Testing malware and defence solutions

How do I go about testing endpoint protection solutions?

I want to set up a virtual instance where I attack these best-of-breed solutions using malware to see prevention rates. I am doing this as part of my dissertation and thought this would be the best place to ask. Kali linux comes to mind but not sure how to effectively test it, what malware to use and how do I even test AI-based endpoint solutions?

cybersecurity defence malware solutions testing