FDM: A Framework for Decision-making to build ML-based Malware detection systems
Proposes FDM framework using WCCS to optimize ML configurations for malware detection across diverse deployment scenarios.
Key Findings
Methodology
The study introduces FDM, which employs five operational parameters (platform constraints, resource budget, latency, update frequency, detection sensitivity) to compute WCCS scores. These scores guide the selection among nine configuration dimensions, covering data collection, feature engineering, model choice, and update strategies. Extensive experiments on three datasets—private Windows API, Malimg, and Android API—evaluate models like XGBoost, LSTM, BiLSTM, EfficientNetB0, and ResNet50. Results show XGBoost achieves 97.46% accuracy with less than 70MB RAM, outperforming LSTM/BiLSTM (up to 2.8GB). In multi-class tasks, classical models outperform deep models, reversing binary classification trends. Transfer learning reduces training time by 2.14×, while autoencoders speed training 14× with minimal accuracy loss (0.86%). These findings validate the context-dependent nature of optimal ML configurations.
Key Results
- XGBoost achieves 97.46% accuracy in binary malware classification with minimal resource use, demonstrating suitability for edge deployment.
- In multi-class classification, traditional models outperform deep models, indicating task-specific architecture needs.
- Transfer learning accelerates training significantly without accuracy compromise, confirming its practical value.
Significance
This work systematically addresses the complex challenge of selecting optimal ML configurations tailored to operational constraints, filling a gap in existing malware detection research. By formalizing decision-making through WCCS, it offers cybersecurity practitioners a quantifiable, adaptable tool to enhance detection performance across diverse environments. The framework bridges the gap between theoretical model performance and real-world deployment needs, enabling scalable, resource-aware, and context-sensitive security solutions. Its practical utility extends to IoT, enterprise endpoints, and cloud systems, fostering more resilient and efficient cybersecurity defenses in an era of rapidly evolving threats.
Technical Contribution
The core innovation lies in the WCCS scoring mechanism, which systematically quantifies the compatibility of ML configurations with operational parameters. This multi-criteria approach integrates five key input dimensions into a unified ranking system, guiding optimal model selection. The framework’s flexibility allows incorporation of diverse models, transfer learning, and autoencoder-based feature extraction, validated through extensive experiments. It advances the state-of-the-art by providing a formal, scalable, and context-aware decision support tool that can adapt to changing operational environments, addressing a critical need in cybersecurity deployment.
Novelty
This is the first comprehensive framework explicitly designed for context-aware ML configuration selection in malware detection, combining multi-criteria decision analysis with empirical validation. Unlike prior isolated studies focusing on specific models or datasets, FDM offers a systematic, adaptable approach that considers operational constraints, making it highly applicable in real-world scenarios. Its integration of WCCS with multi-model benchmarking and transfer learning represents a significant step forward in deployment-oriented cybersecurity research.
Limitations
- The current framework primarily relies on static API features and does not fully incorporate dynamic behavioral analysis, which limits detection of evasive malware.
- Experiments are conducted in controlled environments; real-world heterogeneity and hardware diversity may introduce additional challenges.
- Scalability to extremely resource-constrained devices or ultra-low latency scenarios remains to be validated.
Future Work
Future efforts will focus on integrating dynamic behavior features, exploring multi-modal data fusion, and developing adaptive online configuration mechanisms. Incorporating automated hyperparameter tuning and reinforcement learning could further enhance system robustness. Extending the framework to support real-time continuous adaptation and broader deployment scenarios, including industrial IoT and cloud-native environments, is also planned.
AI Executive Summary
In the rapidly evolving landscape of cybersecurity, malware detection remains a critical challenge. Traditional signature-based methods are increasingly ineffective against sophisticated evasion techniques, zero-day exploits, and polymorphic variants. Machine learning models, especially deep learning, have shown promise in identifying malicious patterns, but their deployment is hampered by the complexity of configuration choices. Different operational environments impose diverse constraints—ranging from limited hardware resources to strict latency requirements—making a one-size-fits-all solution impractical.
