crAVe

crAVe is a framework developed at NECSTLab to automatically test and explore the capabilities of generic AV engines. And it's been developed in order to fuel further research, easing the development of scripts to manipulate malware, submit them to scanners (i.e., VirusTotal) and retrieve, and analyze results.

Running crAVe

While crAVe still lacks proper documentation you can find examples of usage in the examples directory. With craverun.py you can reproduce the results we presented at DIMVA 2018.

Research that makes use of crAVe

Toward Systematically Exploring Antivirus Engines (short paper)
Davide Quarta, Federico Salvioni, Andrea Continella, Stefano Zanero.
In Proceedings of the Conference on Detection of Intrusions and Malware and Vulnerability Assessment (DIMVA), June 2018

@inproceedings{quarta2018toward,
  title={Toward Systematically Exploring Antivirus Engines},
  author={Quarta, Davide and Salvioni, Federico and Continella, Andrea and Zanero, Stefano},
  booktitle={International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment},
  pages={393--403},
  year={2018},
  organization={Springer}
}