{"url":"/task/malware-classification","name":"Malware Classification","slug":"malware-classification","description_markdown":"**Malware Classification** is the process of assigning a malware sample to a specific malware family. Malware within a family shares similar properties that can be used to create signatures for detection and classification. Signatures can be categorized as static or dynamic based on how they are extracted. A static signature can be based on a byte-code sequence, binary assembly instruction, or an imported Dynamic Link Library (DLL). Dynamic signatures can be based on file system activities, terminal commands, network communications, or function and system call sequences.\r\n\r\n\r\n<span class=\"description-source\">Source: [Behavioral Malware Classification using Convolutional Recurrent Neural Networks ](https://arxiv.org/abs/1811.07842)</span>","categories":[{"name":"Miscellaneous","url":"/area/miscellaneous"}],"source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","slug_source":"archive_url"},"counts":{"papers_tagged":146,"papers_with_code":47,"benchmarks":3,"benchmark_tables_in_archive":3,"benchmark_tables_shown":3,"benchmark_tables_withheld_as_spam":0,"benchmark_definition":"a leaderboard table with at least one row; benchmark_tables_shown also counts the zero-row tables; benchmark_tables_in_archive adds the tables withheld as spam","datasets":7,"subtasks":4,"parent_tasks":0},"benchmarks":[{"leaderboard":"/sota/malware-classification-on-microsoft-malware","slug":"malware-classification-on-microsoft-malware","dataset":"Microsoft Malware Classification Challenge","dataset_url":"/dataset/microsoft-malware-classification-challenge","rows_in_archive":29,"metrics":["Accuracy (10-fold)","LogLoss","Macro F1 (10-fold)","Accuracy (5-fold)","F1 score (5-fold)","Accuracy"],"first_row_in_archive_order":{"model":"Ahmadi et al. (2016): ENT, Bytes 1-G, STR, IMG1, IMG2, MD1, MISC, OPC, SEC, REG, DP, API, SYM, MD2 IMG and Opcode N-Grams + Ensemble Learning (XGBoost)","paper_title":"HYDRA: A multimodal deep learning framework for malware classification","paper_url":"/paper/hydra-a-multimodal-deep-learning-framework","paper_date":"2020-05-12","arxiv_id":null,"code_links":[{"title":"danielgibert/mlw_classification_hydra","url":"https://github.com/danielgibert/mlw_classification_hydra"}],"syntology":null}},{"leaderboard":"/sota/malware-classification-on-malimg-dataset","slug":"malware-classification-on-malimg-dataset","dataset":"Malimg Dataset","dataset_url":"/dataset/malimg","rows_in_archive":5,"metrics":["Accuracy (10-fold)","Macro F1 (10-fold)","Accuracy","Macro F1"],"first_row_in_archive_order":{"model":"Gray-scale IMG CNN","paper_title":"Using Convolutional Neural Networks for Classification of Malware represented as Images","paper_url":"/paper/using-convolutional-neural-networks-for-1","paper_date":"2018-08-27","arxiv_id":null,"code_links":[{"title":"danielgibert/mlw_classification_cnn_img","url":"https://github.com/danielgibert/mlw_classification_cnn_img"}],"syntology":null}},{"leaderboard":"/sota/malware-classification-on-malevis","slug":"malware-classification-on-malevis","dataset":"MaleVis","dataset_url":null,"rows_in_archive":1,"metrics":["Accuracy"],"first_row_in_archive_order":{"model":"Levit-MC","paper_title":"Accelerating Malware Classification: A Vision Transformer Solution","paper_url":"/paper/accelerating-malware-classification-a-vision","paper_date":"2024-09-28","arxiv_id":"2409.19461","code_links":[{"title":"Shrey-55/MalwareClassification","url":"https://github.com/Shrey-55/MalwareClassification"}],"syntology":{"n":1,"n_ran":0,"n_unverified":1,"n_pointer_only":0}}}],"datasets":[{"url":"/dataset/ember","name":"EMBER","full_name":"","num_papers_in_archive":115},{"url":"/dataset/microsoft-malware-classification-challenge","name":"Microsoft Malware Classification Challenge","full_name":"","num_papers_in_archive":36},{"url":"/dataset/malimg","name":"Malimg","full_name":"","num_papers_in_archive":6},{"url":"/dataset/bodmas","name":"BODMAS","full_name":"Blue Hexagon Open Dataset for Malware AnalysiS","num_papers_in_archive":1},{"url":"/dataset/iot-23","name":"IoT-23","full_name":"IoT-23: A labeled dataset with malicious and benign IoT network traffic","num_papers_in_archive":1},{"url":"/dataset/motif","name":"MOTIF","full_name":"MOTIF: A Large Malware Reference Dataset with Ground Truth Family