2026· International Journal of Advanced Computer Science and Applications· 0 citations· 43 references
TL;DR
The results suggest that well-designed classical ensemble approaches are still quite competitive for scalable and interpretable static malware detection even with the rising usage of more and more powerful machine learning architectures.
Abstract
Malware detection is a major difficulty in cybersecurity as malicious software continues to evolve in scale, diversity, and sophistication. While deep learning and highly complex architectures are becoming increasingly important in recent work, the practical efficiency of conventional machine learning methods for large-scale static malware detection remains underexplored. We perform a comparative evaluation of four machine learning models (Random Forest, XGBoost, Logistic Regression, and Decision Tree) on approximately 600,000 Portable Executable (PE) samples from the EMBER dataset. To enable a fair comparison of the models, we created a common experiment setup including standardised preprocessing, repeated evaluation with numerous random seeds, selective hyperparameter optimisation, feature importance analysis, and confusion matrix-based error analysis. The experimental results show a strong benefit of ensemble-based approaches for the structured feature representation provided by the EMBER dataset. Random Forest showed the best overall performance, with 96.74 % accuracy, 96.71 % F1-score, and a ROC-AUC of 0.9953, retaining a very steady behavior in repeated runs. XGBoost likewise demonstrated good predictive capacity with less training time but did not outperform Random Forest even with careful hyperparameter adjustment. On the other hand, Logistic Regression performed significantly worse, suggesting that linear decision boundaries were insufficient to capture the deep structural relationships encoded in static malware traits. Further study of the confusion matrix shows a balanced classification behavior with relatively low false negative rates, which is significant for operational malware detection situations. The feature importance analysis suggested that entropy-based features, PE structure metadata, and import-based features played an important role in the malware classification judgments. In conclusion, the results suggest that well-designed classical ensemble approaches are still quite competitive for scalable and interpretable static malware detection even with the rising usage of more and more powerful machine learning architectures.
Malware severely threatens cybersecurity through Portable Executable (PE) files. In this study, the performances of machine learning and deep learning models for malware detection are compared using static analysis features extracted from PE files. Tree-based ensemble models like Random Forest, XGBoost, LightGBM, and CatBoost, along with MLP, DNN, and 1D-CNN deep learning architectures, were trained on a dataset comprising 62,485 samples and 15 features. Experimental results proved that ensemble algorithms outperform deep learning models on low-dimensional tabular data. Among the models, Random Forest achieved the highest success with 99.65% accuracy and a 99.59% F1-score. This academic study demonstrates that lightweight and high-performance tree-based models offer a more efficient solution for malware detection compared to computationally expensive deep neural networks.
Gokay Mutlu, Neşe Rihani, E. Bayazit· Signal Processing and Commun...· 0 citations
Random Forest achieves the highest performance with a test accuracy of 96.3%, F1-score of 0.947, and AUC of 0.993, establishing it as the optimal algorithm for static malware detection tasks and establishing it as the optimal algorithm for static malware detection tasks.
Umesh Balami, Ganesh Gautam, Gajendra Sharma· American Journal of Agricult...· 0 citations
Malware is growing fast in volume, variety, and sophistication, and traditional signature-based defences can no longer keep up. This has driven a shift toward machine-learning (ML) based detection. This paper has two main goals. First, it compares the major malware families - viruses, worms, trojans, ransomware, spyware, adware, rootkits, botnet clients, and polymorphic/metamorphic variants - looking at how each spreads and what damage it causes. It also surveys the intelligent algorithms behind modern ML-based malware detection (probabilistic, ensemble, kernel-based, and deep-sequential models), and works on three gaps in the existing literature: a disconnect between surveys and reproducible benchmarks, limited joint attention to accuracy, efficiency, and robustness together, and under-explored heterogeneous stacking for static malware detection. Second, building on this analysis, the paper designs and tests an efficient stacked-ensemble model that estimates how likely a given executable is to be malicious. Using the ClaMP static PE-header benchmark (5,184 labelled Windows executables, 55 raw features), ten baseline classifiers are benchmarked first. An embedded feature-selection step (Random Forest Gini importance) then cuts the feature space by about 49% before training a four-member ensemble - Random Forest, XGBoost, a Multilayer Perceptron, and Gradient Boosting - combined through a logistic-regression meta-learner. Proposed model in this research performs 98.14% accuracy, 98.20% F1 score and an AUC of 0.998 on given data, it uses five fold cross validation accuracy, our results are compared against recent malware research/types are identified for future research work/area.
Deepak Singh Rana, Sushil Chandra Dimri· International journal of com...· 0 citations
Experimental results demonstrate that the proposed approach achieves high classification performance while improving transparency in malware detection decisions, making it suitable for practical cybersecurity applications.
V. Padmapriya, S Uma, S Sumathi et al.· International journal of com...· 0 citations
Evaluated tree-based ensemble models, Random Forest, XGBoost, and LightGBM, for static malware detection in PE files show that tree-based ensembles outperform deep learning models, such as Multilayer Perceptrons (MLPs) and Convolutional Neural Networks (CNNs), as well as traditional machine learning approaches in handling high-dimensional tabular data.
Aleksandar Sandro Cvetković, S. Adamovic, Marko Šarac· SINTEZA· 0 citations
The growing complexity and scale of Android malware present significant challenges for the development of detection systems that are both accurate and computationally efficient. Traditional machine learning methods often struggle with high-dimensional feature spaces and poorly optimized model architectures, leading to degraded accuracy and excessive resource consumption. To address these limitations, we propose a unified malware detection framework—BIGSA-HNO-ELM—that integrates Binary Improved Gravitational Search Algorithm (BIGSA) for robust feature selection with Hidden Node Optimization (HNO) applied to an Extreme Learning Machine (ELM) classifier. Evaluated on the KronoDroid dataset comprising over 78,000 Android applications with 464 hybrid static and dynamic behavioural features, the proposed framework achieves a 77% reduction in feature dimensionality, significantly lowering computational overhead while preserving high detection accuracy. Through HNO, the optimal number of ELM hidden neurons is dynamically determined, enhancing generalization and reducing overfitting. Comprehensive experiments demonstrate that the BIGSA-HNO-ELM model achieves 98.0% accuracy, 97.4 % precision, 96.2 % recall, 96.8 % F1-Score and an AUC-ROC of 97.0%, substantially outperforming baseline methods. Statistical significance testing (paired t-tests and Wilcoxon signed-rank tests, p < 0.01) confirms the robustness of these performance gains and demonstrates superior stability across 10-fold cross-validation with minimal variance in performance metrics. This integrated optimization approach not only improves predictive performance but also supports deployment in resource-constrained and real-time environments, making BIGSA-HNO-ELM a compelling solution for modern Android malware detection.
Shouzab Khan, Muhammad Hassan· International journal for el...· 0 citations