Algorithm Explainability for Malware Evolution with Search Trajectory Networks

We present a preliminary study investigating the application of fitness landscape analysis to malware evolution. This type of analysis, though widely used in evolutionary computation, has been underutilised in understanding the optimization processes underlying malware adaptation. We examine two types of evolving malware: Android and Windows-based programs, and we analyse an existing evolutionary algorithm from the literature for each setting. To gain deeper insights into the algorithm behaviour we construct, visualise, and analyse search trajectory networks. Our findings suggest that the two considered algorithms are associated with markedly different fitness landscape structure. We notice from the results that current search operators may struggle to effectively navigate malware fitness landscapes. In particular, further consideration of the presence of neutrality and plateaus may be needed in this domain.