Binary classification of multi-class malware
Loading...
Date
2026-02-24
Authors
Κτενάς, Γεώργιος-Κωνσταντίνος
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
This thesis analyzes the detection and prediction of malware behaviors using only static features, under a temporal split instead of a random split. The problem is defined as multi-class classification and a binary relevance approach was applied, where independent binary classifiers are trained per behavior label using EMBER style features. Evaluation is executed on a temporal split to realistically simulate future performance. The study utilizes machine learning models, both classical and modern, such as gradient boosting methods, random forests and even a neural algorithm. It examines the effect of the post processing methods that were applied, like probability calibration and per label decision threshold tuning. Furthermore, an ablation study over feature groups is being carried out to highlight their contribution to generalization. The results indicate that temporal evaluation exposes a substantial gap between validation (in-time fitting) and temporal test (out-of-time generalization), while an appropriate decision rule, thresholding, can significantly increase the F1 performance. Overall, the work provides a reproducible experimental framework and practical insights to design more stable static detection systems in evolving environments over time.
Description
Keywords
Malware detection, Static analysis, Machine learning