# MalPhase: Fine-Grained Malware Detection Using Network Flow Data

arXiv: https://arxiv.org/abs/2106.00541 · HTML: https://mlsanity.com/paper/2106.00541/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 59 references that are in the map.
- First posted on arXiv 1 Jun 2021.

## Builds on (most cited first, 5 of 5)

- [EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models](https://mlsanity.com/paper/1804.04637/) (2018)
- [Medical image denoising using convolutional denoising autoencoders](https://mlsanity.com/paper/1608.04667/) (2016)
- [Early Stage Malware Prediction Using Recurrent Neural Networks](https://mlsanity.com/paper/1708.03513/) (2017)
- [The Naked Sun: Malicious Cooperation Between Benign-Looking Processes](https://mlsanity.com/paper/1911.02423/) (2019)
- [EnCoD: Distinguishing Compressed and Encrypted File Fragments](https://mlsanity.com/paper/2010.07754/) (2020)

## Built on by (most cited first, 7 of 7)

- [SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection](https://mlsanity.com/paper/2305.00550/) (2023)
- [TATTOOED: A Robust Deep Neural Network Watermarking Scheme based on Spread-Spectrum Channel Coding](https://mlsanity.com/paper/2202.06091/) (2022)
- [Do You Trust Your Model? Emerging Malware Threats in the Deep Learning Ecosystem](https://mlsanity.com/paper/2403.03593/) (2024)
- [Minerva: A File-Based Ransomware Detector](https://mlsanity.com/paper/2301.11050/) (2023)
- [Have You Poisoned My Data? Defending Neural Networks against Data Poisoning](https://mlsanity.com/paper/2403.13523/) (2024)
- [UniNet: A Unified Multi-granular Traffic Modeling Framework for Network Security](https://mlsanity.com/paper/2503.04174/) (2025)
- [Orchestrating Collaborative Cybersecurity: A Secure Framework for Distributed Privacy-Preserving Threat Intelligence Sharing](https://mlsanity.com/paper/2209.02676/) (2022)

## Abstract (arXiv)

Economic incentives encourage malware authors to constantly develop new, increasingly complex malware to steal sensitive data or blackmail individuals and companies into paying large ransoms. In 2017, the worldwide economic impact of cyberattacks is estimated to be between 445 and 600 billion USD, or 0.8% of global GDP. Traditionally, one of the approaches used to defend against malware is network traffic analysis, which relies on network data to detect the presence of potentially malicious software. However, to keep up with increasing network speeds and amount of traffic, network analysis is generally limited to work on aggregated network data, which is traditionally challenging and yields mixed results. In this paper we present MalPhase, a system that was designed to cope with the limitations of aggregated flows. MalPhase features a multi-phase pipeline for malware detection, type and family classification. The use of an extended set of network flow features and a simultaneous multi-tier architecture facilitates a performance improvement for deep learning models, making them able to detect malicious flows (>98% F1) and categorize them to a respective malware type (>93% F1) and family (>91% F1). Furthermore, the use of robust features and denoising autoencoders allows MalPhase to perform well on samples with varying amounts of benign traffic mixed in. Finally, MalPhase detects unseen malware samples with performance comparable to that of known samples, even when interlaced with benign flows to reflect realistic network environments.