To address this, the authors propose the FDM (Decision-Making Framework), a systematic approach that leverages a multi-criteria scoring system called WCCS. This mechanism quantifies how well each ML configuration aligns with operational parameters, enabling automated, context-aware recommendations across nine configuration dimensions. The framework's core strength lies in its ability to adapt model choices, feature extraction methods, and update strategies to specific deployment scenarios.
Extensive experiments validate the framework's effectiveness. For binary malware classification, XGBoost achieves 97.46% accuracy while consuming less than 70MB RAM, outperforming resource-heavy deep models. In multi-class tasks, classical models outperform recurrent neural networks, reversing prior assumptions. Transfer learning reduces training time by over twofold without sacrificing accuracy, and autoencoders accelerate training 14 times with minimal accuracy loss. These results demonstrate that optimal ML configurations are highly context-dependent, and the FDM provides a practical, quantifiable tool for cybersecurity practitioners.
Overall, this work bridges the gap between model performance research and deployment realities. It offers a scalable, flexible decision support system that can be tailored to diverse operational constraints, significantly advancing malware detection capabilities. Future developments will incorporate dynamic features and online adaptation, further enhancing system robustness against emerging threats.
Deep Analysis
Background
恶意软件检测经历了从传统签名匹配到行为分析的演变。早期方法依赖静态签名，易被变体绕过。近年来，深度学习模型如CNN、LSTM被引入，提升检测能力，但配置复杂，难以在多样环境中统一部署。已有研究多关注模型性能，缺乏系统化配置指导，导致模型在不同场景表现不一。多目标优化和动态调优成为研究热点，但缺乏统一支持工具。本文提出FDM，结合多目标决策分析，旨在解决模型配置的场景适应性问题，推动行业标准化和智能化发展。
Core Problem
不同部署环境对恶意软件检测模型提出多样化需求，包括资源限制、响应时间和检测敏感度。单一模型难以兼顾所有目标，导致性能折中或资源浪费。现有方法多依赖经验调优，缺乏系统化决策工具，难以实现场景自适应。如何量化操作参数，自动生成最优配置，成为核心难题。特别是在边缘设备、云端和工业控制系统中，模型配置差异显著，亟需统一的决策支持机制。
Innovation
本研究创新点在于：1）提出基于多目标决策分析的WCCS评分机制，将五个操作参数量化为评分指标，系统指导模型配置；2）结合九个配置维度，覆盖数据采集、特征工程、模型选择、更新策略等全过程；3）在多数据集、多模型、多任务环境中验证，展示不同场景下的配置差异；4）引入迁移学习和自动编码器技术，提升训练效率。这些创新实现了模型配置的场景适应性和科学性，为恶意软件检测提供了理论支撑和实践工具。
Methodology
- �� 确定五个操作参数（平台约束、资源预算、响应延迟、更新频率、检测敏感度）作为输入。
- �� 设计WCCS评分机制，将每个参数映射到九个配置维度（如模型类型、特征提取方法、更新策略等），通过加权求和得到整体评分。
- �� 根据评分排序，生成模型配置建议。
- �� 在三类数据集（私有Windows API、Malimg、Android API）上进行多项实验，包括二分类、多分类、增量学习、迁移学习和自动编码器预处理。
- �� 评估指标涵盖准确率、AUC、训练时间、推理速度、内存占用和模型大小。
- �� 通过实验证明不同场景下配置的优劣，验证WCCS的预测能力。
Experiments
采用三类公开和私有数据集，分别进行二分类、多分类、增量学习和迁移学习实验。模型包括XGBoost、LSTM、BiLSTM、EfficientNetB0、ResNet50等。每个实验设置不同的操作参数组合，评估模型在准确率、训练时间、资源消耗等方面的表现。特别关注在有限资源环境下模型的性能折中，验证迁移学习和自动编码器的效率提升。采用交叉验证和多次重复，确保结果的稳健性。对比不同配置的WCCS评分，验证其预测的优越性。
Results
