Jul 2026· Journal for Technology and Science· 0 citations
TL;DR
The findings demonstrate the potential of using ensemble learning in conjunction with explainable artificial intelligence techniques to enhance malware detection systems and cybersecurity applications.
Abstract
Objective: While evolving technologies have introduced advanced threat intelligence, traditional threats such as malware attacks continue to be a potential risk for contemporary computer systems and cybersecurity infrastructures and thus, it is of utmost importance that intelligent methods are developed in order to detect malware. Detecting malware variants is very difficult for traditional signature-based detection methods, especially for new and advanced malware. Thus, in this research work involves an explainable hybrid ensemble framework on machine learning approach with utilizing of Portable Executables (PE) file features for malware detection. Method: Our dataset is composed of 62,485 executable samples on the pre-processed and feature cleaning PE structures reduced to a domain matrix into 16 numerical features. We have implemented and evaluated multiple machine learning algorithms such as, Logistic Regression, Decision Tree, Random Forests, Support Vector Machine and Extreme Gradient Boosting. Voting Classifier was created for a robustness against classification and detection in addition to the hybrid ensemble model. Furthermore, we utilized SHAP analysis to understand model predictions and detect the most important features that contribute to malware classification. Results: Output from our practical experiments demonstrated some superior scores on all types of metrics measured. The Random Forest classifier has the best accuracy (99.64%) and the proposed Hybrid Voting model achieved an accuracy of 99.53%, precision: 99.68, recall: 99.24 and F1-score of 99.46 which confirms that our algorithm yielded very strong rumors and results are strongly stable across all compared datasets as well as high stability between individual classifiers (Fig From this analysis, we found that Dll Characteristics, Debug Size and Debug RVA stood out as the most significant features overall for our malware detection task, which showed how informative variations in executable structural characteristics can be to classification. Novelty: The findings demonstrate the potential of using ensemble learning in conjunction with explainable artificial intelligence techniques to enhance malware detection systems and cybersecurity applications.
With the rapid evolution of malware and sophisticated evasion techniques used, the efficiency of traditional detection approaches will be increasingly compromised since malware creators frequently leverage polymorphic, metamorphic, packing, encryption, and code obfuscation techniques to circumvent traditional security methods. This work includes an AI-based adaptive malware detection system that utilizes the Portable Executable (PE) headers along with hybrid machine learning models. The system conducts static analysis of malware without the need to run malware in sandboxed environments to gather information regarding the structure of executable files. In total, the system trains and tests three machine learning models - Random Forest, eXtreme Gradient Boosting (XGBoost), and Artificial Neural Network (ANN). Training and testing are conducted on a dataset of 19,611 executable files described with 79 characteristics extracted from Portable Executable headers. To enhance predictive accuracy, a hybrid ensemble model is used, while SHapley Additive exPlanations (SHAP) enable predictability. The experiments conducted yielded an accuracy of 99.13% and an Area Under the Curve (AUC) value of 0.9984 with an extremely low false negative rate. The proposed framework combines a hybrid ensemble of Random Forest and XGBoost classifiers with SHapley Additive exPlanations (SHAP) to provide accurate and interpretable malware detection using static PE-header analysis. Experimental results demonstrate that the proposed approach achieves high classification performance while improving transparency in malware detection decisions, making it suitable for practical cybersecurity applications.