Labels","num_papers_in_archive":1},{"url":"/dataset/autorobust","name":"AutoRobust","full_name":"","num_papers_in_archive":0}],"subtasks":[{"url":"/task/android-malware-detection","name":"Android Malware Detection"},{"url":"/task/behavioral-malware-classification","name":"Behavioral Malware Classification"},{"url":"/task/behavioral-malware-detection","name":"Behavioral Malware Detection"},{"url":"/task/malware-detection","name":"Malware Detection"}],"parent_tasks":[],"papers":{"order":"repositories listed in the archive (desc), then date (desc); the archive holds no stars","population":"papers tagged with this task that list at least one repository in the archive","shown":30,"of":47,"tagged_in_all":146,"items":[{"url":"/paper/novel-feature-extraction-selection-and-fusion","title":"Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification","date":"2015-11-13","arxiv_id":"1511.04317","repositories_listed":19,"syntology":null},{"url":"/paper/a-new-burrows-wheeler-transform-markov","title":"A New Burrows Wheeler Transform Markov Distance","date":"2019-12-30","arxiv_id":"1912.13046","repositories_listed":4,"syntology":{"n":3,"n_ran":2,"n_unverified":1,"n_pointer_only":3}},{"url":"/paper/learning-a-neural-network-based","title":"Learning a Neural-network-based Representation for Open Set Recognition","date":"2018-02-12","arxiv_id":"1802.04365","repositories_listed":3,"syntology":null},{"url":"/paper/ember2024-a-benchmark-dataset-for-holistic","title":"EMBER2024 -- A Benchmark Dataset for Holistic Evaluation of Malware Classifiers","date":"2025-06-05","arxiv_id":"2506.05074","repositories_listed":2,"syntology":null},{"url":"/paper/assemblage-automatic-binary-dataset","title":"Assemblage: Automatic Binary Dataset Construction for Machine Learning","date":"2024-05-07","arxiv_id":"2405.03991","repositories_listed":2,"syntology":{"n":2,"n_ran":1,"n_unverified":1,"n_pointer_only":2}},{"url":"/paper/malware-classification-using-static","title":"Malware Classification Using Static Disassembly and Machine Learning","date":"2021-12-10","arxiv_id":"2201.07649","repositories_listed":2,"syntology":null},{"url":"/paper/exploring-backdoor-poisoning-attacks-against","title":"Explanation-Guided Backdoor Poisoning Attacks Against Malware Classifiers","date":"2020-03-02","arxiv_id":"2003.01031","repositories_listed":2,"syntology":null},{"url":"/paper/malware-classification-leveraging-nlp-machine","title":"Malware Classification Leveraging NLP & Machine Learning for Enhanced Accuracy","date":"2025-06-19","arxiv_id":"2506.16224","repositories_listed":1,"syntology":null},{"url":"/paper/imbalanced-malware-classification-an-approach","title":"Imbalanced malware classification: an approach based on dynamic classifier selection","date":"2025-03-30","arxiv_id":"2504.00041","repositories_listed":1,"syntology":null},{"url":"/paper/malcl-leveraging-gan-based-generative-replay","title":"MalCL: Leveraging GAN-Based Generative Replay to Combat Catastrophic Forgetting in Malware Classification","date":"2025-01-02","arxiv_id":"2501.01110","repositories_listed":1,"syntology":null},{"url":"/paper/accelerating-malware-classification-a-vision","title":"Accelerating Malware Classification: A Vision Transformer Solution","date":"2024-09-28","arxiv_id":"2409.19461","repositories_listed":1,"syntology":{"n":1,"n_ran":0,"n_unverified":1,"n_pointer_only":0}},{"url":"/paper/high-resolution-image-based-malware","title":"High-resolution Image-based Malware Classification using Multiple Instance Learning","date":"2023-11-21","arxiv_id":"2311.12760","repositories_listed":1,"syntology":null},{"url":"/paper/nebula-self-attention-for-dynamic-malware","title":"Nebula: Self-Attention for Dynamic Malware Analysis","date":"2023-09-19","arxiv_id":"2310.10664","repositories_listed":1,"syntology":null},{"url":"/paper/decoding-the-secrets-of-machine-learning-in","title":"Decoding the Secrets of Machine Learning in Malware Classification: A Deep Dive into Datasets, Feature Extraction, and Model Performance","date":"2023-07-27","arxiv_id":"2307.14657","repositories_listed":1,"syntology":null},{"url":"/paper/recasting-self-attention-with-holographic","title":"Recasting Self-Attention with Holographic Reduced Representations","date":"2023-05-31","arxiv_id":"2305.19534","repositories_listed":1,"syntology":{"n":11,"n_ran":0,"n_unverified":11,"n_pointer_only":0}},{"url":"/paper/sequential-embedding-based-attentive-sea","title":"Sequential Embedding-based Attentive (SEA) classifier for malware