# Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification

arXiv: https://arxiv.org/abs/1511.04317 · HTML: https://mlsanity.com/paper/1511.04317/

## Key facts

- Cited by 21 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Nov 2015.

## Built on by (most cited first, 21 of 21)

- [Towards an Automated Pipeline for Detecting and Classifying Malware through Machine Learning](https://mlsanity.com/paper/2106.05625/) (2021)
- [AVScan2Vec: Feature Learning on Antivirus Scan Data for Production-Scale Malware Corpora](https://mlsanity.com/paper/2306.06228/) (2023)
- [Towards a Practical Defense against Adversarial Attacks on Deep Learning-based Malware Detectors via Randomized Smoothing](https://mlsanity.com/paper/2308.08906/) (2023)
- [Assessing the Impact of Packing on Machine Learning-Based Malware Detection and Classification Systems](https://mlsanity.com/paper/2410.24017/) (2024)
- [A Comprehensive Study on Learning-Based PE Malware Family Classification Methods](https://mlsanity.com/paper/2110.15552/) (2021)
- [Analysis of Machine Learning Approaches to Packing Detection](https://mlsanity.com/paper/2105.00473/) (2021)
- [New Approach to Malware Detection Using Optimized Convolutional Neural Network](https://mlsanity.com/paper/2301.11161/) (2023)
- [Multiclass Classification Procedure for Detecting Attacks on MQTT-IoT Protocol](https://mlsanity.com/paper/2402.03270/) (2024)
- [Machine Learning for Windows Malware Detection and Classification: Methods, Challenges and Ongoing Research](https://mlsanity.com/paper/2404.18541/) (2024)
- [Adaptive Malware Detection using Sequential Feature Selection: A Dueling Double Deep Q-Network (D3QN) Framework for Intelligent Classification](https://mlsanity.com/paper/2507.04372/) (2025)
- [Automated Malware Family Classification using Weighted Hierarchical Ensembles of Large Language Models](https://mlsanity.com/paper/2604.02490/) (2026)
- [ML-based IoT Malware Detection Under Adversarial Settings: A Systematic Evaluation](https://mlsanity.com/paper/2108.13373/) (2021)
- [Malware Classification using Deep Neural Networks: Performance Evaluation and Applications in Edge Devices](https://mlsanity.com/paper/2310.06841/) (2023)
- [Smart OMVI: Obfuscated Malware Variant Identification using a novel dataset](https://mlsanity.com/paper/2310.10670/) (2023)
- [Obfuscated Malware Detection: Investigating Real-world Scenarios through Memory Analysis](https://mlsanity.com/paper/2404.02372/) (2024)
- [Certified Adversarial Robustness of Machine Learning-based Malware Detectors via (De)Randomized Smoothing](https://mlsanity.com/paper/2405.00392/) (2024)
- [Rethinking and Exploring String-Based Malware Family Classification in the Era of LLMs and RAG](https://mlsanity.com/paper/2507.04055/) (2025)
- [Taming Data Challenges in ML-based Security Tasks Using Generative AI](https://mlsanity.com/paper/2507.06092/) (2025)
- [A Hybrid Approach For Malware Classification Using Secondary Features Fusion](https://mlsanity.com/paper/2606.03432/) (2026)
- [SoK: AI-Augmented Binary Reversing](https://mlsanity.com/paper/2606.17398/) (2026)
- [EXE-Bench: Ranking the Tradeoffs of AI-based Windows Malware Detectors for Real-World Usability](https://mlsanity.com/paper/2607.24177/) (2026)

## Abstract (arXiv)

Modern malware is designed with mutation characteristics, namely polymorphism and metamorphism, which causes an enormous growth in the number of variants of malware samples. Categorization of malware samples on the basis of their behaviors is essential for the computer security community, because they receive huge number of malware everyday, and the signature extraction process is usually based on malicious parts characterizing malware families. Microsoft released a malware classification challenge in 2015 with a huge dataset of near 0.5 terabytes of data, containing more than 20K malware samples. The analysis of this dataset inspired the development of a novel paradigm that is effective in categorizing malware variants into their actual family groups. This paradigm is presented and discussed in the present paper, where emphasis has been given to the phases related to the extraction, and selection of a set of novel features for the effective representation of malware samples. Features can be grouped according to different characteristics of malware behavior, and their fusion is performed according to a per-class weighting paradigm. The proposed method achieved a very high accuracy (≈ 0.998) on the Microsoft Malware Challenge dataset.