Linux ELF Malware Generator Evades ML Detection With Semantic-Preserving Changes

Researchers from Czech Technical University developed a generator that uses semantic-preserving transformations and a simplified genetic algorithm to modify ELF binaries without breaking functionality, successfully bypassing the MalConv ML malware detector with a 67.74% evasion rate. The study identifies twelve modification types (e.g., adding sections, altering padding, appending benign files, modifying .strtab) and shows that injecting benign strings and symbols significantly reduces classifier confidence, revealing a structural weakness in ML-based Linux malware detection.