Pith. sign in

REVIEW 6 major objections 5 minor 22 references

Adaptive Malware Detection using Sequential Feature Selection: A Dueling Double Deep Q-Network (D3QN) Framework for Intelligent Classification

T0 review · 6 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A reinforcement-learning agent can classify malware at 99.22% accuracy after revealing only about 61 of 1,795 features, and 98.83% after about 56 of 2,381, beating full-feature ensembles on both benchmark datasets.

desk verdict The D3QN accuracy numbers may be real, but the 30-40x efficiency claim collapses because the agent sees all features at every step. read the letter →

arxiv 2507.04372 v1 pith:YOWD23JF submitted 2025-07-06 cs.LG cs.CR

Naseem Khan , Aref Y. Al-Tamimi , Amine Bermak , Issa M. Khalil This is my paper
classification cs.LGcs.CR
keywords malwareclassificationreinforcementlearningsequentialfeatureselectionduelingdoubledeepQ-networkD3QNMarkovdecisionprocessadaptiveacquisitionefficiency
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that malware classification can be treated as a sequential decision problem: instead of extracting every feature from a file and then classifying, an agent chooses which features to reveal one at a time and stops when it is confident. The proposed D3QN, a dueling double deep Q-network, is trained with a reward that charges a small cost per revealed feature and pays off at correct classification. On two benchmark datasets the authors report 99.22% and 98.83% accuracy using on average 61 and 56 features, a 96.6% and 97.6% reduction, and 30.1x and 42.5x efficiency gains over ensemble baselines. If that holds, adaptive per-sample feature selection would let detection systems spend computation proportional to sample difficulty rather than pay full feature-extraction cost for every file.

What carries the argument

The mechanism is the state-action-reward loop defined by equations (1)-(4): the state is $s = [x; m] \in \mathbb{R}^{2n}$, concatenating all $n$ feature values with an $n$-bit mask of which features have been revealed; the action space has $n$ feature-reveal actions and $k$ classification actions; feature reveals receive reward $-\lambda = -0.0001$, while classification receives $0$ if correct and $-1$ if wrong. A dueling network splits the Q-value into a state-value stream plus mean-normalized action advantages, double Q-learning uses a soft-updated target network to reduce overestimation bias, and invalid re-selections are blocked by a large penalty on already-revealed features. This machinery is meant to induce a policy that reveals features sequentially and terminates with a classification decision.

What would settle it

Measure wall-clock time from a raw executable file to a classification decision for D3QN versus XGBoost or Random Forest when the selected features are actually extracted only as they are revealed; if the roughly 61-feature policy does not run faster end-to-end than the full-feature ensemble, the computational-efficiency claim is not a real deployment gain.

Watch

Extended reading notes

Core claim

The central claim is that a single reinforcement learning policy can learn both which features to acquire and when to classify, and that this joint policy outperforms full-feature ensembles while using only a few dozen features. The authors formulate malware classification as a Markov decision process in which the state is the complete feature vector concatenated with a binary selection mask, feature-selection actions flip mask bits, and classification actions terminate the episode. The learned policy exploits category-level structure, preferring general info, PE header, and byte entropy features early and only selectively pulling in imports and exports, while producing sample-adaptive episode lengths. The authors also report quantitative evidence that the policy is not random: a 62.5% category-preference deviation from uniform baselines and 57.7% of examined features showing significant class-specific discrimination.

Load-bearing premise

The argument rests on treating 'selecting a feature' as flipping a bit in a mask while the classifier still receives every feature value at every step; if that does not correspond to actually skipping feature extraction, the reported speedups do not transfer to a real scanner.

Editorial extensions

If this is right

  • Real-time malware scanners could allocate extraction effort per sample, spending few features on easy files and more on hard ones, instead of always paying the full feature-extraction cost.
  • The same Markov decision process formulation could apply to any high-dimensional classification task where acquiring each feature has a measurable cost, not only PE malware.
  • The learned category preferences provide an interpretable audit trail, letting analysts see which feature groups drove each classification decision.
  • The reported dominance over static global feature-selection baselines suggests that per-sample selection, not just a fixed small subset, is what buys the accuracy-efficiency combination.
  • If the efficiency ratios hold in deployment, replacing a full-feature ensemble with the D3QN policy would cut per-sample feature extraction from roughly 1,795 or 2,381 features to tens of features, enabling sub-second latency.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the reported 30.1x and 42.5x efficiency gains assume that revealing a feature corresponds to physically extracting it; because the network input always includes every feature value and the mask is just a flag, the paper does not measure actual wall-clock extraction cost, so an end-to-end timing study is the missing validation.
  • Editorial inference: a direct test of whether the mask or the full feature vector drives the result is to feed only the selected features to the Q-network; if accuracy or episode length collapses, the full-x state is carrying the decision rather than the sequential policy.
  • Editorial inference: the adaptive-acquisition idea transfers naturally to other security settings with per-sample cost, such as network packet inspection, log triage, or API-call selection in endpoint monitoring.
  • Editorial inference: the intelligence-assessment metrics are defined by the authors themselves; external validation against malware analysts' documented feature priorities would make the interpretability claim stronger.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 5 minor