XGBoost在二分类中达97.46%的测试准确率，RAM占用<70MB，明显优于耗费2.8GB的深度模型。多分类任务中，传统模型（XGBoost 79.03%）优于BiLSTM（72.27%），显示不同任务对模型架构的需求差异。迁移学习平均加速训练时间2.14倍，未显著影响准确率，验证了其实用性。自动编码器预处理实现了14倍训练速度提升，误差仅0.86个百分点。这些结果表明，模型配置应根据场景需求动态调整，WCCS评分能有效指导优化。
Applications
该框架适用于边缘设备、云端安全系统和工业控制环境，帮助安全工程师快速制定符合资源和性能要求的检测模型。通过系统化配置建议，减少调优时间，提高检测效率。未来，结合自动化超参数调优和在线学习，将实现更智能的安全防护体系，适应不断变化的威胁环境。
Limitations & Outlook
目前框架主要基于静态特征和API调用数据，动态行为分析和多模态融合仍待完善。实验环境偏向特定硬件，实际部署中硬件异构性可能影响效果。模型在极端资源限制或检测敏感度极高场景下的表现尚未充分验证。未来需扩展多模态特征，增强模型鲁棒性，优化自动调参机制。
Plain Language Accessible to non-experts
想象你在管理一个工厂，工厂里有很多不同的机器和流程。每台机器可以用不同的方式操作，有的快但不太准确，有的慢但很稳。工厂的目标是既要快，又要保证产品质量，还要节省能源。你需要根据工厂的具体情况（比如空间、能源、时间限制）选择最合适的机器和操作方式。这个选择过程就像论文中的FDM框架，它帮你用一套评分系统，把各种不同的配置按优劣排序，找到最适合当前工厂条件的方案。这样，无论工厂的条件如何变化，你都能快速找到最合适的操作方案，保证生产效率和质量。
ELI14 Explained like you're 14
想象你在学校里组织一个比赛，你需要决定用什么样的规则和设备，让比赛既公平又有趣。不同的场地、人数、时间限制，都影响你怎么安排。比如，有的场地空间小，不能用太多设备；有的比赛时间短，就不能安排太复杂的规则。你得根据这些条件，选择最合适的规则和设备组合。论文里的方法就像一个聪明的助手，它帮你用一个评分系统，把所有可能的方案都打分，然后告诉你哪个方案最适合你的比赛条件。这样，你就不用自己一遍遍试错，可以快速找到最棒的安排，让比赛顺利又有趣。
Abstract
Selecting appropriate machine learning (ML) configurations for malware detection is a complex, multi-criteria problem. Model choice, feature engineering, and update mechanisms must jointly satisfy operational constraints that vary across deployment contexts. This paper proposes the Framework for Decision-making (FDM) to build ML-based malware detection systems. The FDM formalises this selection process using the Weighted Configuration Compatibility Score (WCCS), a multi-criteria scoring function mapping five operational parameters (platform constraint, resource budget, response latency, update frequency, and detection sensitivity) to ranked recommendations across nine configuration dimensions. To validate the framework, four experiments were conducted on three datasets (a private Windows API dataset, the public Malimg image benchmark, and an Android static API dataset). Key results include: (i) XGBoost achieved the best accuracy-to-resource ratio in binary classification (97.46 % test accuracy, <70 MB RAM), outperforming LSTM/BiLSTM which consumed up to 2.8 GB; (ii) in multi-class classification, classical models (XGBoost 79.03 %) outperformed recurrent deep models (BiLSTM 72.27 %), reversing the binary ranking; (iii) class-incremental learning with EfficientNetB0 maintained 99.13 % accuracy with only 0.65 pp degradation across 11 incremental steps; (iv) transfer learning reduced training time by 2.14 times on average for image-based malware data without significant accuracy cost; and (v) autoencoder pre-processing yielded a 14 times training speedup at a cost of only 0.86 pp accuracy. These findings confirm that the optimal ML configuration is context-dependent, validating the FDM's core premise and demonstrating its practical utility for cybersecurity practitioners.