Malware Classification

Description from the archive archive 2025-07-28.

Benchmarks archive 2025-07-28

3 leaderboard tables shown for this task, 3 with rows (a “benchmark” on this site is a table with at least one row, as on /sota), ordered by row count. “Best model” is the first row in the archive's own order at snapshot; nothing is re-ranked here and metric direction is not recorded in the archive. PwC's Trend sparklines are not in the archive, so that column is omitted.

Syntology column: samples harvested from the paper's repositories and executed on synthesized fixtures; “ran” is not a correctness claim and does not order the table. A dash means no Syntology record for that paper, not a recorded non-run. Read from the graph 2026-09-24.

Libraries

Not in the archive: the export carries no per-task library table, so there is nothing to show at snapshot 2025-07-28.

Datasets archive 2025-07-28

7 datasets whose archive record lists this task, ordered by the archive's paper count.

Subtasks archive 2025-07-28

4 subtasks in the archive's task tree.

Most implemented papers archive 2025-07-28

30 shown of 47 papers with code (146 tagged with this task in all), ordered by repositories listed in the archive, not by stars (the archive holds no stars, so PwC's “Social” and “Latest” sorts cannot be reproduced). Papers without a page here are shown as plain text.

• Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification
  13 Nov 2015 19 repositories listed
  This paradigm is presented and discussed in the present paper, where emphasis has been given to the phases related to the extraction, and selection of a set of novel features for the effective representation of malware…
• A New Burrows Wheeler Transform Markov Distance
  30 Dec 2019 4 repositories listed Syntology ran 2 of 3 samples · 1 unverified · 3 pointer-only (licence)
  Prior work inspired by compression algorithms has described how the Burrows Wheeler Transform can be used to create a distance measure for bioinformatics problems.
• Learning a Neural-network-based Representation for Open Set Recognition
  12 Feb 2018 3 repositories listed
  Open set recognition problems exist in many domains.
• EMBER2024 -- A Benchmark Dataset for Holistic Evaluation of Malware Classifiers
  5 Jun 2025 2 repositories listed
  A lack of accessible data has historically restricted malware analysis research, and practitioners have relied heavily on datasets provided by industry sources to advance.
• Assemblage: Automatic Binary Dataset Construction for Machine Learning
  7 May 2024 2 repositories listed Syntology ran 1 of 2 samples · 1 unverified · 2 pointer-only (licence)
  Our results illustrate the practical need for robust corpora of high-quality Windows PE binaries in training modern learning-based binary analyses.
• Malware Classification Using Static Disassembly and Machine Learning
  10 Dec 2021 2 repositories listed
  Unlike dynamic behavior analysis, static analysis is resource-efficient and offers complete code coverage, but is vulnerable to code obfuscation and encryption.
• Explanation-Guided Backdoor Poisoning Attacks Against Malware Classifiers
  2 Mar 2020 2 repositories listed
  Training pipelines for machine learning (ML) based malware classification often rely on crowdsourced threat feeds, exposing a natural attack injection point.
• Malware Classification Leveraging NLP & Machine Learning for Enhanced Accuracy
  19 Jun 2025 1 repository listed
  This paper investigates the application of natural language processing (NLP)-based n-gram analysis and machine learning techniques to enhance malware classification.
• Imbalanced malware classification: an approach based on dynamic classifier selection
  30 Mar 2025 1 repository listed
  This study addresses the often-overlooked issue of class imbalance in malware detection by evaluating various machine learning strategies for detecting malware in Android applications.
• MalCL: Leveraging GAN-Based Generative Replay to Combat Catastrophic Forgetting in Malware Classification
  2 Jan 2025 1 repository listed
  Generative Replay (GR)-based CL systems utilize a generative model to produce synthetic versions of past data, which are then combined with new data to retrain the primary model.
• Accelerating Malware Classification: A Vision Transformer Solution
  28 Sep 2024 1 repository listed Syntology ran 0 of 1 samples · 1 unverified
  The escalating frequency and scale of recent malware attacks underscore the urgent need for swift and precise malware classification in the ever-evolving cybersecurity landscape.
• High-resolution Image-based Malware Classification using Multiple Instance Learning
  21 Nov 2023 1 repository listed
  This paper proposes a novel method of classifying malware into families using high-resolution greyscale images and multiple instance learning to overcome adversarial binary enlargement.
• Nebula: Self-Attention for Dynamic Malware Analysis
  19 Sep 2023 1 repository listed
  Dynamic analysis enables detecting Windows malware by executing programs in a controlled environment and logging their actions.
