<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-05079220</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-15T21:37:51+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Certifiably Robust Malware Detectors by Design</title>
            <author role="aut">
              <persName>
                <forename type="first">Pierre-François</forename>
                <surname>Gimenez</surname>
              </persName>
              <email type="md5">c905aef7ff3945357bec6c527910600d</email>
              <email type="domain">inria.fr</email>
              <ptr type="url" target="https://pfgimenez.fr"/>
              <idno type="idhal" notation="string">pierre-francois-gimenez</idno>
              <idno type="idhal" notation="numeric">737626</idno>
              <idno type="halauthorid" notation="string">33466-737626</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-4238-4423</idno>
              <idno type="IDREF">https://www.idref.fr/236351400</idno>
              <idno type="GOOGLE SCHOLAR">https://scholar.google.fr/citations?user=2DDHCTkAAAAJ</idno>
              <affiliation ref="#struct-1199950"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Sarath</forename>
                <surname>Sivaprasad</surname>
              </persName>
              <email type="md5">8cbf13fc61bcbc93c2793348d3499d9e</email>
              <email type="domain">cispa.de</email>
              <idno type="idhal" notation="numeric">1544205</idno>
              <idno type="halauthorid" notation="string">3539017-1544205</idno>
              <affiliation ref="#struct-573058"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Mario</forename>
                <surname>Fritz</surname>
              </persName>
              <email type="md5">f84fe0851969281f1894600d8e1b9791</email>
              <email type="domain">cispa.de</email>
              <idno type="idhal" notation="numeric">1544206</idno>
              <idno type="halauthorid" notation="string">517301-1544206</idno>
              <affiliation ref="#struct-573058"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Pierre-François</forename>
                <surname>Gimenez</surname>
              </persName>
              <email type="md5">c905aef7ff3945357bec6c527910600d</email>
              <email type="domain">inria.fr</email>
            </editor>
            <funder ref="#projanr-69632"/>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2025-05-22 11:10:39</date>
              <date type="whenModified">2026-02-04 03:19:19</date>
              <date type="whenReleased">2025-05-22 19:18:08</date>
              <date type="whenProduced">2025-05-21</date>
              <date type="whenEndEmbargoed">2025-05-22</date>
              <ref type="file" target="https://hal.science/hal-05079220v1/document">
                <date notBefore="2025-05-22"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-05079220v1/file/main.pdf" id="file-5079220-4394571">
                <date notBefore="2025-05-22"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="435528">
                <persName>
                  <forename>Pierre-François</forename>
                  <surname>Gimenez</surname>
                </persName>
                <email type="md5">c905aef7ff3945357bec6c527910600d</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-05079220</idno>
            <idno type="halUri">https://hal.science/hal-05079220</idno>
            <idno type="halBibtex">gimenez:hal-05079220</idno>
            <idno type="halRefHtml">&lt;i&gt;SEC 2025 - 40th IFIP TC-11 International Information Security and Privacy Conference&lt;/i&gt;, May 2025, Maribor, Slovenia. pp.125-139, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-031-92886-4_9"&gt;&amp;#x27E8;10.1007/978-3-031-92886-4_9&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">SEC 2025 - 40th IFIP TC-11 International Information Security and Privacy Conference, May 2025, Maribor, Slovenia. pp.125-139, &amp;#x27E8;10.1007/978-3-031-92886-4_9&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-5079220-4394571"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="UNIV-RENNES1">Université de Rennes 1</idno>
            <idno type="stamp" n="CNRS">CNRS - Centre national de la recherche scientifique</idno>
            <idno type="stamp" n="INRIA">INRIA - Institut National de Recherche en Informatique et en Automatique</idno>
            <idno type="stamp" n="UNIV-UBS">Université de Bretagne Sud</idno>
            <idno type="stamp" n="INSA-RENNES">Institut National des Sciences Appliquées de Rennes</idno>
            <idno type="stamp" n="INRIA-RENNES">INRIA Rennes - Bretagne Atlantique</idno>
            <idno type="stamp" n="IRISA">Irisa</idno>
            <idno type="stamp" n="IRISA_SET">IRISA_SET</idno>
            <idno type="stamp" n="INRIA_TEST">INRIA - Institut National de Recherche en Informatique et en Automatique</idno>
            <idno type="stamp" n="TESTALAIN1">TESTALAIN1</idno>
            <idno type="stamp" n="CENTRALESUPELEC">Ecole CentraleSupélec</idno>
            <idno type="stamp" n="INRIA2">INRIA 2</idno>
            <idno type="stamp" n="UR1-HAL">Publications labos UR1 dans HAL-Rennes 1</idno>