classification","date":"2023-02-11","arxiv_id":"2302.05728","repositories_listed":1,"syntology":null},{"url":"/paper/a-dynamic-weighted-federated-learning-for","title":"A Dynamic Weighted Federated Learning for Android Malware Classification","date":"2022-11-23","arxiv_id":"2211.12874","repositories_listed":1,"syntology":null},{"url":"/paper/self-supervised-vision-transformers-for","title":"Self-Supervised Vision Transformers for Malware Detection","date":"2022-08-15","arxiv_id":"2208.07049","repositories_listed":1,"syntology":{"n":8,"n_ran":4,"n_unverified":4,"n_pointer_only":0}},{"url":"/paper/on-the-limitations-of-continual-learning-for","title":"On the Limitations of Continual Learning for Malware Classification","date":"2022-08-13","arxiv_id":"2208.06568","repositories_listed":1,"syntology":null},{"url":"/paper/on-deceiving-malware-classification-with","title":"On deceiving malware classification with section injection","date":"2022-08-12","arxiv_id":"2208.06092","repositories_listed":1,"syntology":null},{"url":"/paper/an-ensemble-of-pre-trained-transformer-models","title":"An Ensemble of Pre-trained Transformer Models For Imbalanced Multiclass Malware Classification","date":"2021-12-25","arxiv_id":"2112.13236","repositories_listed":1,"syntology":null},{"url":"/paper/a-comprehensive-study-on-learning-based-pe","title":"A Comprehensive Study on Learning-Based PE Malware Family Classification Methods","date":"2021-10-29","arxiv_id":"2110.15552","repositories_listed":1,"syntology":null},{"url":"/paper/an-empirical-analysis-of-image-based-learning","title":"An Empirical Analysis of Image-Based Learning Techniques for Malware Classification","date":"2021-03-24","arxiv_id":"2103.13827","repositories_listed":1,"syntology":null},{"url":"/paper/deep-learning-for-android-malware-defenses-a","title":"Deep Learning for Android Malware Defenses: a Systematic Literature Review","date":"2021-03-09","arxiv_id":"2103.05292","repositories_listed":1,"syntology":null},{"url":"/paper/adversarial-robustness-with-non-uniform","title":"Adversarial Robustness with Non-uniform Perturbations","date":"2021-02-24","arxiv_id":"2102.12002","repositories_listed":1,"syntology":{"n":1,"n_ran":1,"n_unverified":0,"n_pointer_only":0}},{"url":"/paper/orthrus-a-bimodal-learning-architecture-for","title":"Orthrus: A Bimodal Learning Architecture for Malware Classification","date":"2020-09-28","arxiv_id":null,"repositories_listed":1,"syntology":null},{"url":"/paper/daemon-dataset-agnostic-explainable-malware","title":"DAEMON: Dataset-Agnostic Explainable Malware Classification Using Multi-Stage Feature Mining","date":"2020-08-04","arxiv_id":"2008.01855","repositories_listed":1,"syntology":null},{"url":"/paper/less-is-more-a-privacy-respecting-android","title":"Less is More: A privacy-respecting Android malware classifier using Federated Learning","date":"2020-07-16","arxiv_id":"2007.08319","repositories_listed":1,"syntology":null},{"url":"/paper/hydra-a-multimodal-deep-learning-framework","title":"HYDRA: A multimodal deep learning framework for malware classification","date":"2020-05-12","arxiv_id":null,"repositories_listed":1,"syntology":null},{"url":"/paper/why-an-android-app-is-classified-as-malware","title":"Why an Android App is Classified as Malware? Towards Malware Classification Interpretation","date":"2020-04-24","arxiv_id":"2004.11516","repositories_listed":1,"syntology":null}],"syntology_records":6,"syntology_note":"a paper without a record is not a recorded non-run: it may lack an arXiv id or simply be absent from the graph layer"},"description_links":{"kept":0,"unwrapped_to_text":0,"bare_urls_linked":0,"relative_images_dropped":0,"rule":"internal links are kept only when the target slug exists in the catalog"},"syntology":{"read_at":"2026-09-24T18:15:14+00:00","claim":"Per-sample execution status on synthesized fixtures ('ran N of M samples'); not a correctness claim and not a ranking signal.","status_vocabulary":{"ran_honours":"ran, honoured the contract we drafted","ran_violates":"ran, violated the contract we drafted","ran_draft_wrong":"ran; our contract draft was wrong, not the code","ran_fixture":"ran; our fixture could not drive it","ran":"ran on a synthesized input","unverified":"unverified (harvested, no recorded run)"}},"not_shown":{"libraries":"the archive has no per-task library table","trend_sparklines":"the Trend column of the benchmarks table was a rendered image; it is not in the archive","social_and_latest_sorts":"stars and social signals are not in the archive"}}