• Decoding the Secrets of Machine Learning in Malware Classification: A Deep Dive into Datasets, Feature Extraction, and Model Performance
  27 Jul 2023 1 repository listed
  As a consequence, our community still lacks an understanding of malware classification results: whether they are tied to the nature and distribution of the collected dataset, to what extent the number of families and…
• Recasting Self-Attention with Holographic Reduced Representations
  31 May 2023 1 repository listed Syntology ran 0 of 11 samples · 11 unverified
  In recent years, self-attention has become the dominant paradigm for sequence modeling in a variety of domains.
• Sequential Embedding-based Attentive (SEA) classifier for malware classification
  11 Feb 2023 1 repository listed
  The tremendous growth in smart devices has uplifted several security threats.
• A Dynamic Weighted Federated Learning for Android Malware Classification
  23 Nov 2022 1 repository listed
  In traditional FL, Federated Averaging (FedAvg) is utilized to construct the global model at each round by merging all of the local models obtained from all of the customers that participated in the FL.
• Self-Supervised Vision Transformers for Malware Detection
  15 Aug 2022 1 repository listed Syntology ran 4 of 8 samples · 4 unverified
  Malware detection plays a crucial role in cyber-security with the increase in malware growth and advancements in cyber-attacks.
• On the Limitations of Continual Learning for Malware Classification
  13 Aug 2022 1 repository listed
  To our surprise, continual learning methods significantly underperformed naive Joint replay of the training data in nearly all settings -- in some cases reducing accuracy by more than 70 percentage points.
• On deceiving malware classification with section injection
  12 Aug 2022 1 repository listed
  Our results show that a mere increase of 7% in the malware size causes an accuracy drop between 25% and 40% for malware family classification.
• An Ensemble of Pre-trained Transformer Models For Imbalanced Multiclass Malware Classification
  25 Dec 2021 1 repository listed
  Furthermore, the proposed bagging-based random transformer forest (RTF), an ensemble of BERT or CANINE, has reached the state-of-the-art evaluation scores on three out of four datasets, particularly state-of-the-art…
• A Comprehensive Study on Learning-Based PE Malware Family Classification Methods
  29 Oct 2021 1 repository listed
  PE malware family classification has gained great attention and a large number of approaches have been proposed.
• An Empirical Analysis of Image-Based Learning Techniques for Malware Classification
  24 Mar 2021 1 repository listed
  In this paper, we consider malware classification using deep learning techniques and image-based features.
• Deep Learning for Android Malware Defenses: a Systematic Literature Review
  9 Mar 2021 1 repository listed
  In this paper, we conducted a systematic literature review to search and analyze how deep learning approaches have been applied in the context of malware defenses in the Android environment.
• Adversarial Robustness with Non-uniform Perturbations
  24 Feb 2021 1 repository listed Syntology ran 1 of 1 samples · 0 unverified
  Robustness of machine learning models is critical for security related applications, where real-world adversaries are uniquely focused on evading neural network based detectors.
• Orthrus: A Bimodal Learning Architecture for Malware Classification
  28 Sep 2020 1 repository listed
  Malware detection and classification is a challenging problem and an active area of research.
• DAEMON: Dataset-Agnostic Explainable Malware Classification Using Multi-Stage Feature Mining
  4 Aug 2020 1 repository listed
  Moreover, malware classification facilitates determining which of the newly discovered variants should undergo manual analysis by a security expert, in order to determine whether they belong to a new family (e.
• Less is More: A privacy-respecting Android malware classifier using Federated Learning
  16 Jul 2020 1 repository listed
  In this paper we present LiM ("Less is More"), a malware classification framework that leverages Federated Learning to detect and classify malicious apps in a privacy-respecting manner.
• HYDRA: A multimodal deep learning framework for malware classification
  12 May 2020 1 repository listed
  While traditional machine learning methods for malware detection largely depend on hand-designed features, which are based on experts’ knowledge of the domain, end-to-end learning approaches take the raw executable as…
• Why an Android App is Classified as Malware? Towards Malware Classification Interpretation
  24 Apr 2020 1 repository listed
  In this paper, to fill this gap, we propose a novel and interpretable ML-based approach (named XMal) to classify malware with high accuracy and explain the classification result meanwhile.

Syntology lines on 6 of the papers shown; no Syntology record for the others (a paper without an arXiv id cannot be joined to the graph, and absence from the graph layer is not a recorded non-run). “Ran” means the sample executed on a synthesized fixture, not that the paper's result was reproduced. Read from the graph 2026-09-24.