  Adversarial EXEmples are carefully-perturbed programs tailored to evade
machine learning Windows malware detectors, with an on-going effort in
developing robust models able to address detection effectiveness. However, even
if robust models can prevent the majority of EXEmples, to maintain predictive
power over time, models are fine-tuned to newer threats, leading either to
partial updates or time-consuming retraining from scratch. Thus, even if the
robustness against attacks is higher, the new models might suffer a regression
in performance by misclassifying threats that were previously correctly
detected. For these reasons, we study the trade-off between accuracy and
regression when updating Windows malware detectors, by proposing EXE-scanner, a
plugin that can be chained to existing detectors to promptly stop EXEmples
without causing regression. We empirically show that previously-proposed
hardening techniques suffer a regression of accuracy when updating non-robust
models. On the contrary, we show that EXE-scanner exhibits comparable
performance to robust models without regression of accuracy, and we show how to
properly chain it after the base classifier to obtain the best performance
without the need of costly retraining. To foster reproducibility, we openly
release source code, along with the dataset of adversarial EXEmples based on
state-of-the-art perturbation algorithms.