Summary. The manuscript proposes treating malware classification as a Markov Decision Process in which a Dueling Double Deep Q-Network (D3QN) agent sequentially selects features and then terminates with a class label. The state is defined as the concatenation of the full feature vector and a binary selection mask, actions either reveal an unselected feature or classify, and the reward trades classification accuracy against a feature-acquisition penalty. Experiments on Microsoft Big2015 and BODMAS report roughly 99% accuracy using about 60 features, with claimed 30.1x and 42.5x computational efficiency gains over full-feature ensemble methods, together with a set of 'intelligence metrics' intended to show that the learned selection policy is strategic rather than random.

Significance. If the efficiency claim were correct, the paper would offer a practically relevant way to reduce malware-detection cost while maintaining accuracy, and the attempt to interpret learned feature-category preferences is a useful direction. Strengths include a detailed hyperparameter table, an ablation against several static feature selectors, and a public code link. However, the central efficiency result is not supported by the architecture as defined, the accuracy comparisons lack statistical controls, and several headline numbers are internally inconsistent. As written, the main quantitative contribution does not hold.

major comments (6)
  1. [§3.1, Eq. (1); §4.4] The state s=[x;m] feeds the complete feature vector x to the network at every decision step; the mask m only indicates which features have been 'revealed'. The input dimension is therefore 2n (3,590 for Big2015 and 4,762 for BODMAS), and all n feature values must be available before the episode starts. Consequently, the claimed reduction from O(n*m) to O(k) feature-extraction operations is not realized by this architecture, and the efficiency ratios in Table 2 (total features divided by average selected features) are not measured speedups. The 30.1x and 42.5x claims rest on a metric that the model, as defined, cannot deliver.
  2. [Table 2; §4.4] Even under the paper's own count-ratio definition of efficiency, D3QN (30.1x/42.5x) is less efficient than the static 60-feature baselines (35.9x/47.6x) listed in the same table. The comparison against 'traditional ensemble methods' using all features is not a valid benchmark for a per-sample feature-selection claim, and the paper does not report wall-clock feature extraction time, inference time, or latency. The efficiency contribution is therefore not established relative to the relevant baselines.
  3. [§4.4, Fig. 3, Tables 1 and 4] The headline accuracy numbers are internally inconsistent: Figure 3's caption reports 98.44% for D3QN on Big2015 with ~60 features, while the abstract and Table 1 report 99.22%; Table 1 lists BODMAS D3QN accuracy as 98.84 while the abstract and Table 4 list 98.83; and Table 4 says episodic length ~60 for both methods, while Table 2 gives DDQN BODMAS ~44 features and D3QN ~56. These discrepancies prevent the reader from identifying the exact experimental result and must be resolved.
  4. [§4.4-4.5] No variance, error bars, or number of random seeds are reported for any accuracy or episode-length number. D3QN's advantage over DDQN is 0.10 percentage points on Big2015 and 0.01 percentage points on BODMAS in Table 1, which is within typical run-to-run variation for deep RL. The claims of consistent superiority are therefore not statistically supported.
  5. [§4.6-4.8] The 'intelligence metrics' are computed from the same policy they are meant to validate, with thresholds θ=0.2 and τ=0.05 that are not derived from any theory or pre-registered criterion. No null distribution or confidence intervals are given, so the 62.5% learning score is not shown to be significantly different from chance. Moreover, DDQN receives a higher learning score (75.0%) than D3QN (62.5%) yet has lower accuracy, so the metrics do not support the architectural claims. The manuscript's own §4.9 acknowledges the need for external validation; the current evidence is suggestive at best.
  6. [§2.3, §4.4] Related work identifies DQFSA and DroidRL as prior RL-based feature selection methods, but the experimental section never compares against them or against any RL baseline other than the authors' own DDQN implementation. The claim of state-of-the-art performance is therefore not supported by the reported experiments.
minor comments (5)
  1. [Table 2, footnote] The footnote says 'Feature counts: Fixed 50 for traditional methods', which contradicts the table's 60-feature column and the §4.3 statement that each method selected the top 60 features.
  2. [Figure 3 caption] The caption says D3QN uses 60 features, while §4.4 and Figure 4 give a mean of 61.54 features for D3QN on Big2015; these numbers should be aligned.
  3. [Figure 9 caption] The caption refers to 'a reduced feature set comprising 1795 features'; 1,795 is the full Big2015 feature set, so the wording is misleading.
  4. [§4.4] The text claims 'sub-second latency', but no latency measurement is reported anywhere in the paper; the claim should either be supported or removed.
  5. [Algorithm 1; Table 3] Algorithm 1 lists 'Training episodes E' but Table 3 reports 10,000 training epochs; the relationship between episodes and epochs should be clarified.

