PhantomCall: Evading ML Malware Detectors via Function Call Graph Perturbation

2026-09-01

AI Summary

PhantomCall通过在恶意软件中注入虚拟函数来改变其函数调用图，从而避开基于图的恶意软件检测器。该方法在多种分类器上均表现出高成功率和快速生成对抗样本的能力。

Abstract

Prior adversarial attacks on Windows PE malware detectors target raw bytes, PE headers, or intra-function control-flow graphs, leaving the function call graph (FCG) unexplored as an attack surface. Yet the FCG structure is an important feature in graph-based malware detectors. We present Phan- tomCall, a black-box attack that perturbs the FCG of Windows PE malware by injecting fully executable dummy functions at targeted call sites, adding new nodes and edges to both the CFG and FCG while preserving program semantics. We pair this structural perturbation with classifier-guided search and tunable injection parameters, effective across three archi- tecturally distinct classifiers. Evaluated on a 2025-collected Windows malware corpus against MalConv (raw-byte CNN), MalGraph (graph-based GNN), and SAFE+GNN (pure FCG GNN trained from scratch on a 2024 corpus) at two FPR thresholds, the best PhantomCall variant achieves 85-100% attack success rate across all configurations, exceeding prior state-of-the-art by up to 14.78 percentage points on MalGraph and 95.5 percentage points on SAFE+GNN, and generating evasive variants up to 2.9x faster on average across all targets. For MalConv and MalGraph, the majority of evasions require only a single call site modification, and 86-97% of evaluated evasive variants preserve the original malicious behavior in sandbox-based semantic testing across all configurations.

Problem

• Function Call Graph
• Malware Detection
• Adversarial Attacks
• PhantomCall

Innovation

• function call graph perturbation
• black-box attack
• classifier-guided search
• executable dummy functions
• program semantics preservation