الملخص
Existing approaches for understanding the detection logic of real-world antivirus (AV) software infer only binary malware/benign decisions from black-box queries, providing limited insight into the fine-grained decision-critical regions that govern AV detection. In this paper, we present \textbf{AVHunter}, the first framework for inferring byte-level decision-critical regions of real-world AV products under a black-box threat model. AVHunter constructs the first large-scale Byte-Level AV Boundary Dataset (BABD) by systematically probing 11 real-world AV products, revealing that modern AV detections are largely associated with a small number of compact decision-critical byte regions. Leveraging BABD, AVHunter trains AV-specific models that not only reproduce binary AV decisions, but also localize the decision-critical byte regions underlying these decisions, achieving an average boundary prediction recall of 85.07% while maintaining 97.43% detection agreement with the target AVs. We further validate that the predicted regions capture genuine AV decision knowledge through boundary-guided malware evasion, false-positive induction on benign executables, and a seven-month longitudinal study demonstrating that the inferred regions remain largely stable as AV products evolve. Overall, AVHunter moves beyond conventional binary-label AV modeling by enabling fine-grained boundary-region localization and revealing a new form of AV knowledge leakage with important implications for malware analysis, AV security, and boundary-aware defenses.
الكلمات المفتاحية
الموضوع
بيانات النشر
- المجلة
- غير متاح
- وصول مفتوح
- وصول مفتوح أخضر
اقتبس هذه المقالة
APA 7
Yang, J., Wang, Z., Jia, Y., Wu, Z., Tang, J., Su, C., Ye, J., Tian, J., & Li, W. (2026). Breaking the Black Box: Byte-Level Boundary Inference of Real-World Antivirus Systems. https://omanscience.com/ar/articles/breaking-the-black-box-byte-level-boundary-inference-of-real-world-antivirus-systems
MLA 9
Yang, Jieshuai, et al. "Breaking the Black Box: Byte-Level Boundary Inference of Real-World Antivirus Systems." https://omanscience.com/ar/articles/breaking-the-black-box-byte-level-boundary-inference-of-real-world-antivirus-systems.
شيكاغو (المؤلف–التاريخ)
Yang, Jieshuai, Zhi Wang, Yan Jia, Zhenhua Wu, Jianfei Tang, Chenbin Su, Jingwei Ye, Jianwen Tian, and Wanpeng Li. 2026. "Breaking the Black Box: Byte-Level Boundary Inference of Real-World Antivirus Systems." https://omanscience.com/ar/articles/breaking-the-black-box-byte-level-boundary-inference-of-real-world-antivirus-systems.
هارفارد
Yang, J., Wang, Z., Jia, Y., Wu, Z., Tang, J., Su, C., Ye, J., Tian, J. and Li, W. (2026) 'Breaking the Black Box: Byte-Level Boundary Inference of Real-World Antivirus Systems', Available at: https://omanscience.com/ar/articles/breaking-the-black-box-byte-level-boundary-inference-of-real-world-antivirus-systems.
فانكوفر
Yang J, Wang Z, Jia Y, Wu Z, Tang J, Su C, et al. Breaking the Black Box: Byte-Level Boundary Inference of Real-World Antivirus Systems. https://omanscience.com/ar/articles/breaking-the-black-box-byte-level-boundary-inference-of-real-world-antivirus-systems
IEEE
J. Yang, Z. Wang, Y. Jia, Z. Wu, J. Tang, C. Su, J. Ye, J. Tian, and W. Li, "Breaking the Black Box: Byte-Level Boundary Inference of Real-World Antivirus Systems," https://omanscience.com/ar/articles/breaking-the-black-box-byte-level-boundary-inference-of-real-world-antivirus-systems.