PaperlayerView exact revision on arXiv

Source-linked AI summary

Enhancing Multiclass Malware Classification in Resource-Constrained Environments

Abdul Khalek Alve, Alif Rahman, Saadman Zaman, Sazzad Hossen Himel, Muhammad Iqbal Hossain

arXiv:2609.27950v1cs.CRcs.LG

TL;DR

Multiclass malware detection remains less developed than binary classification, particularly for resource-constrained platforms. The paper combines lightweight classifiers with feature selection and data balancing, reporting improved accuracy over existing research for both family and individual malware classification.

  • Problem

    Multiclass malware-family and individual-type classification remains underdeveloped, while computational costs, class imbalance, and redundant features challenge detection on low-resource platforms.

    Source: §I · p. 1

  • Method

    The approach combines Random Forest and LightGBM with data balancing and Genetic Algorithm feature selection for malware classification.

    Source: §I · p. 1, E. Feature Selection · p. 8

  • Results

    The preprocessing pipeline with Random Forest and LightGBM achieved greater accuracy than existing research in both malware-family and individual-malware classification.

    Source: A. Concluding Remarks · p. 15

  • Takeaways & Limitations

    The authors conclude that the compact, efficient pipeline is suitable for resource-constrained devices.

    Source: A. Concluding Remarks · p. 15

Abstract

from arXiv · show

The emergence of multi-class malware attacks such as ransomware, spyware, trojans, etc., presents an increasing and serious threat to cybersecurity, particularly in resourceconstrained environments like IoT devices. Existing machine learning models have achieved nearly perfect accuracy in binary malware classification but fall short in terms of classifying malware families and individual malware. Additionally, the complexity of these multi-class malware attacks presents a significant challenge of detection in resource-constrained environments, as multi-class detection usually requires high computational capability. This research bridges the gap by enhancing the detection accuracy of multi-class malware classification as well as developing a lightweight model that can run efficiently on resource-constrained devices. In this paper, we propose a robust, lightweight machine learning model featuring LightGBM classifier with SMOTE oversampling and SOM-US undersampling techniques for data balancing, as well as well-engineered feature selection through Genetic Algorithm. The model performed better than the current state-of-the-art models developed on the same dataset in both malware family classification (4 classes) and individual malware type classification (16 classes) with accuracy of 89.1% and 76% respectively. Thus, maintaining a balance between classification accuracy and computational efficiency in resource-constrained environments. Furthermore, we propose another model using Random Forest classifier with an accuracy of 91.2% in malware family classification and 78.7% in individual malware classification. Demonstrating a significant enhancement in terms of accuracy from the current state-of-the-art models.

I. INTRODUCTION

Multiclass malware classification, especially on low-resource platforms, remains less developed than binary detection, while computational costs and data issues constrain existing approaches. The paper presents lightweight classifiers and preprocessing intended to improve family- and individual-level detection; prior studies on the same dataset provide the comparison point.

I. INTRODUCTION

  • The paper targets limited multiclass malware detection on low-resource platforms, where complex attacks, computational costs, class imbalance, and redundant features constrain existing methods.The introduction contrasts this gap with the high accuracy already achieved for binary classification.Source: §I · p. 1
  • 87.1% family-level accuracy and 72.6% individual-malware accuracy are reported as the current best results on CIC-MalMem-2022.The introduction identifies multiclass performance as remaining low despite high binary-classification accuracy.Source: §I · p. 1
  • The proposed approach combines Random Forest and LightGBM with data balancing and feature selection to improve accuracy while minimizing computational effort.The stated aim covers both malware-family and individual-type classification.Source: §I · p. 1

II. RELATED WORKS

  • Abualhaj et al. reported Random Forest accuracy of 75.6% for 16-class, 86.34% for 4-class, and 99.93% for binary classification after Gray Wolf Optimization feature selection.Source: §II · p. 2
  • Saaidah et al. improved KNN accuracy with firefly feature selection by 1.52% for family and 2.64% for individual classification, while noting a lack of class balancing and model comparisons.Their results concern multiclass tasks on the MalMem-2022 dataset.Source: §II · p. 3
  • The earlier lightweight model by Cassel and Majd reached 87.1% family-level accuracy using Random Forest with SMOTE and Tomek Links.The authors describe it as outperforming RobustCBL for family classification.Source: §II · p. 4

A. Dataset Collection

The study uses CIC-MalMem-2022, a memory-analysis dataset, and cleans it by removing duplicates and unnecessary columns and handling outliers before modeling.