            <idno type="stamp" n="UR1-MATH-STIC">UR1 - publications Maths-STIC</idno>
            <idno type="stamp" n="UR1-UFR-ISTIC">UFR ISTIC Informatique et électronique</idno>
            <idno type="stamp" n="TEST-UR-CSS">TEST Université de Rennes CSS</idno>
            <idno type="stamp" n="UNIV-RENNES">Université de Rennes</idno>
            <idno type="stamp" n="INRIA-RENGRE">INRIA-RENGRE</idno>
            <idno type="stamp" n="ANR">ANR</idno>
            <idno type="stamp" n="UR1-MATH-NUM">Pôle UnivRennes - Mathématiques - Numérique </idno>
            <idno type="stamp" n="HUB-IA">Hub Intelligence Artificielle de CentraleSupélec</idno>
            <idno type="stamp" n="INRIA-ALLEMAGNE">INRIA-ALLEMAGNE</idno>
            <idno type="stamp" n="CYBERSCURITE">PEPR Cybersécurité</idno>
            <idno type="stamp" n="DEFMAL">DEFMAL</idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Certifiably Robust Malware Detectors by Design</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Pierre-François</forename>
                    <surname>Gimenez</surname>
                  </persName>
                  <email type="md5">c905aef7ff3945357bec6c527910600d</email>
                  <email type="domain">inria.fr</email>
                  <ptr type="url" target="https://pfgimenez.fr"/>
                  <idno type="idhal" notation="string">pierre-francois-gimenez</idno>
                  <idno type="idhal" notation="numeric">737626</idno>
                  <idno type="halauthorid" notation="string">33466-737626</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-4238-4423</idno>
                  <idno type="IDREF">https://www.idref.fr/236351400</idno>
                  <idno type="GOOGLE SCHOLAR">https://scholar.google.fr/citations?user=2DDHCTkAAAAJ</idno>
                  <affiliation ref="#struct-1199950"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Sarath</forename>
                    <surname>Sivaprasad</surname>
                  </persName>
                  <email type="md5">8cbf13fc61bcbc93c2793348d3499d9e</email>
                  <email type="domain">cispa.de</email>
                  <idno type="idhal" notation="numeric">1544205</idno>
                  <idno type="halauthorid" notation="string">3539017-1544205</idno>
                  <affiliation ref="#struct-573058"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Mario</forename>
                    <surname>Fritz</surname>
                  </persName>
                  <email type="md5">f84fe0851969281f1894600d8e1b9791</email>
                  <email type="domain">cispa.de</email>
                  <idno type="idhal" notation="numeric">1544206</idno>
                  <idno type="halauthorid" notation="string">517301-1544206</idno>
                  <affiliation ref="#struct-573058"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">IFIP Advances in Information and Communication Technology</title>
                <meeting>
                  <title>SEC 2025 - 40th IFIP TC-11 International Information Security and Privacy Conference</title>
                  <date type="start">2025-05-21</date>
                  <date type="end">2025-05-23</date>
                  <settlement>Maribor</settlement>
                  <country key="SI">Slovenia</country>
                </meeting>
                <imprint>
                  <publisher>Springer Nature Switzerland</publisher>
                  <pubPlace>Cham</pubPlace>
                  <biblScope unit="serie">IFIP Advances in Information and Communication Technology</biblScope>
                  <biblScope unit="volume">746</biblScope>
                  <biblScope unit="pp">125-139</biblScope>
                  <date type="datePub">2025-05-16</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-031-92886-4_9</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">malware analysis</term>
                <term xml:lang="en">adversarial example</term>
              </keywords>
              <classCode scheme="halDomain" n="info.info-cr">Computer Science [cs]/Cryptography and Security [cs.CR]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Malware analysis involves analyzing suspicious software to detect malicious payloads. Static malware analysis, which does not require software execution, relies increasingly on machine learning techniques to achieve scalability. Although such techniques obtain very high detection accuracy, they can be easily evaded with adversarial examples where a few modifications of the sample can dupe the detector without modifying the behavior of the software. Unlike other domains, such as computer vision, creating an adversarial example of malware without altering its functionality requires specific transformations. We propose a new model architecture for certifiably robust malware detection by design. In addition, we show that every robust detector can be decomposed into a specific structure, which can be applied to learn empirically robust malware detectors, even on fragile features. Our framework ERDALT is based on this structure. We compare and validate these approaches with machine-learning-based malware detection methods, allowing for robust detection with limited reduction of detection performance.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="researchteam" xml:id="struct-1199950" status="VALID">
