Linux ELF Malware Generator Evades ML Detection Using Semantic-Preserving Changes

Researchers developed an ELF malware generator that uses semantic-preserving transformations (12 transformation types, 7 data sources) and a genetic-algorithm-based selection process to modify Linux binaries without changing behavior. Tested against the MalConv ML detector, the modified samples evaded detection 67.74% of the time and reduced model confidence by ~0.50, with benign-looking strings (notably .strtab modifications) proving especially effective at misleading the model; the study recommends moving beyond static string features toward behavioral and context-aware detection.