## 2 Background
### Adversarial Attacks and Defences  
Regarding adversarial attacks, the authors of [31] reported that different types of adversaries can compromise the effectiveness of machine learning-based decision systems by taking advantage of vulnerabilities that may affect machine learning models. They also provided definitions of different attacks. Specifically, they reported that _\"The evasion attacks are the most common type of attacks to machine learning models, with malicious inputs that are craftly modified to force the model to make a false prediction and evade detection\"_. In addition, they clarified that _\"The poisoning attacks differ from the evasion attacks because the inputs are modified during training as the model is trained on contaminated inputs to obtain the desired output\"_. Several recent surveys [7; 32; 33; 34] have extensively reviewed the literature related to adversarial attacks on imagery, text and tabular data. The authors of [35] analysed the recent state-of-the-art of research on poisoning attacks against machine learning models. The authors of [36] described a taxonomy of cybersecurity applications and reviewed methods of generating adversarial examples and suitable defences in multiple cybersecurity applications. Focusing on the Windows PE malware detection problems, the authors of [5; 8] reviewed the state-of-the-art literature on adversarial attacks against Windows PE malware detection. On the other hand, the authors of [37] surveyed the defence strategies against adversarial attacks also in PE malware detection. In particular, the adversarial training strategy is one of the mainstream adversarial defences in image analysis. Recent studies [38; 39] have explored how the use of the adversarial training strategy can improve the effectiveness of the Windows PE malware detection models that can be trained with machine learning methods. In particular, the authors of [40] have recently described one of the first studies exploring the performance of adversarial training done with realistic, white-box, adversarial PE malware produced with [14] attacking a MalConv model. In this study, we extend the analysis of the performance of the adversarial training strategy to five realistic attack methods. Finally, the authors of [41] investigated several types of adversarial example attacks on the Android system. The produced adversarial samples are Android malware applications that have been changed by keeping their malicious characteristics and capabilities. This study explores the effect of adversarial example attacks on malware detection systems. In [21], the authors studied the use of the adversarial training strategy, coupled with ensemble learning on Android applications. However, this study considers adversarial samples produced with general-purpose attack methods (e.g., FGSM or PGD) that perturb the handcrafted features of the input space of the machine learning model in place of the raw binaries. Hence, the adversarial samples generated in these studies to perform the adversarial training strategy are unrealistic files, as they may not preserve the executable format with malicious behaviour. The authors of [42] explored the performance of a two-level machine learning model that combines an Ensemble Learning method and a Stacked Generalization method. They show that the proposed model is able to accurately detect recent Android malware. However, this study did not explore the case of adversarial files \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Dataset** & **Malware** & **Goodware** & **Collection Time** & **Binary File Availability** \\ \hline EMBER & 400,000 & 400,000 & 2017–2018 & No \\ \hline SoReL & 9,919,251 & 9,470,626 & 2017–2019 & Malware \\ \hline BODMAS & 57,293 & 77,142 & 2019–2020 & Malware \\ \hline DasMalwerk & 104 & 0 & 2018 & Malware \\ \hline PEMML & 114,737 & 86,812 & Before 2018 & Goodware and malware \\ \hline MAL-API-2019 & 7107 & 0 & 2019 & No \\ \hline AVAST-CTU & 48,976 & 0 & 2017–2019 & No \\ \hline \hline \end{tabular}
\end{table}