  As a result of decades of research, Windows malware detection is approached
through a plethora of techniques. However, there is an ongoing mismatch between
academia -- which pursues an optimal performances in terms of detection rate
and low false alarms -- and the requirements of real-world scenarios. In
particular, academia focuses on combining static and dynamic analysis within a
single or ensemble of models, falling into several pitfalls like (i) firing
dynamic analysis without considering the computational burden it requires; (ii)
discarding impossible-to-analyse samples; and (iii) analysing robustness
against adversarial attacks without considering that malware detectors are
complemented with more non-machine-learning components. Thus, in this paper we
propose SLIFER, a novel Windows malware detection pipeline sequentially
leveraging both static and dynamic analysis, interrupting computations as soon
as one module triggers an alarm, requiring dynamic analysis only when needed.
Contrary to the state of the art, we investigate how to deal with samples
resistance to analysis, showing how much they impact performances, concluding
that it is better to flag them as legitimate to not drastically increase false
alarms. Lastly, we perform a robustness evaluation of SLIFER leveraging
content-injections attacks, and we show that, counter-intuitively, attacks are
blocked more by YARA rules than dynamic analysis due to byte artifacts created
while optimizing the adversarial strategy.