V. Padmapriya, S Uma, S Sumathi et al.· International journal of com...· 0 citations
Malware attacks have increased significantly recently, posing serious threats to computer systems, network infrastructures, and critical digital services. Traditional malware detection techniques mainly rely on signature based approaches, which are often ineffective in detecting newly emerging, polymorphic, and previously unseen malware variants. To address this limitation, machine learning techniques have been widely adopted to enhance malware detection by identifying hidden patterns and structural characteristics in executable files. This paper presents a machine learning-based malware detection framework using features extracted from Windows Portable Executable (PE) files. The dataset, stored in a structured format such as a malware.csv file, is preprocessed and analyzed using several machine learning classifiers, including Support Vector Machine (SVM), Random Forest (RF), Decision Tree (DT), Naïve Bayes (NB), Logistic Regression (LR), and K-Nearest Neighbors (KNN). To improve model transparency and interpretability, Shapley Additive Explanations (SHAP) are employed to analyze the contribution of individual features toward classification decisions. The SHAP-based feature importance approach helps identify the most influential features responsible for malware detection while also reducing model complexity and computational cost. Experimental results demonstrate that integrating SHAP with machine learning classifiers enhances detection accuracy and provides meaningful explanations for model predictions. The proposed approach highlights the effectiveness of explainable machine learning techniques in developing accurate, interpretable, and efficient malware detection systems for modern cybersecurity applications.
Balachandra Chikkoppa, H. J.· International Journal of All...· 0 citations
The growing prevalence of malware presents a critical threat to cybersecurity, causing substantial financial and operational damage to organizations worldwide. Traditional signature-based detection approaches are increasingly insufficient against polymorphic and zero-day threats. This paper presents a comprehensive comparative study of four machine learning (ML) algorithms — Random Forest (RF), Decision Tree (DT), K-Nearest Neighbor (KNN), and Linear Support Vector Machine (SVM) — for malware detection using static feature analysis on Portable Executable (PE) files. Experiments were conducted on a combined dataset derived from Drebin-215 and Malgenome-215 containing 18,830 instances with 208 features. A stratified 10-fold cross-validation with GridSearch CV hyperparameter tuning was employed. Evaluation metrics include accuracy, precision, recall, F1-score, and Area Under the ROC Curve (AUC). Results demonstrate that Random Forest achieves the highest performance with a test accuracy of 96.3%, F1-score of 0.947, and AUC of 0.993, outperforming all other classifiers and establishing it as the optimal algorithm for static malware detection tasks.
Umesh Balami, Ganesh Gautam, Gajendra Sharma· American Journal of Agricult...· 0 citations
Malware severely threatens cybersecurity through Portable Executable (PE) files. In this study, the performances of machine learning and deep learning models for malware detection are compared using static analysis features extracted from PE files. Tree-based ensemble models like Random Forest, XGBoost, LightGBM, and CatBoost, along with MLP, DNN, and 1D-CNN deep learning architectures, were trained on a dataset comprising 62,485 samples and 15 features. Experimental results proved that ensemble algorithms outperform deep learning models on low-dimensional tabular data. Among the models, Random Forest achieved the highest success with 99.65% accuracy and a 99.59% F1-score. This academic study demonstrates that lightweight and high-performance tree-based models offer a more efficient solution for malware detection compared to computationally expensive deep neural networks.
Gokay Mutlu, Neşe Rihani, E. Bayazit· Signal Processing and Commun...· 0 citations
Malware has become one of the biggest threats to computer systems and digital networks, affecting individuals, businesses, and government organizations. Traditional malware detection methods mainly depend on signatures and predefined rules, making them less effective against newly developed and constantly evolving attacks. As cybercriminals continue to use advanced techniques such as code obfuscation and polymorphism, there is a growing need for smarter and faster detection methods. This project proposes a robust malware detection system using deep learning to identify both known and unknown malware with improved accuracy. The model automatically learns meaningful patterns from malware data without relying heavily on manual feature extraction. By analyzing the behavior and characteristics of malicious files, the proposed system can classify malware efficiently while reducing false alarms. The approach improves detection speed, enhances security, and supports real-time threat analysis. This makes it a reliable solution for protecting modern computer systems against rapidly changing cyber threats.
S.Srikar, G.Rajini· International Journal of Dat...· 0 citations
A Hybrid Neural Network–Convolutional Neural Network (NN–CNN) Deep Learning Framework for malware detection, malware-family classification, and malware-variant identification and considers two important issues in practical malware detection: model explainability and generalization to previously unseen malware.
Chioma Grace Nwankwo, B. C. Amanze, Ikechukwu Amaefule· World Journal of Advanced Re...· 0 citations