A. Dataset Collection

  • CIC-MalMem-2022 provides memory-dump samples and metadata for studying multiple malware types and their memory analysis.The dataset was developed by the Canadian Institute for Cybersecurity.Source: A. Dataset Collection · p. 5

B. Data Cleaning

  • Cleaning removed 534 duplicate records and nine unnecessary columns with zero values; the dataset had no missing or null values.Source: B. Data Cleaning · p. 6
  • Outliers were capped using lower and upper thresholds, with Isolation Forest applied to some extreme values.The authors report that the two-step handling improved data distribution among target classes.Source: B. Data Cleaning · p. 6

C. Data Analysis

The analysis uses t-SNE to inspect family and individual class structure, then balances the training data with SOM-US undersampling and SMOTE oversampling.

C. Data Analysis

  • The dataset comprises benign samples and three malware families; each malware family is subdivided into five individual malware classes.Source: C. Data Analysis · p. 6
  • The family-class t-SNE visualization shows a clear distinction between the binary and malware classes, alongside outliers in both.Source: C. Data Analysis · p. 6, Figure 2 · p. 6
  • The individual-class visualization shows malware classes generally mixed together while benign classes are mostly separate, with greater benign-malware overlap associated with lower possible individual-class accuracy.The dataset contains 58,596 rows and 56 feature columns; t-SNE was used to visualize the high-dimensional data.Source: C. Data Analysis · p. 6, Figure 3 · p. 6

D. Data Balancing

  • The data was split 80% for training and 20% for testing before balancing so the test set remained untouched.SOM-US undersampled majority classes and SMOTE interpolated between nearby minority-class samples.Source: D. Data Balancing · p. 6
  • SOM-US selects representative majority-class samples to retain their distribution, while SMOTE creates synthetic minority-class instances using k-nearest neighbors.The methods were applied to both family- and individual-class classification.Source: D. Data Balancing · p. 7

E. Feature Selection

The section compares PCA, Firefly Optimization, and Genetic Algorithm feature selection; GA gave the best performance in this study, selecting 22 of 46 features.

E. Feature Selection

  • PCA produced 21 principal components but did not improve model performance, so alternative selection methods were explored.The components captured variance but were not relevant for model training.Source: E. Feature Selection · p. 7
  • 22 of 46 features were selected by GA, which outperformed PCA and Firefly for this study.The selected features are shown in Fig. 8.Source: Figure 8 · p. 8, E. Feature Selection · p. 8
  • Firefly-selected features did not yield the desired performance improvement, prompting exploration of other feature-selection methods.The study implemented Firefly Optimization for feature selection.Source: E. Feature Selection · p. 8
  • GA evaluated feature subsets over 10 generations using weighted F1 score as its fitness function.The method evolves candidate solutions through selection, crossover, and mutation.Source: E. Feature Selection · p. 8

F. Resource Feasibility of Feature Extraction

The section reports that Random Forest performed best in the model comparison, while feature extraction remains a practical resource boundary for small IoT devices. It also summarizes preprocessing and model-development steps.

F. Resource Feasibility of Feature Extraction

  • Six of the 22 selected features were not extractable on IoT devices with less than 1 GB RAM, and existing feature-extraction tools require substantially more memory than the 2.5 MB model.The cited extraction tools include Cuckoo Sandbox, INetSim, Volatility Framework, and VirusTotal.Source: F. Resource Feasibility of Feature… · p. 8

G. Summary of Preprocessed Data

  • Preprocessing removed 534 duplicates, capped class-wise outliers, and balanced the data with SOM-US undersampling and SMOTE oversampling.SOM-US sampling was set to 15,000 for family classification and 6,000 for individual malware classification.Source: G. Summary of Preprocessed Data · pp. 8–9

