Skip to content
Log in
Open access

EXPLAINABLE MACHINE LEARNING-BASED MALWARE DETECTION USING PORTABLE EXECUTABLE STRUCTURAL FEATURES AND HYBRID VOTING ENSEMBLE

Haider Ali Muften
Jul 2026 · Journal for Technology and Science · 0 citations

TL;DR

The findings demonstrate the potential of using ensemble learning in conjunction with explainable artificial intelligence techniques to enhance malware detection systems and cybersecurity applications.

Abstract

Objective: While evolving technologies have introduced advanced threat intelligence, traditional threats such as malware attacks continue to be a potential risk for contemporary computer systems and cybersecurity infrastructures and thus, it is of utmost importance that intelligent methods are developed in order to detect malware. Detecting malware variants is very difficult for traditional signature-based detection methods, especially for new and advanced malware. Thus, in this research work involves an explainable hybrid ensemble framework on machine learning approach with utilizing of Portable Executables (PE) file features for malware detection. Method: Our dataset is composed of 62,485 executable samples on the pre-processed and feature cleaning PE structures reduced to a domain matrix into 16 numerical features. We have implemented and evaluated multiple machine learning algorithms such as, Logistic Regression, Decision Tree, Random Forests, Support Vector Machine and Extreme Gradient Boosting. Voting Classifier was created for a robustness against classification and detection in addition to the hybrid ensemble model. Furthermore, we utilized SHAP analysis to understand model predictions and detect the most important features that contribute to malware classification. Results: Output from our practical experiments demonstrated some superior scores on all types of metrics measured. The Random Forest classifier has the best accuracy (99.64%) and the proposed Hybrid Voting model achieved an accuracy of 99.53%, precision: 99.68, recall: 99.24 and F1-score of 99.46 which confirms that our algorithm yielded very strong rumors and results are strongly stable across all compared datasets as well as high stability between individual classifiers (Fig From this analysis, we found that Dll Characteristics, Debug Size and Debug RVA stood out as the most significant features overall for our malware detection task, which showed how informative variations in executable structural characteristics can be to classification. Novelty: The findings demonstrate the potential of using ensemble learning in conjunction with explainable artificial intelligence techniques to enhance malware detection systems and cybersecurity applications.

DOI Semantic Scholar
Read PDF

Similar papers

Open access Jul 2026

AI-Based Adaptive Malware Detection Using Portable Executable (PE) Header Analysis and Hybrid Machine Learning

Experimental results demonstrate that the proposed approach achieves high classification performance while improving transparency in malware detection decisions, making it suitable for practical cybersecurity applications.

V. Padmapriya, S Uma, S Sumathi et al. · 0 citations
Open access 2026

Explainable AI for Malware Detection: Feature Importance Analysis Using SHAP and Machine Learning

A machine learning-based malware detection framework using features extracted from Windows Portable Executable (PE) files is presented and the SHAP-based feature importance approach helps identify the most influential features responsible for malware detection while also reducing model complexity and computational cost.

Balachandra Chikkoppa, H. J. · 0 citations
Open access Aug 2026

Machine Learning-Based Malware Detection: A Comparative Study of Random Forest, Decision Tree, KNN, and Linear SVM

Random Forest achieves the highest performance with a test accuracy of 96.3%, F1-score of 0.947, and AUC of 0.993, establishing it as the optimal algorithm for static malware detection tasks and establishing it as the optimal algorithm for static malware detection tasks.

Umesh Balami, Ganesh Gautam, Gajendra Sharma · 0 citations
Conference Jul 2026

A Comparative Analysis of Machine Learning and Deep Learning Methods for Malware Detection in Portable Executable Files

Malware severely threatens cybersecurity through Portable Executable (PE) files. In this study, the performances of machine learning and deep learning models for malware detection are compared using static analysis features extracted from PE files. Tree-based ensemble models like Random Forest, XGBoost, LightGBM, and CatBoost, along with MLP, DNN, and 1D-CNN deep learning architectures, were trained on a dataset comprising 62,485 samples and 15 features. Experimental results proved that ensemble algorithms outperform deep learning models on low-dimensional tabular data. Among the models, Random Forest achieved the highest success with 99.65% accuracy and a 99.59% F1-score. This academic study demonstrates that lightweight and high-performance tree-based models offer a more efficient solution for malware detection compared to computationally expensive deep neural networks.

Gokay Mutlu, Neşe Rihani, E. Bayazit · 0 citations
Open access Jul 2026

A Robust Deep Learning Framework for Intelligent Malware Detection

Malware has become one of the biggest threats to computer systems and digital networks, affecting individuals, businesses, and government organizations. Traditional malware detection methods mainly depend on signatures and predefined rules, making them less effective against newly developed and constantly evolving attacks. As cybercriminals continue to use advanced techniques such as code obfuscation and polymorphism, there is a growing need for smarter and faster detection methods. This project proposes a robust malware detection system using deep learning to identify both known and unknown malware with improved accuracy. The model automatically learns meaningful patterns from malware data without relying heavily on manual feature extraction. By analyzing the behavior and characteristics of malicious files, the proposed system can classify malware efficiently while reducing false alarms. The approach improves detection speed, enhances security, and supports real-time threat analysis. This makes it a reliable solution for protecting modern computer systems against rapidly changing cyber threats.

S.Srikar, G.Rajini · 0 citations
#explainable ai Open access Aug 2026

DEVELOPMENT OF A HYBRID NN–CNN DEEP LEARNING FRAMEWORK FOR INTELLIGENT MALWARE DETECTION, FAMILY CLASSIFICATION, AND VARIANT IDENTIFICATION

A Hybrid Neural Network–Convolutional Neural Network (NN–CNN) Deep Learning Framework for malware detection, malware-family classification, and malware-variant identification and considers two important issues in practical malware detection: model explainability and generalization to previously unseen malware.

Chioma Grace Nwankwo, B. C. Amanze, Ikechukwu Amaefule · 0 citations