Malware Detection

Description from the archive archive 2025-07-28.

Benchmarks archive 2025-07-28

2 leaderboard tables shown for this task, 2 with rows (a “benchmark” on this site is a table with at least one row, as on /sota), ordered by row count. “Best model” is the first row in the archive's own order at snapshot; nothing is re-ranked here and metric direction is not recorded in the archive. PwC's Trend sparklines are not in the archive, so that column is omitted.

Syntology column: samples harvested from the paper's repositories and executed on synthesized fixtures; “ran” is not a correctness claim and does not order the table. A dash means no Syntology record for that paper, not a recorded non-run. Read from the graph 2026-09-24.

Libraries

Not in the archive: the export carries no per-task library table, so there is nothing to show at snapshot 2025-07-28.

Datasets archive 2025-07-28

5 datasets whose archive record lists this task, ordered by the archive's paper count.

Subtasks archive 2025-07-28

No subtask under this task in the archive's task tree.

Parent tasks archive 2025-07-28

Most implemented papers archive 2025-07-28

30 shown of 108 papers with code (431 tagged with this task in all), ordered by repositories listed in the archive, not by stars (the archive holds no stars, so PwC's “Social” and “Latest” sorts cannot be reproduced). Papers without a page here are shown as plain text.

• Malware Detection by Eating a Whole EXE
  25 Oct 2017 7 repositories listed Syntology ran 0 of 7 samples · 7 unverified
  In this work we introduce malware detection from raw byte sequences as a fruitful research area to the larger machine learning community.
• Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
  13 Mar 2018 4 repositories listed Syntology ran 3 of 3 samples · 0 unverified
  However, deep learning is often criticized for its lack of robustness in adversarial settings (e.
• Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
  20 Feb 2017 4 repositories listed
  A generative network is trained to minimize the generated adversarial examples' malicious probabilities predicted by the substitute detector.
• Automatic Malware Description via Attribute Tagging and Similarity Embedding
  15 May 2019 3 repositories listed
  With the rapid proliferation and increased sophistication of malicious software (malware), detection methods no longer rely only on manually generated signatures but have also incorporated more general approaches like…
• DeepXplore: Automated Whitebox Testing of Deep Learning Systems
  18 May 2017 3 repositories listed
  First, we introduce neuron coverage for systematically measuring the parts of a DL system exercised by test inputs.
• subgraph2vec: Learning Distributed Representations of Rooted Sub-graphs from Large Graphs
  29 Jun 2016 3 repositories listed
  Also, we show that the subgraph vectors could be used for building a deep learning variant of Weisfeiler-Lehman graph kernel.
• EMBER2024 -- A Benchmark Dataset for Holistic Evaluation of Malware Classifiers
  5 Jun 2025 2 repositories listed
  A lack of accessible data has historically restricted malware analysis research, and practitioners have relied heavily on datasets provided by industry sources to advance.
• Continuous Learning for Android Malware Detection
  8 Feb 2023 2 repositories listed
  We propose a new hierarchical contrastive learning scheme, and a new sample selection technique to continuously train the Android malware classifier.
• RS-Del: Edit Distance Robustness Certificates for Sequence Classifiers via Randomized Deletion
  31 Jan 2023 2 repositories listed Syntology ran 5 of 14 samples · 9 unverified
  When applied to the popular MalConv malware detection model, our smoothing mechanism RS-Del achieves a certified accuracy of 91% at an edit distance radius of 128 bytes.
• Evading Malware Classifiers via Monte Carlo Mutant Feature Discovery
  15 Jun 2021 2 repositories listed
  The use of Machine Learning has become a significant part of malware detection efforts due to the influx of new malware, an ever changing threat landscape, and the ability of Machine Learning methods to discover…
• Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection
  17 Aug 2020 2 repositories listed
  Recent work has shown that adversarial Windows malware samples - referred to as adversarial EXEmples in this paper - can bypass machine learning-based detection relying on static code analysis by perturbing relatively…
• Probabilistic Jacobian-based Saliency Maps Attacks
  12 Jul 2020 2 repositories listed
  Neural network classifiers (NNCs) are known to be vulnerable to malicious adversarial perturbations of inputs including those modifying a small fraction of the input features named sparse or L₀ attacks.
• Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attacks
  23 Jun 2020 2 repositories listed
  We propose a versatile framework based on random search, Sparse-RS, for score-based sparse targeted and untargeted attacks in the black-box setting.