Circularity Check

3 steps flagged · score 6.0 of 10

The efficiency ratios and 'strategic learning' evidence are definitional restatements of the paper's own metrics, while the accuracy claims retain independent empirical content.

  1. self definitional [Section 4.4 'Feature Efficiency and Computational Advantages' and Table 2 footnote]
    "D3QN demonstrates remarkable efficiency with approximately 61 features on Big2015 (96.6% reduction) and 56 features on BODMAS (97.6% reduction), achieving efficiency ratios of 30.1× and 42.5× respectively (Table 2). This computational efficiency translates directly to real-time deployment capability. [Table 2 footnote:] Efficiency = Feature reduction ratio (Total Features÷ Features Used)."

    The efficiency improvement is not measured. Table 2 defines Efficiency as Total Features ÷ Features Used, so 30.1× = 1795/61 and 42.5× = 2381/56 by arithmetic. The paper then labels this ratio a 'computational efficiency improvement over traditional ensemble methods' and asserts real-time deployment. No runtime, FLOP, or feature-extraction cost is measured; the claimed speedup is a restatement of the feature-count ratio, not a derived consequence.

  2. self definitional [Section 3.1 Eq. (1) and Section 4.4 O(k) complexity claim]
    "Each state s ∈ R2n concatenates the feature vector with a binary selection mask: s = [x; m] ∈ R2n (1) ... Our RL-based approach reduces this to O(k) where k represents the dynamically selected feature subset."

    Because s always contains the complete feature vector x plus the mask m, the network input is dimension 2n at every step; flipping a mask bit to mi = 1 does not remove xi from the input or avoid computing it. The claimed reduction from O(n×m) ensemble cost to O(k) therefore is not entailed by the architecture. The reported '61 features used' is a count of mask bits, so the 96.6% dimensionality reduction is a definitional count, not a reduction in the features actually processed by the model.

1 more flagged steps
  1. self definitional [Section 4.6 Eqs. (18)-(19) and Section 4.7 'Strategic Learning Evidence']
    "Lscore = 1/|C| Σ I[|Pc − 1.0| > θ] ... D3QN achieves a Learning Score of 62.5%, significantly exceeding the 50% random threshold ... This score indicates that 5 out of 8 feature categories ... demonstrate non-random strategic preferences."

    The property being validated, 'strategic learning', is operationalized as the Learning Score: the score is defined as the fraction of categories whose observed usage ratio differs from uniform by more than θ = 0.2. The reported 62.5% is simply this fraction computed from the trained policy's own usage frequencies. Calling it 'evidence of genuine strategic learning rather than sophisticated random exploration' is a restatement of the metric's definition, not an independent test; no null distribution or external validation is supplied.

full rationale

The accuracy results are empirical and not circular: the reported 99.22% and 98.83% accuracies are obtained from held-out test sets and compared with baselines, and the RL reward in Eq. (4) does not encode the claimed outcomes. However, the two flagship quantitative contributions reduce by construction. The 30.1× and 42.5× computational efficiency gains are defined in Table 2 as total features divided by used features, and Eq. (1) shows the agent receives the full feature vector plus a mask, so the architecture does not realize an O(k) computation despite the paper's O(k) claim. The 62.5% 'strategic learning' evidence is likewise the value of a metric the paper defines as deviation from uniform usage; presenting it as validation of strategic behavior is tautological. No self-citation chain is involved. Score 6 reflects that partial circularity is present in the central efficiency and intelligence claims, while the accuracy comparisons retain independent content.

