What question did this study set out to answer?

The study aims to outline how AI integration enhances malware effectiveness and propose defense mechanisms against it.

May 4, 2026Open Access

AI-in-the-Loop Malware: A Capability-Architecture Reference Map and Defender's Counter-Architecture

Key Points

The study aims to outline how AI integration enhances malware effectiveness and propose defense mechanisms against it.
Developed a five-stage reference architecture for malware lifecycle with citations.
Simulated a 100-host network to evaluate AI-augmented malware infections.
Conducted a cost-Pareto analysis of detector pairs comparing performance.
AI-augmented malware infects 3.9-6.5x more hosts than traditional malware.
LotL (Living off the Land) attacks are more effectively defended by signature detectors than behavioral ones.
Two-detector pairs outperform three-detector ensembles in terms of cost and effectiveness.

Abstract

AI integration across the malware lifecycle (recon, payload generation, C2, persistence, post-exec) is an observable not hypothetical threat. We construct a five-stage reference architecture, document per-stage capability uplift with research citations, and provide a 100-host network simulation showing AI-augmented malware infects 3.9-6.5x more hosts than traditional. Multi-posture sweep (zero-day/LotL/adaptive x signature/behavioral/cross-stage detector) reveals defender-preference inversion by attacker posture: LotL is best-defended by signature, not behavioral. Cost-Pareto analysis shows 2-detector pairs dominate the 3-detector ensemble. This paper is part of the AIACW (AI-Autonomous Cyber Weapons) ResearchProgramme, Wave 2 (papers P10-P20). Wave 1 (P1-P9) was deposited atpeer-review venues 2026-Q2 (NDSS, ACM CCS, IEEE S&P, USENIX Security,Oxford J. of Cybersecurity, ACM Computing Surveys). Wave 2 establishesthe empirical interior. P19 (cross-paper integration test) and P20(methodology meta-paper) provide programme-level validation anddocumentation.

Connected Papers

Building similarity graph...

Analyzing shared references across papers

Discussion

Authors

Hangyu Mei

Actions

References and Citations

Connected Papers

Building similarity graph...

Analyzing shared references across papers

AI-in-the-Loop Malware: A Capability-Architecture Reference Map and Defender's Counter-Architecture

Key Points

Abstract

Citation Network

Connected Papers

Discussion

Authors

Actions

References and Citations

Citation Network

Connected Papers

Discussion

Cite this study

Also consider