• Dynamic Malware Analysis with Feature Engineering and Feature Learning
  17 Jul 2019 2 repositories listed
  In this paper, we propose a novel and low-cost feature extraction approach, and an effective deep neural network architecture for accurate and fast malware detection.
• Evaluating Explanation Methods for Deep Learning in Security
  5 Jun 2019 2 repositories listed
  Deep learning is increasingly used as a building block of security systems.
• Efficient Formal Safety Analysis of Neural Networks
  19 Sep 2018 2 repositories listed
  Our approach can check different safety properties and find concrete counterexamples for networks that are 10× larger than the ones supported by existing analysis techniques.
• DeepSign: Deep Learning for Automatic Malware Signature Generation and Classification
  21 Nov 2017 2 repositories listed
  While conventional signature and token based methods for malware detection do not detect a majority of new variants for existing malware, the results presented in this paper show that signatures generated by the DBN…
• Learning the PE Header, Malware Detection with Minimal Domain Knowledge
  5 Sep 2017 2 repositories listed
  Many efforts have been made to use various forms of domain knowledge in malware detection.
• A learning model to detect maliciousness of portable executable using integrated feature set
  31 Jan 2017 2 repositories listed
  In the experiments conducted on the novel test data set the accuracy was observed as 89.
• LAMDA: A Longitudinal Android Malware Benchmark for Concept Drift Analysis
  24 May 2025 1 repository listed
  In practice, these distributions evolve due to frequent changes in the Android ecosystem, adversarial development of new malware families, and the continuous emergence of both benign and malicious applications.
• Evaluating the Robustness of Adversarial Defenses in Malware Detection Systems
  14 May 2025 1 repository listed
  Adversarially trained defenses, including AT-rFGSM-k, AT-MaxMA, improves robustness under small budgets but remains vulnerable to unrestricted perturbations, with attack success rates of 99.
• Cyber Security Data Science: Machine Learning Methods and their Performance on Imbalanced Datasets
  7 May 2025 1 repository listed
  Therefore, we recommend testing single classifiers and imbalance learning techniques for each new dataset and application involving imbalanced datasets as is the case in several cyber security applications.
• Imbalanced malware classification: an approach based on dynamic classifier selection
  30 Mar 2025 1 repository listed
  This study addresses the often-overlooked issue of class imbalance in malware detection by evaluating various machine learning strategies for detecting malware in Android applications.
• CyberLLMInstruct: A New Dataset for Analysing Safety of Fine-Tuned LLMs Using Cyber Security Data
  12 Mar 2025 1 repository listed
  In our primary example, we rigorously assess the safety of fine-tuned models using the OWASP top 10 framework, finding that fine-tuning reduces safety resilience across all tested LLMs and every adversarial attack (e.
• Malware Detection based on API calls
  18 Feb 2025 1 repository listed
  We also empirically show that we only need a subset of the function call sequence, specifically calls to the ntdll.
• Crystal ball: From innovative attacks to attack effectiveness classifier
  24 Dec 2024 1 repository listed
  This study presents a set of innovative problem-based evasion attacks against well-known Android malware detection systems, which decrease their detection rate by up to 97%.
• MASKDROID: Robust Android Malware Detection with Masked Graph Representations
  29 Sep 2024 1 repository listed
  Among the various tools employed in malware detection, graph representations (e.
• Accelerating Malware Classification: A Vision Transformer Solution
  28 Sep 2024 1 repository listed Syntology ran 0 of 1 samples · 1 unverified
  The escalating frequency and scale of recent malware attacks underscore the urgent need for swift and precise malware classification in the ever-evolving cybersecurity landscape.
• DetectBERT: Towards Full App-Level Representation Learning to Detect Android Malware
  29 Aug 2024 1 repository listed
  Recent advancements in ML and DL have significantly improved Android malware detection, yet many methodologies still rely on basic static analysis, bytecode, or function call graphs that often fail to capture complex…
• Improving Adversarial Robustness in Android Malware Detection by Reducing the Impact of Spurious Correlations
  27 Aug 2024 1 repository listed
  In particular, our defense can improve adversarial robustness by up to 55% against realistic evasion attacks compared to Sec-SVM.

Syntology lines on 4 of the papers shown; no Syntology record for the others (a paper without an arXiv id cannot be joined to the graph, and absence from the graph layer is not a recorded non-run). “Ran” means the sample executed on a synthesized fixture, not that the paper's result was reproduced. Read from the graph 2026-09-24.