A. Methodology Overview

  • The methodology combines preprocessing, feature reduction, and comparative classifier evaluation, selecting models with accuracy and computational efficiency in view.The tested models included Random Forest, LightGBM, Decision Tree, and KNN.Source: A. Methodology Overview · p. 9
  • Random Forest outperformed the other models on accuracy, precision, and F1-score; tuned RF performed better computationally, while LightGBM was sensitive to parameter tuning.Models were evaluated using an 80% training and 20% testing split.Source: A. Methodology Overview · p. 9

B. Model Architecture

The architecture compares four lightweight classifiers, using Random Forest and LightGBM as ensemble models and Decision Tree and KNN as simpler baselines. Their mechanisms differ, from tree voting and boosting to feature-based splits and distance voting.

B. Model Architecture

  • Four computationally light classifiers were selected: Random Forest, LightGBM, Decision Tree, and KNN.RF and LightGBM were chosen for ensemble capabilities and robust performance; DT and KNN served as simpler baselines.Source: B. Model Architecture · pp. 9–10
  • Random Forest combines multiple decision trees whose votes determine the final classification, with tuning of tree count, depth, and split size.The described evaluation uses k-fold cross-validation and accuracy, precision, recall, and F1-score.Source: B. Model Architecture · p. 10
  • LightGBM grows trees leaf by leaf and uses GOSS, EFB, and feature-value histograms to reduce training computation.Its leaf-wise growth may lead to overfitting; the model is tuned on maximum depth, learning rate, and number of leaves.Source: B. Model Architecture · p. 10
  • Decision Trees split data by feature values to improve purity, while KNN predicts by distance to neighboring training samples and majority voting.KNN uses a selected K-value and distance metrics such as Euclidean, Manhattan, or Cosine.Source: B. Model Architecture · pp. 10–11

C. Implementation of Selected Design

The implementation evaluates lightweight classifiers on held-out data, tunes parameters with accuracy, performance, and resource use in mind, and reports improved accuracy with fewer false positives.

C. Implementation of Selected Design

  • Models were trained on 80% of the preprocessed data, with accuracy, loss curves, and class-wise performance analyzed for overfitting.The remaining 20% was used for testing before balancing.Source: C. Implementation of Selected Design · p. 11
  • Testing used accuracy, precision, recall, F1-score, confusion matrices, and ROC-AUC to assess performance and false positives.The test data was the 20% split selected before balancing.Source: C. Implementation of Selected Design · p. 11
  • Tuning varied model-specific parameters while targeting classification performance, training time, and memory use.Methods included grid search, manual testing, Optuna, and cross-validation.Source: C. Implementation of Selected Design · p. 11
  • The implementation reports that validated lightweight models detect obfuscated malware with better accuracy and fewer false-positive rates.The approach combines SMOTE and SOM-US balancing with comparative analysis of multiple classifiers.Source: C. Implementation of Selected Design · p. 11

V. RESULT ANALYSIS

Across the evaluated classifiers, Random Forest led malware-family performance, while model size and device capacity shaped whether local deployment was practical. Family-level errors clustered between Ransomware and Trojan, although all models correctly predicted the benign class.

V. RESULT ANALYSIS

  • The study evaluated four classifiers at family and individual-malware levels, using cross-validation and hyperparameter tuning to support consistency and optimize parameters.Grid Search, Optuna, and manual testing were used for tuning.Source: §V · p. 11

A. Malware Family Classification

  • Ransomware and Trojan were commonly confused, especially when Trojan samples were predicted as Ransomware; all models correctly predicted the benign class.Decision Tree had the highest misclassification in this case, while LightGBM struggled with Spyware and KNN had the worst overall misclassification rate.Source: A. Malware Family Classification · p. 11, Figure 14 · p. 12, Figure 15 · p. 12
  • Random Forest outperformed the other classifiers by at least 2% in malware-family classification.Table I reports classification-model performance metrics for malware-family classification.Source: A. Malware Family Classification · p. 11, Table I
  • Random Forest required significantly more training time and storage space, limiting its suitability for lower-capacity IoT devices.The evaluation considered training time, testing time, and model size; some high-end IoT devices can store models locally, unlike lower-end devices.Source: A. Malware Family Classification · p. 12, Table II · p. 12
  • KNN combined a significantly larger model size with very low accuracy, while the authors describe Random Forest as an option for high-end IoT or gateway/cloud detection.The authors also report similar results for LightGBM and Decision Tree, with slightly higher accuracy for LightGBM and faster prediction for Decision Tree.Source: A. Malware Family Classification · p. 12

