MeLeMaD: Adaptive Malware Detection via Chunk-wise Feature Selection and Meta-Learning

TL;DR

Malware detection must cope with rapid threat evolution and high-dimensional data. MeLeMaD combines Chunk-wise Feature Selection based on Gradient Boosting (CFSGB) with Model-Agnostic Meta-Learning (MAML) to enable rapid adaptation to new malware variants while efficiently selecting informative static features. The approach is validated on CIC-AndMal2020, BODMAS, and a newly introduced EMBOD dataset, achieving top-tier metrics including 98.04% accuracy on CIC-AndMal2020, 99.97% on BODMAS, and 97.85% on EMBOD, with AUC close to 1.0 in all cases. This work demonstrates a scalable, robust, and adaptable malware detection framework capable of generalizing across platforms and threat landscapes, paving the way for practical, real-time cybersecurity deployments. Key components include the chunk-based feature selection mechanism that reduces dimensionality without losing discriminative power and the meta-learning loop that yields fast, data-efficient adaptation to novel threats, quantified by inner-loop and outer-loop updates that optimize rapid task-specific learning.

Abstract

Confronting the substantial challenges of malware detection in cybersecurity necessitates solutions that are both robust and adaptable to the ever-evolving threat environment. The paper introduces Meta Learning Malware Detection (MeLeMaD), a novel framework leveraging the adaptability and generalization capabilities of Model-Agnostic Meta-Learning (MAML) for malware detection. MeLeMaD incorporates a novel feature selection technique, Chunk-wise Feature Selection based on Gradient Boosting (CFSGB), tailored for handling large-scale, high-dimensional malware datasets, significantly enhancing the detection efficiency. Two benchmark malware datasets (CIC-AndMal2020 and BODMAS) and a custom dataset (EMBOD) were used for rigorously validating the MeLeMaD, achieving a remarkable performance in terms of key evaluation measures, including accuracy, precision, recall, F1-score, MCC, and AUC. With accuracies of 98.04\% on CIC-AndMal2020 and 99.97\% on BODMAS, MeLeMaD outperforms the state-of-the-art approaches. The custom dataset, EMBOD, also achieves a commendable accuracy of 97.85\%. The results underscore the MeLeMaD's potential to address the challenges of robustness, adaptability, and large-scale, high-dimensional datasets in malware detection, paving the way for more effective and efficient cybersecurity solutions.

Figures (8)

• Figure 1: Venn diagram illustrating the grouping of reviewed studies based on the platforms they target. The left (green) circle represents Android, the right (yellow) circle represents Windows, and the overlapping area indicates studies applicable to both platforms.
• Figure 2: Architecture of MeLeMaD Framework (Proposed)
• Figure 3: Architecture of Chunk-wise Feature Selection based on Gradient Boosting (CFSGB)
• Figure 4: MAML training process
• Figure 5: EMBOD Dataset Creation Process