Loading article...
Loading article...
Stream/Area:
-
Subject:
-
Paper ID:
IJSREM67156
Volume:
10 |
9 |
Sep 2026
Pages:
1-8
Publication Frequency:
Monthly (12 issues per year)
License:International Journal of Scientific Research in Engineering and Management follows the Creative Commons Attribution 4.0 (CC BY 4.0) License, allowing free use and distribution with proper attribution.
Department of Computer Science
Institute of Engineering & Technology , Dr. Bhimrao Ambedkar University , Agra
Department of Computer Science
Institute of Engineering & Technology , Dr. Bhimrao Ambedkar University , Agra
The rapid evolution of malware—including ransomware, trojans, spyware, botnets, worms, fileless malware, Android malware, and IoT threats—has exposed important limitations in conventional signature-based detection. Modern malware increasingly uses obfuscation, packing, polymorphism, anti-analysis mechanisms, encryption, and adversarial manipulation to evade static signatures. Machine Learning (ML) and Deep Learning (DL) therefore provide important alternatives because they can learn discriminative patterns from executable code, API calls, system calls, network behavior, binary representations, and program graphs. This survey reviews ML-based intelligent malware detection research with emphasis on the 2021–2026 period. The review organizes the literature according to malware type, platform, analysis strategy, feature representation, algorithm, dataset, evaluation metrics, and research gap. Traditional ML methods such as Random Forest, Support Vector Machine, Decision Tree, and boosting remain effective when carefully engineered features are available, while CNN, LSTM, CNN-LSTM, autoencoder, Transformer, and Graph Neural Network (GNN) models provide automated representation learning. Hybrid approaches combine static and dynamic evidence and frequently improve robustness. Emerging directions include explainable AI (XAI), federated learning, adversarially robust detection, temporal/concept-drift adaptation, and cross-platform learning. Public datasets such as EMBER, BIG2015, Malimg, Drebin, AndroZoo, CICMalDroid, VirusShare, VirusTotal, IoT-23, and Malicia are examined. The principal unresolved problems are zero-day detection, dataset bias and age, class imbalance, adversarial evasion, concept drift, explainability, computational cost, and cross-platform generalization. The paper concludes with a proposed integrated framework combining static and dynamic features, graph and sequence representations, hybrid ML/DL learning, XAI, adversarial testing, and continuous adaptation.
KEYWORDS
Machine learning and deep learning have transformed malware detection from predominantly signature-driven matching toward adaptive pattern recognition. The surveyed evidence shows strong growth in deep learning, continued dominance of supervised learning, persistent reliance on static features, and increasing interest in hybrid, graph, explainable, federated and Transformer-based approaches. Yet the most important unresolved issue is not whether intelligent models can achieve high benchmark accuracy; it is whether they can maintain reliable detection against unseen malware, temporal drift, adversarial manipulation, obfuscation, heterogeneous platforms and operational constraints. A Scopus-oriented research contribution should therefore move beyond another benchmark-specific accuracy claim. The stronger scientific position is to establish reproducible, temporal and cross-dataset evaluation; compare predictive performance with robustness and computational cost; and integrate explainability and deployment considerations. The resulting research agenda is centered on trustworthy, multimodal, adaptive and resource-aware malware detection
[1] J. Ferdous, R. Islam, A. Mahboubi, and M. Z. Islam, “AI-Based Ransomware Detection: A Comprehensive Review,” IEEE Access, vol. 12, 2024, doi: 10.1109/ACCESS.2024.3461965. [2] J. Ferdous, R. Islam, A. Mahboubi, and M. Z. Islam, “A review of state-of-the-art malware attack trends and defense mechanisms,” IEEE Access, vol. 11, pp. 121118–121141, 2023, doi: 10.1109/ACCESS.2023.3328351. [3] B. A. S. Al-Rimy, M. A. Maarof, and S. Z. M. Shaid, “Ransomware threat success factors, taxonomy, and countermeasures: A survey and research directions,” Computers & Security, vol. 74, pp. 144–166, 2018, doi: 10.1016/j.cose.2018.01.001. [4] C. Beaman, A. Barkworth, T. D. Akande, S. Hakak, and M. K. Khan, “Ransomware: Recent advances, analysis, challenges and future research directions,” Computers & Security, vol. 111, Art. no. 102490, 2021, doi: 10.1016/j.cose.2021.102490. [5] S. Razaulla et al., “The age of ransomware: A survey on the evolution, taxonomy, and research directions,” IEEE Access, vol. 11, pp. 40698–40723, 2023, doi: 10.1109/ACCESS.2023.3268535. [6] T. McIntosh et al., “Ransomware mitigation in the modern era: A comprehensive review, research challenges, and future directions,” ACM Computing Surveys, vol. 54, no. 9, pp. 1–36, 2022, doi: 10.1145/3479393. [7] I. Almomani, A. Alkhayer, and W. El-Shafai, “E2E-RDS: Efficient end-to-end ransomware detection system based on static-based ML and vision-based DL approaches,” Sensors, vol. 23, no. 9, p. 4467, 2023, doi: 10.3390/s23094467. [8] E. B. Karbab, M. Debbabi, and A. Derhab, “SwiftR: Cross-platform ransomware fingerprinting using hierarchical neural networks on hybrid features,” Expert Systems with Applications, vol. 225, Art. no. 120017, 2023, doi: 10.1016/j.eswa.2023.120017. [9] H. S. Anderson and P. Roth, “EMBER: An open dataset for training static PE malware machine learning models,” arXiv:1804.04637, 2018. [10] Q. M. Yaseen, “The effect of the ransomware dataset age on the detection accuracy of machine learning models,” Information, vol. 14, no. 3, p. 193, 2023, doi: 10.3390/info14030193.
Publication Date
9/9/2026
Peer Review Type
Double-Blind Peer Review
Review Rounds: 2
Documents
Article Views
0
Total views since publication
PDF Downloads
8
Total downloads since publication
Geographic Reach
5
Digital Preservation: This article is permanently archived on Zenodo and complies with all data preservation standards across major indexing platforms.
Plagiarism Screening
This manuscript has been checked for plagiarism using TurnitinPlagiarismChecker software.
Conflict of Interest
The authors declare no conflict of interest related to this research work.
Funding Information
No funding information available for this research.
Related research in the same subject area
Loading similar articles...