KUBO: a framework for automated efficacy testing of anti-virus behavioral detection with procedure-based malware emulation
Jakub Pružinec, Quynh Anh Mai Nguyen, Adrian Baldwin, Jonathan Griffin, Yang Liu · 2022
Traditional testing of Anti-Virus (AV) products is usually performed on a curated set of malware samples. While this approach can evaluate an AV's overall performance on known threats, it fails to provide details on the coverage of exact attack techniques used by adversaries and malware. Such coverage information is crucial in helping users understand potential attack paths formed using new code and combinations of known attack techniques.