          <idno type="RNSR">202424530N</idno>
          <idno type="ROR">https://ror.org/04abbt041</idno>
          <orgName>Protection de l’information et résistances aux attaques</orgName>
          <orgName type="acronym">PIRAT</orgName>
          <date type="start">2024-03-01</date>
          <date type="end">2028-02-29</date>
          <desc>
            <address>
              <addrLine>Centre Inria de l'Université de RennesCampus de Beaulieu263 Av. Général Leclerc35042 Rennes</addrLine>
              <country key="FR"/>
            </address>
          </desc>
          <listRelation>
            <relation active="#struct-411575" type="direct"/>
            <relation active="#struct-419153" type="direct"/>
            <relation active="#struct-300009" type="indirect"/>
            <relation active="#struct-490900" type="direct"/>
            <relation active="#struct-490899" type="indirect"/>
            <relation active="#struct-105160" type="indirect"/>
            <relation active="#struct-117606" type="indirect"/>
            <relation active="#struct-301232" type="indirect"/>
            <relation active="#struct-172265" type="indirect"/>
            <relation active="#struct-247362" type="indirect"/>
            <relation name="UMR6074" active="#struct-441569" type="indirect"/>
            <relation active="#struct-481355" type="indirect"/>
            <relation active="#struct-302102" type="indirect"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-573058" status="VALID">
          <idno type="ROR">https://ror.org/02njgxr09</idno>
          <orgName>Helmholtz Center for Information Security [Saarbrücken]</orgName>
          <orgName type="acronym">CISPA</orgName>
          <desc>
            <address>
              <addrLine>Stuhlsatzenhaus 566123 Saarbrücken</addrLine>
              <country key="DE"/>
            </address>
            <ref type="url">https://cispa.saarland/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-411575" status="VALID">
          <idno type="IdRef">184443237</idno>
          <idno type="ROR">https://ror.org/019tcpt25</idno>
          <orgName>CentraleSupélec</orgName>
          <desc>
            <address>
              <addrLine>3, rue Joliot Curie,Plateau de Moulon,91192 GIF-SUR-YVETTE Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.centralesupelec.fr</ref>
          </desc>
        </org>
        <org type="laboratory" xml:id="struct-419153" status="VALID">
          <idno type="RNSR">198018249C</idno>
          <idno type="ROR">https://ror.org/04040yw90</idno>
          <orgName>Centre Inria de l'Université de Rennes</orgName>
          <desc>
            <address>
              <addrLine>Campus de beaulieu35042 Rennes cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.inria.fr/centre/rennes</ref>
          </desc>
          <listRelation>
            <relation active="#struct-300009" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-300009" status="VALID">
          <idno type="ROR">https://ror.org/02kvxyf05</idno>
          <orgName>Institut National de Recherche en Informatique et en Automatique</orgName>
          <orgName type="acronym">Inria</orgName>
          <desc>
            <address>
              <addrLine>Domaine de VoluceauRocquencourt - BP 10578153 Le Chesnay Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.inria.fr/en/</ref>
          </desc>
        </org>
        <org type="department" xml:id="struct-490900" status="VALID">
          <orgName>SYSTÈMES LARGE ÉCHELLE</orgName>
          <orgName type="acronym">IRISA-D1</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.irisa.fr/fr/departements/d1-systemes-large-echelle</ref>
          </desc>
          <listRelation>
            <relation active="#struct-490899" type="direct"/>
            <relation active="#struct-105160" type="indirect"/>
            <relation active="#struct-117606" type="indirect"/>
            <relation active="#struct-301232" type="indirect"/>
            <relation active="#struct-172265" type="indirect"/>
            <relation active="#struct-247362" type="indirect"/>
            <relation active="#struct-300009" type="indirect"/>
            <relation active="#struct-411575" type="indirect"/>
            <relation name="UMR6074" active="#struct-441569" type="indirect"/>
            <relation active="#struct-481355" type="indirect"/>
            <relation active="#struct-302102" type="indirect"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-490899" status="VALID">
          <idno type="IdRef">026386909</idno>
          <idno type="ISNI">0000 0001 2298 7270</idno>
          <idno type="RNSR">200012163A</idno>
          <idno type="ROR">https://ror.org/00myn0z94</idno>
          <orgName>Institut de Recherche en Informatique et Systèmes Aléatoires</orgName>
          <orgName type="acronym">IRISA</orgName>
          <date type="start">2017-01-01</date>
          <desc>
            <address>
              <addrLine>Avenue du général LeclercCampus de Beaulieu 35042 RENNES CEDEX</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.irisa.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-105160" type="direct"/>
