{"url":"/sota/malware-classification-on-microsoft-malware","task":{"name":"Malware Classification","url":"/task/malware-classification","note":null},"dataset":{"name":"Microsoft Malware Classification Challenge","url":"/dataset/microsoft-malware-classification-challenge"},"category":"Miscellaneous","categories":["Miscellaneous"],"category_note":null,"description":"**Malware Classification** is the process of assigning a malware sample to a specific malware family. Malware within a family shares similar properties that can be used to create signatures for detection and classification. Signatures can be categorized as static or dynamic based on how they are extracted. A static signature can be based on a byte-code sequence, binary assembly instruction, or an imported Dynamic Link Library (DLL). Dynamic signatures can be based on file system activities, terminal commands, network communications, or function and system call sequences.\r\n\r\n\r\n<span class=\"description-source\">Source: [Behavioral Malware Classification using Convolutional Recurrent Neural Networks ](https://arxiv.org/abs/1811.07842)</span>","description_from":"task","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","rank":"the archive's row order at snapshot; not re-ranked","rows_end_at":"2025-07-28","rows_withheld_as_spam":0,"metric_values":"the archive's strings, untouched"},"metrics":["Accuracy (10-fold)","LogLoss","Macro F1 (10-fold)","Accuracy (5-fold)","F1 score (5-fold)","Accuracy"],"metric_direction":{"note":"inferred from the metric name only (the archive records no direction); null = not inferred, chart draws points only","by_metric":{"Accuracy (10-fold)":"higher","LogLoss":null,"Macro F1 (10-fold)":"higher","Accuracy (5-fold)":"higher","F1 score (5-fold)":"higher","Accuracy":"higher"}},"counts":{"rows":29,"rows_with_code":22,"rows_with_paper_page":29,"rows_dated":29,"rows_using_additional_data":0},"rows":[{"rank_in_archive_order":1,"model":"Ahmadi et al. (2016): ENT, Bytes 1-G, STR, IMG1, IMG2, MD1, MISC, OPC, SEC, REG, DP, API, SYM, MD2 IMG and Opcode N-Grams + Ensemble Learning (XGBoost)","metrics":{"Accuracy (10-fold)":"0.9976","Macro F1 (10-fold)":"0.9931"},"uses_additional_data":false,"paper_date":"2020-05-12","paper":"/paper/hydra-a-multimodal-deep-learning-framework","paper_url":"https://www.sciencedirect.com/science/article/pii/S0167404820301462","paper_title":"HYDRA: A multimodal deep learning framework for malware classification","code":"https://github.com/danielgibert/mlw_classification_hydra","n_code_links":1,"syntology":null},{"rank_in_archive_order":2,"model":"HYDRA","metrics":{"Accuracy (10-fold)":"0.9975","Macro F1 (10-fold)":"0.9951"},"uses_additional_data":false,"paper_date":"2020-05-12","paper":"/paper/hydra-a-multimodal-deep-learning-framework","paper_url":"https://www.sciencedirect.com/science/article/pii/S0167404820301462","paper_title":"HYDRA: A multimodal deep learning framework for malware classification","code":"https://github.com/danielgibert/mlw_classification_hydra","n_code_links":1,"syntology":null},{"rank_in_archive_order":3,"model":"Zhang et al. (2016): Total lines of each Section, Operation Code Count, API Usage, Special Symbols Count, Asm File Pixel Intensity Feature, Bytes File Block Size Distribution, Bytes File N-Gram + Ensemble Learning (XGBoost)","metrics":{"Accuracy (10-fold)":"0.9974","Macro F1 (10-fold)":"0.9938"},"uses_additional_data":false,"paper_date":"2020-05-12","paper":"/paper/hydra-a-multimodal-deep-learning-framework","paper_url":"https://www.sciencedirect.com/science/article/pii/S0167404820301462","paper_title":"HYDRA: A multimodal deep learning framework for malware classification","code":"https://github.com/danielgibert/mlw_classification_hydra","n_code_links":1,"syntology":null},{"rank_in_archive_order":4,"model":"Orthrus","metrics":{"Accuracy (10-fold)":"0.9924","Macro F1 (10-fold)":"0.9872"},"uses_additional_data":false,"paper_date":"2020-09-28","paper":"/paper/orthrus-a-bimodal-learning-architecture-for","paper_url":"https://ieeexplore.ieee.org/document/9206671","paper_title":"Orthrus: A Bimodal Learning Architecture for Malware Classification","code":"https://github.com/danielgibert/mlw_classification_orthrus","n_code_links":1,"syntology":null},{"rank_in_archive_order":5,"model":"Opcode-based Shallow CNN","metrics":{"Accuracy (10-fold)":"0.9917","LogLoss":"0.0244","Macro F1 (10-fold)":"0.9856"},"uses_additional_data":false,"paper_date":"2017-10-27","paper":"/paper/convolutional-neural-network-for-1","paper_url":"http://ebooks.iospress.nl/publication/47742","paper_title":"Convolutional Neural Network for Classification of Malware Assembly Code","code":"https://github.com/danielgibert/mlw_classification_cnn_assembly","n_code_links":1,"syntology":null},{"rank_in_archive_order":6,"model":"Hierarchical Convolutional Network","metrics":{"Accuracy (10-fold)":"0.9913","LogLoss":"0.0419","Macro F1 (10-fold)":"0.9830"},"uses_additional_data":false,"paper_date":"2019-09-30","paper":"/paper/a-hierarchical-convolutional-neural-network","paper_url":"https://ieeexplore.ieee.org/abstract/document/8852469","paper_title":"A Hierarchical Convolutional Neural Network for Malware Classification","code":null,"n_code_links":0,"syntology":null},{"rank_in_archive_order":7,"model":"SEA","metrics":{"Accuracy (10-fold)":"0.9912","LogLoss":"0.0431","Macro F1 (10-fold)":"0.9908"},"uses_additional_data":false,"paper_date":"2023-02-11","paper":"/paper/sequential-embedding-based-attentive-sea","paper_url":"https://arxiv.org/abs/2302.05728v1","paper_title":"Sequential Embedding-based Attentive (SEA) classifier for malware classification","code":"https://github.com/Muhammad4hmed/SEA","n_code_links":1,"syntology":null},{"rank_in_archive_order":8,"model":"Dynamic Time Wrapping + K-NN","metrics":{"Accuracy (10-fold)":"0.9894","LogLoss":"0.367724","Macro F1 (10-fold)":"0.9813"},"uses_additional_data":false,"paper_date":"2018-04-27","paper":"/paper/classification-of-malware-by-using-structural","paper_url":"https://www.aaai.org/ocs/index.php/AAAI/AAAI18/paper/view/16133","paper_title":"Classification of Malware by Using Structural Entropy on Convolutional Neural Networks","code":"https://github.com/danielgibert/mlw_classification_structural_entropy","n_code_links":1,"syntology":null},{"rank_in_archive_order":9,"model":"Ahmadi et al. (2016): API feature vector + XGBoost","metrics":{"Accuracy (10-fold)":"0.9868","Macro F1 (10-fold)":"0.9638"},"uses_additional_data":false,"paper_date":"2020-05-12","paper":"/paper/hydra-a-multimodal-deep-learning-framework","paper_url":"https://www.sciencedirect.com/science/article/pii/S0167404820301462","paper_title":"HYDRA: A multimodal deep learning framework for malware classification","code":"https://github.com/danielgibert/mlw_classification_hydra","n_code_links":1,"syntology":null},{"rank_in_archive_order":10,"model":"Autoencoders+Residual Network","metrics":{"Accuracy (10-fold)":"0.9861","LogLoss":"0.106343","Macro F1 (10-fold)":"0.9719"},"uses_additional_data":false,"paper_date":"2018-09-27","paper":"/paper/an-end-to-end-deep-learning-architecture-for-1","paper_url":"https://link.springer.com/chapter/10.1007/978-3-030-01424-7_38","paper_title":"An End-to-End Deep Learning Architecture for Classification of Malware’s Binary Content","code":null,"n_code_links":0,"syntology":null},{"rank_in_archive_order":11,"model":"Multiresolution CNN","metrics":{"Accuracy (10-fold)":"0.9828","LogLoss":"0.124431","Macro F1 (10-fold)":"0.9636"},"uses_additional_data":false,"paper_date":"2018-04-27","paper":"/paper/classification-of-malware-by-using-structural","paper_url":"https://www.aaai.org/ocs/index.php/AAAI/AAAI18/paper/view/16133","paper_title":"Classification