Assumptions & free parameters 5 free parameters · 3 assumptions · 0 invented entities

The central efficiency claim rests on the assumption that selected features are the only ones processed, but Eq. (1) contradicts this. Several thresholds and reward costs are hand-picked, and no new physical entities are introduced.

free parameters (5)
  • feature acquisition cost lambda = 0.0001
    R(s,a) = -lambda for feature actions in Eq. (4); chosen by systematic evaluation in [0,1] per Section 3.1.
  • learning score threshold theta = 0.2
    Indicator threshold in Eq. (19) for Lscore; arbitrary and no sensitivity analysis is reported.
  • specialization threshold tau = 0.05
    Threshold in Eq. (20) for D_f; with large BODMAS samples almost any feature will exceed this small value, making the 57.7% result unsurprising.
  • exploration scheduling start/min epsilon = 0.70 / 0.03
    Epsilon-greedy decay in Eq. (7); the decay rate alpha is not specified.
  • target network soft update tau = 0.01
    Soft update rate in Eq. (17); standard but still a hand-set hyperparameter.
assumptions (3)
  • domain assumption The state contains the full feature vector x even for features marked unexplored (Eq. 1).
    This is the load-bearing premise for the efficiency claim; it contradicts the claimed O(k) computation because the network input always has dimension 2n.
  • domain assumption The reward function with lambda=0.0001 defines the accuracy-efficiency tradeoff.
    Section 3.1 Eq. 4; the tradeoff is imposed by the authors and tuned, not derived from a deployment cost model.
  • ad hoc to paper The intelligence metrics with thresholds theta=0.2 and tau=0.05 are accepted as evidence of strategic learning.
    Section 4.6; metrics are newly defined, thresholds are arbitrary, and the authors note in Section 4.9 that external validation against human experts is still needed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adaptive Malware Detection using Sequential Feature Selection: A Dueling Double Deep Q-Network (D3QN) Framework for Intelligent Classification." pith.science (2026). https://pith.science/paper/YOWD23JF

@misc{pith2026250704372,
  author       = {Pith},
  title        = {Pith review of: Adaptive Malware Detection using Sequential Feature Selection: A Dueling Double Deep Q-Network (D3QN) Framework for Intelligent Classification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YOWD23JF}},
  note         = {Machine review of arXiv:2507.04372}
}
read the original abstract

Traditional malware detection methods exhibit computational inefficiency due to exhaustive feature extraction requirements, creating accuracy-efficiency trade-offs that limit real-time deployment. We formulate malware classification as a Markov Decision Process with episodic feature acquisition and propose a Dueling Double Deep Q-Network (D3QN) framework for adaptive sequential feature selection. The agent learns to dynamically select informative features per sample before terminating with classification decisions, optimizing both detection accuracy and computational cost through reinforcement learning. We evaluate our approach on Microsoft Big2015 (9-class, 1,795 features) and BODMAS (binary, 2,381 features) datasets. D3QN achieves 99.22% and 98.83% accuracy while utilizing only 61 and 56 features on average, representing 96.6% and 97.6% dimensionality reduction. This yields computational efficiency improvements of 30.1x and 42.5x over traditional ensemble methods. Comprehensive ablation studies demonstrate consistent superiority over Random Forest, XGBoost, and static feature selection approaches. Quantitative analysis demonstrates that D3QN learns non-random feature selection policies with 62.5% deviation from uniform baseline distributions. The learned policies exhibit structured hierarchical preferences, utilizing high-level metadata features for initial assessment while selectively incorporating detailed behavioral features based on classification uncertainty. Feature specialization analysis reveals 57.7% of examined features demonstrate significant class-specific discrimination patterns. Our results validate reinforcement learning-based sequential feature selection for malware classification, achieving superior accuracy with substantial computational reduction through learned adaptive policies.

Figures

Figures reproduced from arXiv: 2507.04372 by the authors.

