manipulations (e.g., injecting bytes in eligible zones). Then, they represent the manipulated binary PE file in the input space of the attacked model. Concerning MalConv, this corresponds to applying the byte embedding transformation \(\Phi\colon\{0,\dots,256\}\mapsto\mathcal{E}\) with \(\mathcal{E}\subseteq\mathbb{R}^{8}\). \(\Phi\) denotes the one-to-one mapping between each 1-dimensional binary input (corresponding to each byte in the initial 1 Mb sequence of the PE file) and its 8-dimensional real embedding in the MalConv input space. Notably, the input space of \(\Phi(\cdot)\) includes the value 256 that is used to generate a padded embedding value whenever the embedding representation of a binary PE file with size smaller than 1 Mb must be padded to fit the fixed size of the embedding input dimension of the MalConv neural network. Subsequently, the embeddings of the manipulated input sample are iteratively perturbed to minimise the loss function. This is done by applying gradient-based update operations. Finally, the output sample produced in the embedding space is reconstructed through an inverse transformation, \(\Phi^{-1}\colon\mathbb{R}^{8}\mapsto\{0,\dots,255\}\), from the 8-dimensional embedding space into the input 1-dimensional byte space. \(\Phi^{-1}\) works by accounting for the embedding of one-to-one mapping, \(\Phi\). Let \(\mathbf{z_{i}}\) be the \(i\)-th 8-dimensional vector of an output sample produced in the embedding space. Let \(\mathbf{z^{\prime}_{i}}=\underset{\mathbf{z^{\prime}_{i}}\in\mathcal{E}}{ \arg\min}\,||\mathbf{z^{\prime}_{i}}-\mathbf{z_{i}}||\) be the embedding vector value that is identified in the co-domain of the transformation \(\Phi\), as the closest to \(\mathbf{z_{i}}\). The inverse reconstruction, \(\Phi^{-1}(\mathbf{z_{i}})=x^{\prime}_{i}\), is recovered so that \(\Phi(x^{\prime}_{i})=\mathbf{z^{\prime}_{i}}\). The attack methods considered in this study, namely Extend, Full DOS, Shift and FGSM padding+slack, follow the attack schema described above, but they differ in the adopted manipulations. Extend.This white-box attack method [5] creates a new area within the binary file by increasing the size of the DOS header. It uses the new area in the DOS header to add noise bytes. According to [5], this byte injection is done by keeping the functionality of the executable file. Specifically, the method operates in four steps. First, it determines how many bytes must be injected into the DOS header. Then, it identifies the PE header offset of the added area to record the injected bytes. Subsequently, it applies all the requested changes to make the new file compliant with the PE format constraints. For example, it increases the offset to the PE header, the size of the header field and the section entries. Finally, it applies the perturbation to the bytes that can be modified in the DOS header to create the adversarial payload. Full DOS.This white-box attack method [5] applies noise to the bytes in the DOS header. It is based on the fact that the DOS header is still kept in Windows PE files to make these files still compatible with the older operating systems. In fact, the DOS header may be changed by keeping the functionality of the executable file except for the magic number \"MZ\" and the four-byte-long integer at offset \"0 \(\times\) 3c\". In particular, the magic number identifies the file uniquely, while the four-byte-long integer at offset \"0 \(\times\) 3c\" points to the starting point of the PE header in the binary code. Both cannot be changed in order to obtain an executable file. Hence, this attack method perturbs the bytes that are placed in the DOS header in the areas before the magic number and after the pointer to the PE header.