of Malware by Using Structural Entropy on Convolutional Neural Networks","code":"https://github.com/danielgibert/mlw_classification_structural_entropy","n_code_links":1,"syntology":null},{"rank_in_archive_order":12,"model":"CNN+BiLSTM","metrics":{"Accuracy (10-fold)":"0.9820","LogLoss":"0.0744","Macro F1 (10-fold)":"0.9605"},"uses_additional_data":false,"paper_date":"2019-09-30","paper":"/paper/a-hierarchical-convolutional-neural-network","paper_url":"https://ieeexplore.ieee.org/abstract/document/8852469","paper_title":"A Hierarchical Convolutional Neural Network for Malware Classification","code":null,"n_code_links":0,"syntology":null},{"rank_in_archive_order":13,"model":"Scaled bytes sequence + CNN & Bidirectional LSTM","metrics":{"Accuracy (10-fold)":"0.9814","Macro F1 (10-fold)":"0.9662"},"uses_additional_data":false,"paper_date":"2020-05-12","paper":"/paper/hydra-a-multimodal-deep-learning-framework","paper_url":"https://www.sciencedirect.com/science/article/pii/S0167404820301462","paper_title":"HYDRA: A multimodal deep learning framework for malware classification","code":"https://github.com/danielgibert/mlw_classification_hydra","n_code_links":1,"syntology":null},{"rank_in_archive_order":14,"model":"Grayscale images + Opcode N-grams (Feature selection for malware classification)","metrics":{"Accuracy (10-fold)":"0.9770"},"uses_additional_data":false,"paper_date":"2020-09-28","paper":"/paper/orthrus-a-bimodal-learning-architecture-for","paper_url":"https://ieeexplore.ieee.org/document/9206671","paper_title":"Orthrus: A Bimodal Learning Architecture for Malware Classification","code":"https://github.com/danielgibert/mlw_classification_orthrus","n_code_links":1,"syntology":null},{"rank_in_archive_order":15,"model":"DeepConv","metrics":{"Accuracy (10-fold)":"0.9756","LogLoss":"0.1602","Macro F1 (10-fold)":"0.9071"},"uses_additional_data":false,"paper_date":"2019-09-30","paper":"/paper/a-hierarchical-convolutional-neural-network","paper_url":"https://ieeexplore.ieee.org/abstract/document/8852469","paper_title":"A Hierarchical Convolutional Neural Network for Malware Classification","code":null,"n_code_links":0,"syntology":null},{"rank_in_archive_order":16,"model":"Gray-scale IMG CNN","metrics":{"Accuracy (10-fold)":"0.9750","Accuracy (5-fold)":"0.973","LogLoss":"0.184483","Macro F1 (10-fold)":"0.9400"},"uses_additional_data":false,"paper_date":"2018-08-27","paper":"/paper/using-convolutional-neural-networks-for-1","paper_url":"https://link.springer.com/article/10.1007/s11416-018-0323-0","paper_title":"Using Convolutional Neural Networks for Classification of Malware represented as Images","code":"https://github.com/danielgibert/mlw_classification_cnn_img","n_code_links":1,"syntology":null},{"rank_in_archive_order":17,"model":"Hierarchical Attention Network","metrics":{"Accuracy (10-fold)":"0.9742","LogLoss":"0.0933","Macro F1 (10-fold)":"0.9468"},"uses_additional_data":false,"paper_date":"2019-09-30","paper":"/paper/a-hierarchical-convolutional-neural-network","paper_url":"https://ieeexplore.ieee.org/abstract/document/8852469","paper_title":"A Hierarchical Convolutional Neural Network for Malware Classification","code":null,"n_code_links":0,"syntology":null},{"rank_in_archive_order":18,"model":"Structural entropy CNN","metrics":{"Accuracy (10-fold)":"0.9708","LogLoss":"0.134624","Macro F1 (10-fold)":"0.9314"},"uses_additional_data":false,"paper_date":"2018-04-27","paper":"/paper/classification-of-malware-by-using-structural","paper_url":"https://www.aaai.org/ocs/index.php/AAAI/AAAI18/paper/view/16133","paper_title":"Classification of Malware by Using Structural Entropy on Convolutional Neural Networks","code":"https://github.com/danielgibert/mlw_classification_structural_entropy","n_code_links":1,"syntology":null},{"rank_in_archive_order":19,"model":"Narayanan