A Comparative Evaluation of Malware Families and Machine-Learning Detection Techniques, and an Optimized Stacked-Ensemble Model for Predicting Software Maliciousness
Aug 2026· International journal of computer information systems and industrial management applications· 0 citations
TL;DR
An efficient stacked-ensemble model that estimates how likely a given executable is to be malicious and is compared against recent malware research/types are compared and identified for future research work/area.
Abstract
Malware is growing fast in volume, variety, and sophistication, and traditional signature-based defences can no longer keep up. This has driven a shift toward machine-learning (ML) based detection. This paper has two main goals. First, it compares the major malware families - viruses, worms, trojans, ransomware, spyware, adware, rootkits, botnet clients, and polymorphic/metamorphic variants - looking at how each spreads and what damage it causes. It also surveys the intelligent algorithms behind modern ML-based malware detection (probabilistic, ensemble, kernel-based, and deep-sequential models), and works on three gaps in the existing literature: a disconnect between surveys and reproducible benchmarks, limited joint attention to accuracy, efficiency, and robustness together, and under-explored heterogeneous stacking for static malware detection. Second, building on this analysis, the paper designs and tests an efficient stacked-ensemble model that estimates how likely a given executable is to be malicious. Using the ClaMP static PE-header benchmark (5,184 labelled Windows executables, 55 raw features), ten baseline classifiers are benchmarked first. An embedded feature-selection step (Random Forest Gini importance) then cuts the feature space by about 49% before training a four-member ensemble - Random Forest, XGBoost, a Multilayer Perceptron, and Gradient Boosting - combined through a logistic-regression meta-learner. Proposed model in this research performs 98.14% accuracy, 98.20% F1 score and an AUC of 0.998 on given data, it uses five fold cross validation accuracy, our results are compared against recent malware research/types are identified for future research work/area.
The increasing sophistication and volume of malware pose a persistent and evolving threat to cybersecurity. The research paper systematically examines and compares various malware detection techniques, including traditional methods such as signature, heuristic, and anomaly detection, and more advanced methods such as behavior analysis, sandboxing, and machine learning, including deep learning. The study examined the mechanisms, advantages, and disadvantages of each technique using recent empirical data from academic literature. A comprehensive table provides a parallel comparison of these methods based on key performance indicators, efficacy against evasive malware, and resource consumption. In addition, it discusses the current challenges of malware detection, such as the increasing complexity of malware, evasion tactics, and threats to machine learning models. Finally, it explores emerging trends and future directions in this field, including integration of artificial intelligence, cloud analysis, proactive defense mechanisms, and the growing role of large language models. This review underscores the need to continuously innovate and adapt malware detection strategies to effectively counter the evolving landscape of cyber threats.
A. Cvetkovic, S. Adamovic, Marko Šarac· ZBORNIK RADOVA UNIVERZITETA...· 0 citations
Experimental results demonstrate that the proposed approach achieves high classification performance while improving transparency in malware detection decisions, making it suitable for practical cybersecurity applications.
V. Padmapriya, S. Uma, S. Sumathi et al.· International journal of com...· 0 citations
Malware is a serious threat in the cybersecurity area because of its dynamic nature, the variety of malware families, stealth, propagation and the capability of evading traditional security products. Therefore, proper malware detection and classification are crucial for detecting malicious software and for securing computer systems from unauthorized access and data stealing, and for disrupting systems. This study covers all the bases when it comes to deep learning approaches for malware detection and classification. It covers the principles, different forms of malware, how to detect deep learning malware, how to represent data, obtaining features, and applications. The traditional detection methods are described with their drawbacks, namely based on signature, behavioral and heuristic methods. The report also delves into the methodologies used by deep learning to classify malware, namely CNNs and Bidirectional Long Short-Term Memory (BiLSTM) networks. BiLSTM models excel at learning sequential features from code-or behavior-related data, whereas CNN-based representation learning approaches excel at learning spatial features from malware representations. Moreover, the various detection techniques (static, dynamic and hybrid) are discussed so that their role in malware analysis can be understood. The survey identifies the current challenges and gaps in research and emphasizes the need for strong, scalable and adaptive deep-learning models to combat new malware threats and enhance cybersecurity protection.
Shivani Jain· International Journal of Cyb...· 0 citations
Random Forest achieves the highest performance with a test accuracy of 96.3%, F1-score of 0.947, and AUC of 0.993, establishing it as the optimal algorithm for static malware detection tasks and establishing it as the optimal algorithm for static malware detection tasks.
Umesh Balami, Ganesh Gautam, Gajendra Sharma· American Journal of Agricult...· 0 citations
This work presents Replicant, a deep reinforcement learning framework that learns the realistic task of evasion under a strict label-only black-box threat model and demonstrates that learning the task of evasion not only results in stronger attack performance but provides a better signal for hardening malware detectors.
Shae McFadden, Ilias Tsingenopoulos, Mario D'Onghia et al.· 0 citations
The results have shown how well-engineered static features coupled with overfitting-aware ensemble design can give robust results of multi-class malware classification in the absence of dynamic traces, to develop additional resilience from obfuscation and runtime-evasive threats.
H. Lamkuche, Mannat Pal· Journal of Computer Virology...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
