Combination of General-Purpose and Attack-Specific Detectors against Adversarial Malware

In this paper, we propose a two-stage detection method for detecting malware and adversarial malware. In the first stage, we use a general-purpose detector that targets several types of adversarial malware to determine whether the input data are malware. In the second stage, we use attack-specific detectors to detect malware that was determined to be benign in the first stage. The second-stage detector is composed of multiple detectors. We train each detector using data generated by a specific adversarial malware generation method. Through experiments on the Android malware dataset, we demonstrated that our proposed method improved accuracy compared with existing methods.