# Survey of Machine Learning Techniques for Malware Analysis

arXiv: https://arxiv.org/abs/1710.08189 · HTML: https://mlsanity.com/paper/1710.08189/

## Key facts

- Cited by 31 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 23 Oct 2017.

## Built on by (most cited first, 30 of 31)

- [The Threat of Offensive AI to Organizations](https://mlsanity.com/paper/2106.15764/) (2021)
- [A Survey on Machine Learning Techniques for Source Code Analysis](https://mlsanity.com/paper/2110.09610/) (2021)
- [The Role of Machine Learning in Cybersecurity](https://mlsanity.com/paper/2206.09707/) (2022)
- [Deep Learning for Android Malware Defenses: a Systematic Literature Review](https://mlsanity.com/paper/2103.05292/) (2021)
- [Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art](https://mlsanity.com/paper/2112.12310/) (2021)
- [On The Empirical Effectiveness of Unrealistic Adversarial Hardening Against Realistic Adversarial Attacks](https://mlsanity.com/paper/2202.03277/) (2022)
- [SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection](https://mlsanity.com/paper/2305.00550/) (2023)
- [MERLIN -- Malware Evasion with Reinforcement LearnINg](https://mlsanity.com/paper/2203.12980/) (2022)
- [Quo Vadis: Hybrid Machine Learning Meta-Model based on Contextual and Behavioral Malware Representations](https://mlsanity.com/paper/2208.12248/) (2022)
- [AI-based Malware and Ransomware Detection Models](https://mlsanity.com/paper/2207.02108/) (2022)
- [Combating Concept Drift with Explanatory Detection and Adaptation for Android Malware Classification](https://mlsanity.com/paper/2405.04095/) (2024)
- [An Ensemble of Pre-trained Transformer Models For Imbalanced Multiclass Malware Classification](https://mlsanity.com/paper/2112.13236/) (2021)
- [AVScan2Vec: Feature Learning on Antivirus Scan Data for Production-Scale Malware Corpora](https://mlsanity.com/paper/2306.06228/) (2023)
- [Efficient Concept Drift Handling for Batch Android Malware Detection Models](https://mlsanity.com/paper/2309.09807/) (2023)
- [Change Management using Generative Modeling on Digital Twins](https://mlsanity.com/paper/2309.12421/) (2023)
- [A Comprehensive Study on Learning-Based PE Malware Family Classification Methods](https://mlsanity.com/paper/2110.15552/) (2021)
- [Creating Valid Adversarial Examples of Malware](https://mlsanity.com/paper/2306.13587/) (2023)
- [Deep Multi-Task Learning for Malware Image Classification](https://mlsanity.com/paper/2405.05906/) (2024)
- [KiNETGAN: Enabling Distributed Network Intrusion Detection through Knowledge-Infused Synthetic Data Generation](https://mlsanity.com/paper/2405.16476/) (2024)
- [Evaluating the Potential of Quantum Machine Learning in Cybersecurity: A Case-Study on PCA-based Intrusion Detection Systems](https://mlsanity.com/paper/2502.11173/) (2025)
- [A Survey on Cross-Architectural IoT Malware Threat Hunting](https://mlsanity.com/paper/2306.07989/) (2023)
- [Zipf-Gramming: Scaling Byte N-Grams Up to Production Sized Malware Corpora](https://mlsanity.com/paper/2511.13808/) (2025)
- [Parallel Instance Filtering for Malware Detection](https://mlsanity.com/paper/2206.13889/) (2022)
- [Using Static and Dynamic Malware features to perform Malware Ascription](https://mlsanity.com/paper/2112.02639/) (2021)
- [Malware Analysis with Symbolic Execution and Graph Kernel](https://mlsanity.com/paper/2204.05632/) (2022)
- [On the impact of dataset size and class imbalance in evaluating machine-learning-based windows malware detection techniques](https://mlsanity.com/paper/2206.06256/) (2022)
- [Classification of Web Phishing Kits for early detection by platform providers](https://mlsanity.com/paper/2210.08273/) (2022)
- [Clustering based opcode graph generation for malware variant detection](https://mlsanity.com/paper/2211.10048/) (2022)
- [Case Study-Based Approach of Quantum Machine Learning in Cybersecurity: Quantum Support Vector Machine for Malware Classification and Protection](https://mlsanity.com/paper/2306.00284/) (2023)
- [Imbalanced malware classification: an approach based on dynamic classifier selection](https://mlsanity.com/paper/2504.00041/) (2025)

## Abstract (arXiv)

Coping with malware is getting more and more challenging, given their relentless growth in complexity and volume. One of the most common approaches in literature is using machine learning techniques, to automatically learn models and patterns behind such complexity, and to develop technologies to keep pace with malware evolution. This survey aims at providing an overview on the way machine learning has been used so far in the context of malware analysis in Windows environments, i.e. for the analysis of Portable Executables. We systematize surveyed papers according to their objectives (i.e., the expected output), what information about malware they specifically use (i.e., the features), and what machine learning techniques they employ (i.e., what algorithm is used to process the input and produce the output). We also outline a number of issues and challenges, including those concerning the used datasets, and identify the main current topical trends and how to possibly advance them. In particular, we introduce the novel concept of malware analysis economics, regarding the study of existing trade-offs among key metrics, such as analysis accuracy and economical costs.