MalGEN: A Testbed for Modeling and Evaluating Malware Behaviors
For cybersecurity researchers and practitioners, MalGEN provides a systematic tool to evaluate detection systems against novel and evolving attack behaviors, highlighting weaknesses in current defenses.
MalGEN is a modular testbed that generates diverse, multi-stage malware behaviors to stress-test detection systems. Evaluation across 1,920 settings produced 977 executable samples, with 45.71% undetected by existing engines, revealing gaps in current defenses.
Modern cybersecurity requires systematic ways to evaluate how detection systems respond to evolving and previously unseen attack behaviors. Existing malware repositories largely capture known patterns and provide limited support for stress-testing defenses against novel threats. To address this, we present MalGEN, a modular testbed that models adversarial workflows and generates executable artifacts in a controlled environment. The framework decomposes high-level attack objectives into structured stages, enabling the synthesis of diverse and multi-stage behaviors. We evaluate MalGEN across 1,920 benchmark settings covering multiple platforms and behavioral objectives, resulting in 977 executable samples. Analysis shows that the generated artifacts exhibit a wide range of malicious techniques and multi-stage attack patterns. However, 45.71% of these samples remain undetected by existing detection engines, which reveals notable gaps in current defenses. These findings provide practical insights into the limitations of widely used detection approaches and support the development of more robust security evaluation and testing practices.