# Early Stage Malware Prediction Using Recurrent Neural Networks

arXiv: https://arxiv.org/abs/1708.03513 · HTML: https://mlsanity.com/paper/1708.03513/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 Aug 2017.

## Built on by (most cited first, 14 of 14)

- [Decoding the Secrets of Machine Learning in Malware Classification: A Deep Dive into Datasets, Feature Extraction, and Model Performance](https://mlsanity.com/paper/2307.14657/) (2023)
- [MalPhase: Fine-Grained Malware Detection Using Network Flow Data](https://mlsanity.com/paper/2106.00541/) (2021)
- [Malware Detection Using Frequency Domain-Based Image Visualization and Deep Learning](https://mlsanity.com/paper/2101.10578/) (2021)
- [An Intrusion Detection System based on Deep Belief Networks](https://mlsanity.com/paper/2207.02117/) (2022)
- [Avast-CTU Public CAPE Dataset](https://mlsanity.com/paper/2209.03188/) (2022)
- [Evaluating Ensemble and Deep Learning Models for Static Malware Detection with Dimensionality Reduction Using the EMBER Dataset](https://mlsanity.com/paper/2507.16952/) (2025)
- [Towards interpreting ML-based automated malware detection models: a survey](https://mlsanity.com/paper/2101.06232/) (2021)
- [Deep Learning Based XIoT Malware Analysis: A Comprehensive Survey, Taxonomy, and Research Challenges](https://mlsanity.com/paper/2410.13894/) (2024)
- [MAIDS: Malicious Agent Identification-based Data Security Model for Cloud Environments](https://mlsanity.com/paper/2412.14490/) (2024)
- [Behavioural Reports of Multi-Stage Malware](https://mlsanity.com/paper/2301.12800/) (2023)
- [Quantized Non-Volatile Nanomagnetic Synapse based Autoencoder for Efficient Unsupervised Network Anomaly Detection](https://mlsanity.com/paper/2309.06449/) (2023)
- [Enhancing Enterprise Network Security: Comparing Machine-Level and Process-Level Analysis for Dynamic Malware Detection](https://mlsanity.com/paper/2310.18165/) (2023)
- [Scoring the Unscorables: Cyber Risk Assessment Beyond Internet Scans](https://mlsanity.com/paper/2506.06604/) (2025)
- [Machine Learning Epidemic Predictions Using Agent-based Wireless Sensor Network Models](https://mlsanity.com/paper/2511.15982/) (2025)

## Abstract (arXiv)

Static malware analysis is well-suited to endpoint anti-virus systems as it can be conducted quickly by examining the features of an executable piece of code and matching it to previously observed malicious code. However, static code analysis can be vulnerable to code obfuscation techniques. Behavioural data collected during file execution is more difficult to obfuscate, but takes a relatively long time to capture - typically up to 5 minutes, meaning the malicious payload has likely already been delivered by the time it is detected. In this paper we investigate the possibility of predicting whether or not an executable is malicious based on a short snapshot of behavioural data. We find that an ensemble of recurrent neural networks are able to predict whether an executable is malicious or benign within the first 5 seconds of execution with 94% accuracy. This is the first time general types of malicious file have been predicted to be malicious during execution rather than using a complete activity log file post-execution, and enables cyber security endpoint protection to be advanced to use behavioural data for blocking malicious payloads rather than detecting them post-execution and having to repair the damage.