This post is also available in:
עברית (Hebrew)
Cybersecurity tools are typically tested against known malicious files and behaviors, but real attackers rarely leave their code unchanged. Malware can be rewritten or reorganized while preserving the same underlying function, potentially making previously reliable detection rules less effective. The challenge for defenders is therefore not simply recognizing one malicious program, but identifying its many possible variations.
Researchers at Carnegie Mellon University Africa are using genetic algorithms to test how well endpoint security systems handle that problem. Rather than manually creating individual variants, their approach automatically transforms software over successive generations and measures whether security tools continue recognizing its behavior.
Genetic algorithms borrow their basic logic from biological evolution. A computer generates multiple versions of a program, evaluates them according to predefined criteria, selects useful transformations and produces another generation. Repeating this process allows researchers to explore large numbers of functionally similar programs without redesigning each one by hand.
The team’s initial experiments focused on reverse shells in controlled laboratory environments. A reverse shell establishes a connection outward from a compromised machine, allowing remote command execution after access has been obtained. Because the target initiates the connection, this behavior can sometimes bypass network restrictions intended to block unsolicited incoming connections.
The researchers generated transformed versions of these test samples and measured differences in how endpoint defenses detected them. The objective was not to develop operational malware, but to determine whether changing the structure of software while retaining its function could expose weaknesses in detection systems.
According to TechXplore, the work subsequently expanded into a framework called TransForge, covering six execution categories across different programming languages and computing environments. Testing included other security-relevant behaviors such as keylogging, allowing researchers to examine whether the same problem extends beyond one particular type of code.
The project is now moving toward a substantially larger dataset of approximately 10,000 software variants. Such a collection could provide a standardized way to benchmark endpoint-security products against continuously changing code rather than a limited collection of static samples.
The research has clear implications for defense, government and critical infrastructure. These organizations depend on endpoint detection to protect workstations and servers containing sensitive information, while sophisticated adversaries routinely modify malicious code to avoid established signatures. Testing defenses against automatically evolving variants could reveal weaknesses before attackers exploit them.
The broader lesson is that detecting today’s malware is not enough. Security systems also need to recognize tomorrow’s version of the same threat, even when its code looks different. By using evolutionary computing to create that variation in a controlled environment, defenders can test whether their protections are genuinely robust rather than simply familiar with existing samples.