et al. (2016): PCA features + 1-NN","metrics":{"Accuracy (10-fold)":"0.9660","Macro F1 (10-fold)":"0.9102"},"uses_additional_data":false,"paper_date":"2020-05-12","paper":"/paper/hydra-a-multimodal-deep-learning-framework","paper_url":"https://www.sciencedirect.com/science/article/pii/S0167404820301462","paper_title":"HYDRA: A multimodal deep learning framework for malware classification","code":"https://github.com/danielgibert/mlw_classification_hydra","n_code_links":1,"syntology":null},{"rank_in_archive_order":20,"model":"Deep Transferred Generative Adversarial Networks","metrics":{"Accuracy (10-fold)":"0.9639"},"uses_additional_data":false,"paper_date":"2020-09-28","paper":"/paper/orthrus-a-bimodal-learning-architecture-for","paper_url":"https://ieeexplore.ieee.org/document/9206671","paper_title":"Orthrus: A Bimodal Learning Architecture for Malware Classification","code":"https://github.com/danielgibert/mlw_classification_orthrus","n_code_links":1,"syntology":null},{"rank_in_archive_order":21,"model":"Zero Rule Classifier","metrics":{"Accuracy (10-fold)":"0.2707"},"uses_additional_data":false,"paper_date":"2020-05-12","paper":"/paper/hydra-a-multimodal-deep-learning-framework","paper_url":"https://www.sciencedirect.com/science/article/pii/S0167404820301462","paper_title":"HYDRA: A multimodal deep learning framework for malware classification","code":"https://github.com/danielgibert/mlw_classification_hydra","n_code_links":1,"syntology":null},{"rank_in_archive_order":22,"model":"Random Guess Classifier","metrics":{"Accuracy (10-fold)":"0.1755"},"uses_additional_data":false,"paper_date":"2020-05-12","paper":"/paper/hydra-a-multimodal-deep-learning-framework","paper_url":"https://www.sciencedirect.com/science/article/pii/S0167404820301462","paper_title":"HYDRA: A multimodal deep learning framework for malware classification","code":"https://github.com/danielgibert/mlw_classification_hydra","n_code_links":1,"syntology":null},{"rank_in_archive_order":23,"model":"Multiresolution CNN + Bagging","metrics":{"LogLoss":"0.075081"},"uses_additional_data":false,"paper_date":"2018-04-27","paper":"/paper/classification-of-malware-by-using-structural","paper_url":"https://www.aaai.org/ocs/index.php/AAAI/AAAI18/paper/view/16133","paper_title":"Classification of Malware by Using Structural Entropy on Convolutional Neural Networks","code":"https://github.com/danielgibert/mlw_classification_structural_entropy","n_code_links":1,"syntology":null},{"rank_in_archive_order":24,"model":"MalConv","metrics":{"Accuracy (10-fold)":"0,9641","LogLoss":"0.3071","Macro F1 (10-fold)":"0.8902"},"uses_additional_data":false,"paper_date":"2019-09-30","paper":"/paper/a-hierarchical-convolutional-neural-network","paper_url":"https://ieeexplore.ieee.org/abstract/document/8852469","paper_title":"A Hierarchical Convolutional Neural Network for Malware Classification","code":null,"n_code_links":0,"syntology":null},{"rank_in_archive_order":25,"model":"TPOT Classifier","metrics":{"Accuracy (5-fold)":"98.94"},"uses_additional_data":false,"paper_date":"2021-12-10","paper":"/paper/malware-classification-using-static","paper_url":"https://arxiv.org/abs/2201.07649v1","paper_title":"Malware Classification Using Static Disassembly and Machine Learning","code":"https://github.com/czs108/microsoft-malware-classification","n_code_links":2,"syntology":null},{"rank_in_archive_order":26,"model":"CNN BiLSTM - Reb Sampl","metrics":{"Accuracy (5-fold)":"98.20","F1 score (5-fold)":"96.05"},"uses_additional_data":false,"paper_date":"2018-07-22","paper":"/paper/deep-learning-at-the-shallow-end-malware","paper_url":"http://arxiv.org/abs/1807.08265v1","paper_title":"Deep learning at the shallow end: Malware classification for non-domain