Proactive Malware Detection and Behavioral Analysis through an AI-Enhanced Cryptographic Framework

Abstract

Today's malware is polymorphic, metamorphic, file-less and signature evasive. Although the classifiers based on machine learning (ML) and deep learning (DL) have seen great improvements in their ability to accurately detect attacks, they remain susceptible to adversarial perturbations, model-extraction attacks, and training data leakage. One of the difficulties with an AI inference pipeline is the absence of a direct incorporation of cryptographic guarantees of integrity and confidentiality into the pipeline. In response to this, this paper introduces a hybrid scheme called Hybrid AI-Enhanced Cryptographic Framework (H-AIECF) that merges static and dynamic feature engineering on the EMBER2024 benchmark with a cryptographic envelope composed of AES-256-GCM (confidentiality), SHA-256 (integrity), and ECDSA-signed verdicts (authentication). The portable-executable (PE) features of EMBER2024 are extracted using chi-square selection and Principal Component Analysis (PCA) to train a baseline Random Forest (RF) and a CNN-LSTM hybrid. In the binary detection task, the proposed framework achieves 98.74% accuracy, 98.52% precision, 98.91% recall, 98.71% F1-score and 0.81% False Positive Rate (FPR) that are all better than those of a legacy signature scanner, tuned Random Forest and a standalone CNN–LSTM. All in all, the overhead of the cryptographic layer is still below 5% of the total inference latency, demonstrating that the behaviour-aware detection and end-to-end cryptographic protection are not conflicting and mutually reinforcing characteristics of a trustworthy pipeline for malware-defence.