B. Individual Malware Classification

Random Forest ranked first in individual-malware classification, followed by LightGBM, Decision Tree, and KNN. The reported class-level results vary, with ransomware-family malware among the lowest-performing classes, and the authors identify Random Forest and LightGBM as suitable options depending on device constraints and priorities.

B. Individual Malware Classification

C. Comparison with Existing Works

The comparison reports gains over prior work in malware-family and individual-malware classification. The preprocessing evaluation attributes accuracy and resource-use changes to class-wise outlier handling, genetic-algorithm feature selection, dataset balancing, and hyperparameter tuning.

C. Comparison with Existing Works

  • Three of the four implemented classifiers produced better malware-family results than prior works, and LightGBM and Decision Tree outperformed previous works in every metric.The authors associate higher accuracy with genetic-algorithm feature selection, two-step outlier handling, and SMOTE oversampling with SOM-US undersampling.Source: C. Comparison with Existing Works · p. 13
  • Random Forest increased precision, recall, and F1-score by 4% over the previous state-of-the-art model by Cassel and Majd.The comparison covers malware-family classification; Table V is the comparison table for prior works.Source: C. Comparison with Existing Works · p. 13, Table V
  • For individual-malware classification, Random Forest and LightGBM outperformed the KNN with Firefly Algorithm model by 9% and 6.5%, respectively.The passage also reports that the Random Forest and LightGBM models outperformed the Gray Wolf Optimization approach by Abualhaj et al.. Table VI covers the comparison with prior works.Source: C. Comparison with Existing Works · p. 13, Table VI · p. 14
  • The authors present their models as state of the art for both malware-family and individual-malware classification on the same dataset.The comparison passages describe these as results on the CIC-Malmem-2022 dataset.Source: C. Comparison with Existing Works · p. 13

D. Preprocessing Pipeline Evaluation

  • Two-step class-wise outlier handling and genetic-algorithm feature selection were associated with high classification results and reduced training time, testing time, and model size through dataset reduction.The comparison is between preprocessing phases 1 and 2.Source: D. Preprocessing Pipeline Evaluation · p. 14, Table VII · p. 14
  • In phase 3, balancing maintained accuracy while hyperparameter tuning further reduced model size and training and testing time, except individual-malware training time, which rose from 8.69 to 24.9 seconds.The authors attribute the individual-malware training-time increase to the larger training sample after balancing; they report higher accuracy in exchange and reduced testing time versus phase 2.Source: D. Preprocessing Pipeline Evaluation · p. 14, Table VIII · p. 14

VI. CONCLUSION

The conclusion reports improved multiclass malware classification with a compact, efficient model for resource-constrained devices. It identifies hybrid or behavior-based approaches and reduced-feature fallback as directions for further work.

A. Concluding Remarks

  • The preprocessing pipeline with Random Forest and LightGBM improves on existing research in family and individual malware classification while producing a compact, efficient model for resource-constrained devices.The conclusion attributes optimization to hyperparameter tuning and data balancing with SMOTE and SOM-US, alongside class-based outlier handling and Genetic Algorithm feature selection.Source: A. Concluding Remarks · p. 15

B. Future Improvements

  • Hybrid classification and behavior-based anomaly detection are proposed as future refinements, with behavior-based models identified as suitable for zero-day attacks.The conclusion says incorporating these approaches could support prediction of the exact malware family or individual malware.Source: B. Future Improvements · p. 15
  • A fallback using fewer features is proposed for cases when tools needed for full feature extraction are unavailable, allowing inputs to adjust to device resources.The stated aim is to adapt malware detection across IoT devices with differing resource capabilities.Source: B. Future Improvements · p. 15
Loading 2609.27950v1…