Figure 1
Figure 1. Sequential decision-making framework for malware classification. The RL agent executes [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Experimental flow-chart of our proposed policy network. Random sample, selected from [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Confusion matrix comparison for best performing models on Big2015 dataset: (a) XG [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: Episode length distribution analysis on Big2015 test data: (a) DDQN and (b) D3QN. The [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Learned Feature Category Preferences with Statistical Validation. Preference ratios comparing D3QN’s actual feature category usage against random baseline expectations (1.0×, solid black line). Categories with ratios >1.0× indicate learned preferences (green), while ra…
Figure 6
Figure 6. Figure 6: D3QN Sequential Feature Category Usage Patterns across 15 Decision Steps. Heatmap [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Total number of samples and data distribution of each malware family in the Microsoft [PITH_FULL_IMAGE:figures/full_fig_p018_7.png]
Figure 8
Figure 8. Figure 8: Top 14 malware families and their number of samples ( [PITH_FULL_IMAGE:figures/full_fig_p018_8.png]
Figure 9
Figure 9. Figure 9: Average Episode Length and Average Accuracy measured on the validation dataset during [PITH_FULL_IMAGE:figures/full_fig_p019_9.png]
Figure 10
Figure 10. Figure 10: Quantified Learning Evidence Metrics for both architectures. Learning Score measures the [PITH_FULL_IMAGE:figures/full_fig_p020_10.png]
Figure 11
Figure 11. Figure 11: EMBER feature category distribution in top-performing features selected by the model. [PITH_FULL_IMAGE:figures/full_fig_p020_11.png]
Figure 12
Figure 12. Figure 12: Feature specialization analysis showing discriminative features identified by the reinforcement [PITH_FULL_IMAGE:figures/full_fig_p021_12.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

22 extracted references · 20 canonical work pages

  1. [1]

    Using ai and machine learning to predict and mitigate cybersecurity risks in critical infrastructure

    Ajayi Abisoye, Joshua Idowu Akerele, Princess Eloho Odio, Anuoluwapo Collins, Gideon Opeyemi Babatunde, and Siki- rat Damilola Mustapha. Using ai and machine learning to predict and mitigate cybersecurity risks in critical infrastructure. International Journal of Engineering Research and Development, 21(2):205–224, 2025

    work page 2025

  2. [2]

    Novel feature extraction, selection and fusion for effective malware family classifica- tion

    Mansour Ahmadi, Dmitry Ulyanov, Stanislav Semenov, Mikhail Trofimov, and Giorgio Gi- acinto. Novel feature extraction, selection and fusion for effective malware family classifica- tion. In Proceedings of the sixth ACM con- ference on data and application security and privacy, pages 183–194, 2016

    work page 2016

  3. [3]

    Malbot-drl: Malware botnet detection using deep reinforcement learning in iot networks

    Mohammad Al-Fawa’reh, Jumana Abu- Khalaf, Patryk Szewczyk, and James Jin Kang. Malbot-drl: Malware botnet detection using deep reinforcement learning in iot networks. IEEE Internet of Things Journal, 2023

    work page 2023

  4. [4]

    Optimizing malware de- tectionandclassificationinreal-timeusinghy- brid deep learning approaches

    Yaseen Ahmed Mohammed Alsumaidaee, Mustafa Mahmood Yahya, and Abdule- lah Hameed Yaseen. Optimizing malware de- tectionandclassificationinreal-timeusinghy- brid deep learning approaches. International Journal of Safety & Security Engineering, 15 (1), 2025

    work page 2025

  5. [5]

    H. S. Anderson and P. Roth. EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models. ArXiv e-prints, April 2018

    work page 2018

  6. [6]

    A malware detection scheme based on mining format information

    Jinrong Bai, Junfeng Wang, and Guozhong Zou. A malware detection scheme based on mining format information. The Scientific World Journal, 2014, 2014

    work page 2014

  7. [7]

    Adversarial environment re- inforcement learning algorithm for intrusion detection

    Guillermo Caminero, Manuel Lopez-Martin, and Belen Carro. Adversarial environment re- inforcement learning algorithm for intrusion detection. Computer Networks, 159:96–109, 2019

    work page 2019

  8. [8]

    Mal- ware detection & classification using machine learning

    Sunita Choudhary and Anand Sharma. Mal- ware detection & classification using machine learning. In2020 International Conference on Emerging Trends in Communication, Control and Computing (ICONC3), pages 1–4. IEEE, 2020

    work page 2020

Show all 22 references
  1. [9]

    Feature selection for mal- ware detection based on reinforcement learn- ing

    Zhiyang Fang, Junfeng Wang, Jiaxuan Geng, and Xuan Kan. Feature selection for mal- ware detection based on reinforcement learn- ing. IEEE Access, 7:176177–176187, 2019

    2019

  2. [10]

    Assess- ing the impact of packing on static machine learning-based malware detection and classifi- cation systems