experts","code":"https://bitbucket.org/ceadarireland/deeplearningattheshallowend","n_code_links":1,"syntology":null},{"rank_in_archive_order":27,"model":"Haralick features + XGBoost","metrics":{"Accuracy (5-fold)":"0.9550"},"uses_additional_data":false,"paper_date":"2018-08-27","paper":"/paper/using-convolutional-neural-networks-for-1","paper_url":"https://link.springer.com/article/10.1007/s11416-018-0323-0","paper_title":"Using Convolutional Neural Networks for Classification of Malware represented as Images","code":"https://github.com/danielgibert/mlw_classification_cnn_img","n_code_links":1,"syntology":null},{"rank_in_archive_order":28,"model":"LBP features + XGBoost","metrics":{"Accuracy (5-fold)":"0.951"},"uses_additional_data":false,"paper_date":"2018-08-27","paper":"/paper/using-convolutional-neural-networks-for-1","paper_url":"https://link.springer.com/article/10.1007/s11416-018-0323-0","paper_title":"Using Convolutional Neural Networks for Classification of Malware represented as Images","code":"https://github.com/danielgibert/mlw_classification_cnn_img","n_code_links":1,"syntology":null},{"rank_in_archive_order":29,"model":"GA Designed Deep CNN","metrics":{"Accuracy":"0.9307"},"uses_additional_data":false,"paper_date":"2022-07-18","paper":"/paper/designing-deep-convolutional-neural-networks-1","paper_url":"https://ieeexplore.ieee.org/document/9870218","paper_title":"Designing Deep Convolutional Neural Networks using a Genetic Algorithm for Image-based Malware Classification","code":null,"n_code_links":0,"syntology":null}],"since_archive":{"claim":"Results that newer papers report for their own method, placed here by Syntology. A model pointed at the cell in the paper's own table; the number was read from that cell and checked against this leaderboard's metric, dataset, split and scale; an independent check that saw this leaderboard's other rows and every other leaderboard on the same dataset accepted it. Not reviewed by the paper's authors or by the archive's editors, and not ranked against the archive rows.","extraction_file_present":true,"measurement":{"test_papers":883,"papers_with_output":881,"judged_true":108,"judged":110,"wilson95_lower":0.9361,"measured_on":"2026-09-24","frozen_commit":"0e3de0df94"},"measurement_note":"blind adjudication of accepted entries on a held-out split of archive papers, rules frozen before the test","coverage":{"sentence":"Syntology has checked 6,264 of the 9,581 papers on this site that are newer than the archive; results from the others appear after they are checked.","complete":false,"papers_newer_than_archive":9581,"papers_checked":6264,"papers_extracted_not_yet_verified":0,"boards_without_verdict":2,"papers_not_yet_extracted":3316},"order":"newest first by month (arXiv date, else the arXiv-id month), then arXiv id descending","columns":[],"entries":[]},"syntology":{"read_at":"2026-09-24T18:15:14+00:00","claim":"Per row: N of M harvested code samples from that row's paper executed on a synthesized fixture; the other M-N are unverified. Not a reproduction of the row's number; not a correctness claim. n_pointer_only_licence counts samples the site points at rather than redistributes (a licence axis, independent of ran/unverified).","rows_with_graph_line":0,"rows_with_any_sample_ran":0,"distinct_papers_with_graph_line":0,"distinct_papers_with_any_sample_ran":0,"samples_over_distinct_papers":{"n_ran":0,"n_unverified":0,"n_samples":0,"n_pointer_only_licence":0,"note":"each paper (arXiv id) counted once, however many rows it is behind; this is the page-level figure"},"samples_row_weighted":{"n_ran":0,"n_unverified":0,"n_samples":0,"n_pointer_only_licence":0,"note":"row-weighted: a paper behind several rows is counted once per row; inflated relative to samples_over_distinct_papers by design, kept for readers summing the per-row syntology blocks"}}}