Genetic Engines
Co-Evolutionary Malware Mutation & Adaptive Defense
6th-Semester Capstone, PES University
Most malware-detection research treats generation and detection as separate, static problems: samples are generated once, a model is trained once against that fixed set, and the reported accuracy holds only as long as the threat doesn't move. Real attackers and defenders don't hold still for each other. This project asked what happens when both sides are allowed to adapt — a genetic engine mutating malware against a defense engine mutating its own detection thresholds in response, across generations, instead of a single static snapshot of either.
- 01Co-evolutionary system pairing a Genetic Payload Mutation Engine (GPME) against a Genetic Defense Mutation Engine (GDME) — malware variants and detection thresholds evolve against each other across generations.
- 02Trained and evaluated against 967 benign and 931 malware PE binaries (DikeDataset) spanning ransomware, rogue security software, and banking trojan families, selected for behavioral diversity.
- 03Feature extraction into a 25-element numeric vector (entropy, section structure, import patterns) feeding a deterministic, family-agnostic detection engine — no hardcoded per-family logic.
- 04Population generation and mutation pipeline for GPME, with profile-driven mutation constraints per malware family.
Building GPME and GDME to run against each other — instead of training a detector once against a fixed sample set — is what made detection robustness legible: which features and thresholds hold up under adversarial pressure, and how much of a 'good' detection rate is really just a property of the threat staying still. It's a research and simulation system evaluated against DikeDataset, not a deployed AV engine — no live malware execution, no claim on catching a real-world adversary, just a testbed for how robustness holds up when the generator is allowed to fight back.