# A Survey of Machine Learning Methods and Challenges for Windows Malware Classification

arXiv: https://arxiv.org/abs/2006.09271 · HTML: https://mlsanity.com/paper/2006.09271/

## Key facts

- Cited by 33 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Jun 2020.

## Built on by (most cited first, 30 of 33)

- [EMBER2024 -- A Benchmark Dataset for Holistic Evaluation of Malware Classifiers](https://mlsanity.com/paper/2506.05074/) (2025)
- [Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art](https://mlsanity.com/paper/2112.12310/) (2021)
- [MOTIF: A Large Malware Reference Dataset with Ground Truth Family Labels](https://mlsanity.com/paper/2111.15031/) (2021)
- [A Framework for Cluster and Classifier Evaluation in the Absence of Reference Labels](https://mlsanity.com/paper/2109.11126/) (2021)
- [Out of Distribution Data Detection Using Dropout Bayesian Neural Networks](https://mlsanity.com/paper/2202.08985/) (2022)
- [Assemblage: Automatic Binary Dataset Construction for Machine Learning](https://mlsanity.com/paper/2405.03991/) (2024)
- [MERLIN -- Malware Evasion with Reinforcement LearnINg](https://mlsanity.com/paper/2203.12980/) (2022)
- [Adversarial Transfer Attacks With Unknown Data and Class Overlap](https://mlsanity.com/paper/2109.11125/) (2021)
- [Rank-1 Similarity Matrix Decomposition For Modeling Changes in Antivirus Consensus Through Time](https://mlsanity.com/paper/2201.00757/) (2021)
- [AI-based Malware and Ransomware Detection Models](https://mlsanity.com/paper/2207.02108/) (2022)
- [Towards an Automated Pipeline for Detecting and Classifying Malware through Machine Learning](https://mlsanity.com/paper/2106.05625/) (2021)
- [Holographic Global Convolutional Networks for Long-Range Prediction Tasks in Malware Detection](https://mlsanity.com/paper/2403.17978/) (2024)
- [Is Function Similarity Over-Engineered? Building a Benchmark](https://mlsanity.com/paper/2410.22677/) (2024)
- [AVScan2Vec: Feature Learning on Antivirus Scan Data for Production-Scale Malware Corpora](https://mlsanity.com/paper/2306.06228/) (2023)
- [Small Effect Sizes in Malware Detection? Make Harder Train/Test Splits!](https://mlsanity.com/paper/2312.15813/) (2023)
- [A Comprehensive Study on Learning-Based PE Malware Family Classification Methods](https://mlsanity.com/paper/2110.15552/) (2021)
- [MalMixer: Few-Shot Malware Classification with Retrieval-Augmented Semi-Supervised Learning](https://mlsanity.com/paper/2409.13213/) (2024)
- [Zipf-Gramming: Scaling Byte N-Grams Up to Production Sized Malware Corpora](https://mlsanity.com/paper/2511.13808/) (2025)
- [Toward the Detection of Polyglot Files](https://mlsanity.com/paper/2203.07561/) (2022)
- [Marvolo: Programmatic Data Augmentation for Practical ML-Driven Malware Detection](https://mlsanity.com/paper/2206.03265/) (2022)
- [Parallel Instance Filtering for Malware Detection](https://mlsanity.com/paper/2206.13889/) (2022)
- [Towards an in-depth detection of malware using distributed QCNN](https://mlsanity.com/paper/2312.12161/) (2023)
- [Use of Multi-CNNs for Section Analysis in Static Malware Detection](https://mlsanity.com/paper/2402.04102/) (2024)
- [Adaptive Malware Detection using Sequential Feature Selection: A Dueling Double Deep Q-Network (D3QN) Framework for Intelligent Classification](https://mlsanity.com/paper/2507.04372/) (2025)
- [Trident: Improving Malware Detection with LLMs and Behavioral Features](https://mlsanity.com/paper/2605.00297/) (2026)
- [MalwareDNA: Simultaneous Classification of Malware, Malware Families, and Novel Malware](https://mlsanity.com/paper/2309.01350/) (2023)
- [On the Effectiveness of Adversarial Samples against Ensemble Learning-based Windows PE Malware Detectors](https://mlsanity.com/paper/2309.13841/) (2023)
- [Malware Classification Leveraging NLP & Machine Learning for Enhanced Accuracy](https://mlsanity.com/paper/2506.16224/) (2025)
- [Certifiably robust malware detectors by design](https://mlsanity.com/paper/2508.10038/) (2025)
- [Machine Learning Transferability for Malware Detection](https://mlsanity.com/paper/2603.26632/) (2026)

## Abstract (arXiv)

Malware classification is a difficult problem, to which machine learning methods have been applied for decades. Yet progress has often been slow, in part due to a number of unique difficulties with the task that occur through all stages of the developing a machine learning system: data collection, labeling, feature creation and selection, model selection, and evaluation. In this survey we will review a number of the current methods and challenges related to malware classification, including data collection, feature extraction, and model construction, and evaluation. Our discussion will include thoughts on the constraints that must be considered for machine learning based solutions in this domain, and yet to be tackled problems for which machine learning could also provide a solution. This survey aims to be useful both to cybersecurity practitioners who wish to learn more about how machine learning can be applied to the malware problem, and to give data scientists the necessary background into the challenges in this uniquely complicated space.