A Review of Explainable Machine Learning Methods for Malware Detection and Classification

A Comparative Evaluation of Malware Families and Machine-Learning Detection Techniques, and an Optimized Stacked-Ensemble Model for Predicting Software Maliciousness

Malware is growing fast in volume, variety, and sophistication, and traditional signature-based defences can no longer keep up. This has driven a shift toward machine-learning (ML) based detection. This paper has two main goals. First, it compares the major malware families - viruses, worms, trojans, ransomware, spyware, adware, rootkits, botnet clients, and polymorphic/metamorphic variants - looking at how each spreads and what damage it causes. It also surveys the intelligent algorithms behind modern ML-based malware detection (probabilistic, ensemble, kernel-based, and deep-sequential models), and works on three gaps in the existing literature: a disconnect between surveys and reproducible benchmarks, limited joint attention to accuracy, efficiency, and robustness together, and under-explored heterogeneous stacking for static malware detection. Second, building on this analysis, the paper designs and tests an efficient stacked-ensemble model that estimates how likely a given executable is to be malicious. Using the ClaMP static PE-header benchmark (5,184 labelled Windows executables, 55 raw features), ten baseline classifiers are benchmarked first. An embedded feature-selection step (Random Forest Gini importance) then cuts the feature space by about 49% before training a four-member ensemble - Random Forest, XGBoost, a Multilayer Perceptron, and Gradient Boosting - combined through a logistic-regression meta-learner.  Proposed model in this research performs 98.14% accuracy, 98.20% F1 score and an AUC of 0.998 on given data, it uses five fold cross validation accuracy, our results are compared against recent malware research/types are identified for future research work/area.

A Survey on Deep Learning Approaches for Malware Detection and Classification

Malware is a serious threat in the cybersecurity area because of its dynamic nature, the variety of malware families, stealth, propagation and the capability of evading traditional security products. Therefore, proper malware detection and classification are crucial for detecting malicious software and for securing computer systems from unauthorized access and data stealing, and for disrupting systems. This study covers all the bases when it comes to deep learning approaches for malware detection and classification. It covers the principles, different forms of malware, how to detect deep learning malware, how to represent data, obtaining features, and applications. The traditional detection methods are described with their drawbacks, namely based on signature, behavioral and heuristic methods. The report also delves into the methodologies used by deep learning to classify malware, namely CNNs and Bidirectional Long Short-Term Memory (BiLSTM) networks. BiLSTM models excel at learning sequential features from code-or behavior-related data, whereas CNN-based representation learning approaches excel at learning spatial features from malware representations. Moreover, the various detection techniques (static, dynamic and hybrid) are discussed so that their role in malware analysis can be understood. The survey identifies the current challenges and gaps in research and emphasizes the need for strong, scalable and adaptive deep-learning models to combat new malware threats and enhance cybersecurity protection.

A Robust Deep Learning Framework for Intelligent Malware Detection

Malware has become one of the biggest threats to computer systems and digital networks, affecting individuals, businesses, and government organizations. Traditional malware detection methods mainly depend on signatures and predefined rules, making them less effective against newly developed and constantly evolving attacks. As cybercriminals continue to use advanced techniques such as code obfuscation and polymorphism, there is a growing need for smarter and faster detection methods. This project proposes a robust malware detection system using deep learning to identify both known and unknown malware with improved accuracy. The model automatically learns meaningful patterns from malware data without relying heavily on manual feature extraction. By analyzing the behavior and characteristics of malicious files, the proposed system can classify malware efficiently while reducing false alarms. The approach improves detection speed, enhances security, and supports real-time threat analysis. This makes it a reliable solution for protecting modern computer systems against rapidly changing cyber threats.

Obfuscated Malware Detection Through Ensemble Learning

Modern malwares utilize different obfuscation techniques to hide their behaviors and overcome traditional signature-based detection methods. This paper investigates the use of machine learning techniques to detect obfuscated malware in the Windows operating system trained on memory-based features. This research considers different malware types and analyzes several obfuscation techniques used by malwares to bypass antivirus detection. An ensemble machine learning model is developed based on four algorithms: SVM, Random Forest, Gradient Boosting, and CatBoost. Voting is used for classification based on results of each model. The ensemble model is evaluated using a dataset of obfuscated malware samples, namely CIC-MalMem-2022, and validated through cross-validation. Experimental results show high detection rate where the accuracy and F1-score are 99.99% and 99%, respectively. The results show that machine learning can enhance malware detection against obfuscated malware threats.

AI-Based Adaptive Malware Detection Using Portable Executable (PE) Header Analysis and Hybrid Machine Learning

Experimental results demonstrate that the proposed approach achieves high classification performance while improving transparency in malware detection decisions, making it suitable for practical cybersecurity applications.

Detection and Explanation of PowerShell Malware with Large Language Models