Whetstones: מדידת תפתחות תקופתית בין תוכנה נגוחה והגנה התנהגותית

תקציר מקורי באנגליתarXiv:2608.00745v3 Announce Type: replace Abstract: The literature on self-adapting malware is open-loop: adaptation is evaluated against static detectors in simulators, with fitness computed by experimenters. This report closes the loop. We built both sides of the adaptive-malware confrontation and the selection loop between them, measuring four generations of engagement under pre-registered protocols. On the red side, a trained adaptive adversary completes reconnaissance-persistence-exfiltration task chains with zero detections under four concurrent commercial stacks (Microsoft Defender RTP, Falco, Wazuh 4.9.2, Suricata 8.0.3, 52,151 ET Open rules). On the blue side, a behavioral-grammar detector -- a 0.88M Transformer prior over an 8-token event grammar fused with four further detection