2026· Journal of Computer and Forensic Sciences· 0 citations· 8 references
TL;DR
The findings indicate that combining deep representation learning with ensemble classification can improve dynamic malware detection and reduce dependence on static signatures.
Abstract
Malware continues to evolve through polymorphic, metamorphic, and file-less techniques, reducing the effectiveness of signature-based detection. This study proposes a hybrid dynamic malware classification framework that combines Convolutional Neural Networks (CNNs), Long Short-Term Memory (LSTM) networks, and a Random Forest (RF) classifier. Dynamic behavioural traces are transformed into machine-readable features using Term Frequency-Inverse Document Frequency (TF-IDF), Count Vectorization, and Word2Vec embeddings. CNN and LSTM models are used as feature extractors to capture local and sequential behavioural patterns, while RF performs the final classification to improve robustness and interpretability. The reported experimental evaluation shows that the embedding-based hybrid CNN-RF configuration achieved the best performance, reaching 98.21% accuracy. The findings indicate that combining deep representation learning with ensemble classification can improve dynamic malware detection and reduce dependence on static signatures. The proposed framework is therefore a promising approach for adaptive malware classification and future security monitoring applications.
The rapid evolution of malware through the use of obfuscation techniques and continuous runtime behavior mutation has made traditional signature-based detection mechanisms much less effective, making there is a dire need for adaptive and deployable malware detection solutions. In response, behavioral analysis based on API call sequences has received more and more attention, especially with the use of deep learning models, such as Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTMs) networks. Although these models are shown to have a strong ability in modeling the sequential execution behavior, a lot of the existing approaches are limited to API level features and are not strongly linked to the practical detection tools used in real-world environments. This paper proposes a hybrid malware detection framework using CNN-LSTM-based behavioral modelling and contextual intelligence using the Hybrid Analysis platform. The system takes execution level API call sequences and augments them with light-weight external features such as threat score and antivirus detection counts to make the classification robust and reduce ambiguity in decision making. Furthermore, the learned behavioral patterns are then translated into dynamically generated YARA rules for interpretable and practical deployment, not limited to black box classification. The proposed framework is evaluated with a well-established academic data set created by combining the MalBehavD-V1 and Oliveira API call sequence datasets with 3500 samples. Experimental results show that the accuracy of hybrid CNN and LSTM reach 95.43% with only API sequences, and reach 97.49% when incorporating Hybrid Analysis features and combining the two sets of accuracy will be clearly improved, the discriminative effect will be improved as shown in the AUC metric. These results show that the fusion of deep learning-based behavioral analysis with external contextual intelligence is an effective and deployable malware detection solution which supports dynamic YARA rule generation.
Malware severely threatens cybersecurity through Portable Executable (PE) files. In this study, the performances of machine learning and deep learning models for malware detection are compared using static analysis features extracted from PE files. Tree-based ensemble models like Random Forest, XGBoost, LightGBM, and CatBoost, along with MLP, DNN, and 1D-CNN deep learning architectures, were trained on a dataset comprising 62,485 samples and 15 features. Experimental results proved that ensemble algorithms outperform deep learning models on low-dimensional tabular data. Among the models, Random Forest achieved the highest success with 99.65% accuracy and a 99.59% F1-score. This academic study demonstrates that lightweight and high-performance tree-based models offer a more efficient solution for malware detection compared to computationally expensive deep neural networks.
Gokay Mutlu, Neşe Rihani, E. Bayazit· Signal Processing and Commun...· 0 citations
A Hybrid Neural Network–Convolutional Neural Network (NN–CNN) Deep Learning Framework for malware detection, malware-family classification, and malware-variant identification and considers two important issues in practical malware detection: model explainability and generalization to previously unseen malware.
Chioma Grace Nwankwo, B. C. Amanze, Ikechukwu Amaefule· World Journal of Advanced Re...· 0 citations
Evaluation using metrics such as accuracy, precision, F1 score, and false positive rate indicates that CNN-GBM outperforms existing deep learning models, and enhancements stem from the effective integration of CNN feature extraction with GBM’s boosting capabilities.
C. Chimeleze, Norziana Jamil, Z. M. Zain et al.· Scientific Reports· 0 citations
The findings demonstrate the potential of using ensemble learning in conjunction with explainable artificial intelligence techniques to enhance malware detection systems and cybersecurity applications.
Haider Ali Muften· Journal for Technology and S...· 0 citations
Static malware analysis increasingly relies on visual binary representations to bypass signature evasion techniques, yet standard Convolutional Neural Network (CNN) classifiers depend on parameterized Fully Connected (FC) layers that introduce parameter bloat, high latency, and vulnerability to class imbalance. To address these structural limits, this paper proposes a novel hybrid CNN-Hopfield Neural Network (CNN-HNN) framework that replaces traditional dense classification heads with continuous Modern Hopfield associative memory layers. In this architecture, raw malware executables are transformed into 2D grayscale image matrices, from which a CNN backbone extracts abstract latent feature representations. The continuous Hopfield layer then acts as a pattern retrieval engine, evaluating the extracted query vector against stored class archetype prototypes using log-sum-exp energy minimization. Benchmark evaluations on the MalImg and Microsoft Malware Classification Challenge datasets demonstrate that the hybrid model achieves top-tier accuracy (99.58% and 99.62%, respectively) while reducing classification-head parameter counts by up to 78%, lowering floating-point operations (FLOPs) by over 65%, and accelerating inference latency to under 2 ms per sample. Furthermore, the associative energy landscape isolates minority threat categories within distinct basins of attraction, achieving an F1-score improvement of over 20% on severely imbalanced classes compared to standard CNNs.
Uma Kannan, Rajendran Swamidurai· International journal of res...· 0 citations