    Daniel Gibert, Nikolaos Totosis, Constantinos Patsakis, Quan Le, and Giulio Zizzo. Assess- ing the impact of packing on static machine learning-based malware detection and classifi- cation systems. Computers & Security, page 104495, 2025

    2025

  3. [11]

    Sorel- 20m: A large scale benchmark dataset for malicious pe detection

    Richard Harang and Ethan M Rudd. Sorel- 20m: A large scale benchmark dataset for malicious pe detection. arXiv preprint arXiv:2012.07634, 2020

    2012 arXiv

  4. [12]

    Enhancing malware detection with feature selection and scaling techniques using machine learning models

    Rakibul Hasan, Barna Biswas, Md Samiun, Mohammad Abu Saleh, Mani Prabha, Jaha- nara Akter, Fatema Haque Joya, and Masuk Abdullah. Enhancing malware detection with feature selection and scaling techniques using machine learning models. Scientific Reports, 15(1):9122, 2025

    2025

  5. [13]

    An efficient malware detection approach based on machine learn- ing feature influence techniques for resource- constrained devices

    Subir Panja, Subhash Mondal, Amitava Nag, Jyoti Prakash Singh, Manob Jyoti Saikia, and Anup Kumar Barman. An efficient malware detection approach based on machine learn- ing feature influence techniques for resource- constrained devices. IEEE Access, 2025

    2025

  6. [14]

    A survey of machine learning methods and challenges for windows malware classification

    Edward Raff and Charles Nicholas. A survey of machine learning methods and challenges for windows malware classification. arXiv preprint arXiv:2006.09271, 2020

    2006 arXiv

  7. [15]

    Malware classification us- ing deep learning based feature extraction and wrapper based feature selection technique

    Muhammad Furqan Rafique, Muhammad Ali, Aqsa Saeed Qureshi, Asifullah Khan, and An- war Majid Mirza. Malware classification us- ing deep learning based feature extraction and wrapper based feature selection technique. arXiv preprint arXiv:1910.10958, 2019

    1910 arXiv

  8. [16]

    Mi- crosoft malware classification challenge.arXiv preprint arXiv:1802.10135, 2018

    Royi Ronen, Marian Radu, Corina Feuerstein, Elad Yom-Tov, and Mansour Ahmadi. Mi- crosoft malware classification challenge.arXiv preprint arXiv:1802.10135, 2018. 14

    2018 arXiv

  9. [17]

    A state-of-the-art survey of malware detection approaches using data mining techniques

    Alireza Souri and Rahil Hosseini. A state-of-the-art survey of malware detection approaches using data mining techniques. Human-centric Computing and Information Sciences, 8(1):1–22, 2018

    2018

  10. [18]

    Droidsieve: Fast and accurate classification of obfuscated android malware

    Guillermo Suarez-Tangil, Santanu Kumar Dash, Mansour Ahmadi, Johannes Kinder, Giorgio Giacinto, and Lorenzo Cavallaro. Droidsieve: Fast and accurate classification of obfuscated android malware. InProceedings of the seventh ACM on conference on data and application security an...

    2017

  11. [19]

    Static feature selection for iot malware detec- tion

    Nguyen Ngoc Toan, Dang Quang Thang, et al. Static feature selection for iot malware detec- tion. Journal of Science and Technology on Information security, 1(15):74–84, 2022

    2022

  12. [20]

    Droidrl: Feature selection for android malware detection with reinforcement learn- ing

    Yinwei Wu, Meijin Li, Qi Zeng, Tao Yang, Junfeng Wang, Zhiyang Fang, and Luyu Cheng. Droidrl: Feature selection for android malware detection with reinforcement learn- ing. Computers & Security, 128:103126, 2023

    2023

  13. [21]

    Bodmas: An open dataset for learning based temporal analysis of pe malware

    Limin Yang, Arridhana Ciptadi, Ihar Laziuk, Ali Ahmadzadeh, and Gang Wang. Bodmas: An open dataset for learning based temporal analysis of pe malware. In4th Deep Learning and Security Workshop, 2021

    2021

  14. [22]

    A novel image based approach for mobile android malware detection and classification.Knowledge-Based Systems, page 113855, 2025

    Muhammed Mutlu Yapici. A novel image based approach for mobile android malware detection and classification.Knowledge-Based Systems, page 113855, 2025. 15 Table 3: Dataset Characteristics and Experimental Configuration Characteristic Microsoft Big-2015 BODMAS Dataset Propertie...

    2025

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.