            <relation active="#struct-117606" type="direct"/>
            <relation active="#struct-301232" type="indirect"/>
            <relation active="#struct-172265" type="direct"/>
            <relation active="#struct-247362" type="direct"/>
            <relation active="#struct-300009" type="direct"/>
            <relation active="#struct-411575" type="direct"/>
            <relation name="UMR6074" active="#struct-441569" type="direct"/>
            <relation active="#struct-481355" type="direct"/>
            <relation active="#struct-302102" type="indirect"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-105160" status="VALID">
          <idno type="IdRef">26693823X</idno>
          <idno type="ROR">https://ror.org/015m7wh34</idno>
          <orgName>Université de Rennes</orgName>
          <orgName type="acronym">UR</orgName>
          <desc>
            <address>
              <addrLine>Campus de Beaulieu, 263 avenue Général Leclerc, CS 74205, 35042 RENNES CEDEX</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.univ-rennes.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-117606" status="VALID">
          <idno type="ROR">https://ror.org/04xaa4j22</idno>
          <orgName>Institut National des Sciences Appliquées - Rennes</orgName>
          <orgName type="acronym">INSA Rennes</orgName>
          <desc>
            <address>
              <addrLine>20, avenue des Buttes de Coësmes - CS 70839 - 35708 Rennes cedex 7</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.insa-rennes.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-301232" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-301232" status="VALID">
          <idno type="IdRef">162105150</idno>
          <orgName>Institut National des Sciences Appliquées</orgName>
          <orgName type="acronym">INSA</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
          </desc>
        </org>
        <org type="institution" xml:id="struct-172265" status="VALID">
          <idno type="IdRef">05017746X</idno>
          <idno type="ISNI">0000000121680285</idno>
          <idno type="ROR">https://ror.org/04ed7fw48</idno>
          <orgName>Université de Bretagne Sud</orgName>
          <orgName type="acronym">UBS</orgName>
          <date type="start">1995-02-07</date>
          <desc>
            <address>
              <addrLine>BP 92116 - 56321 Lorient cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.univ-ubs.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-247362" status="VALID">
          <idno type="ROR">https://ror.org/03rxtdc22</idno>
          <orgName>École normale supérieure - Rennes</orgName>
          <orgName type="acronym">ENS Rennes</orgName>
          <desc>
            <address>
              <addrLine>Campus de Ker Lann - avenue Robert Schuman - 35170 Bruz</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.ens-rennes.fr</ref>
          </desc>
        </org>
        <org type="regroupinstitution" xml:id="struct-441569" status="VALID">
          <idno type="IdRef">02636817X</idno>
          <idno type="ISNI">0000000122597504</idno>
          <idno type="ROR">https://ror.org/02feahw73</idno>
          <orgName>Centre National de la Recherche Scientifique</orgName>
          <orgName type="acronym">CNRS</orgName>
          <date type="start">1939-10-19</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.cnrs.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-481355" status="VALID">
          <idno type="IdRef">202743233</idno>
          <idno type="ROR">https://ror.org/030hj3061</idno>
          <orgName>IMT Atlantique</orgName>
          <orgName type="acronym">IMT Atlantique</orgName>
          <date type="start">2017-01-01</date>
          <desc>
            <address>
              <addrLine>Campus Brest : Technopôle Brest-Iroise CS 8381829238 BREST Cedex 3 -Campus Nantes : 4, rue Alfred Kastler- La chantrerie 44300 NANTES -Campus Rennes :  2 Rue de la Châtaigneraie, 35510 CESSON SEVIGNE</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.imt-atlantique.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-302102" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-302102" status="VALID">
          <idno type="IdRef">192427156</idno>
          <idno type="ISNI">000000012202567X</idno>
          <idno type="ROR">https://ror.org/025vp2923</idno>
          <idno type="Wikidata">Q27962533</idno>
          <orgName>Institut Mines-Télécom [Paris]</orgName>
          <orgName type="acronym">IMT</orgName>
          <date type="start">2012-03-01</date>
          <desc>
            <address>
              <addrLine>19 Place Marguerite Perey, 91120 Palaiseau</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.imt.fr/</ref>
          </desc>
        </org>
      </listOrg>
      <listOrg type="projects">
        <org type="anrProject" xml:id="projanr-69632" status="VALID">
          <idno type="anr">ANR-22-PECY-0007</idno>
          <orgName>Defmal</orgName>
          <desc>Defense against malware</desc>
          <date type="start">2022</date>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>