# A Comparison of Static, Dynamic, and Hybrid Analysis for Malware Detection

arXiv: https://arxiv.org/abs/2203.09938 · HTML: https://mlsanity.com/paper/2203.09938/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- Builds on 0 of its 52 references that are in the map.
- First posted on arXiv 13 Mar 2022.

## Built on by (most cited first, 17 of 17)

- [From Prompt Injections to SQL Injection Attacks: How Protected is Your LLM-Integrated Web Application?](https://mlsanity.com/paper/2308.01990/) (2023)
- [A Survey of Malware Detection Using Deep Learning](https://mlsanity.com/paper/2407.19153/) (2024)
- [Self-Supervised Vision Transformers for Malware Detection](https://mlsanity.com/paper/2208.07049/) (2022)
- [Explainable Artificial Intelligence (XAI) for Malware Analysis: A Survey of Techniques, Applications, and Open Challenges](https://mlsanity.com/paper/2409.13723/) (2024)
- [A Natural Language Processing Approach to Malware Classification](https://mlsanity.com/paper/2307.11032/) (2023)
- [A Comparison of Graph Neural Networks for Malware Classification](https://mlsanity.com/paper/2303.12812/) (2023)
- [Classification and Online Clustering of Zero-Day Malware](https://mlsanity.com/paper/2305.00605/) (2023)
- [Creating Valid Adversarial Examples of Malware](https://mlsanity.com/paper/2306.13587/) (2023)
- [Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy?](https://mlsanity.com/paper/2504.13769/) (2025)
- [Parallel Instance Filtering for Malware Detection](https://mlsanity.com/paper/2206.13889/) (2022)
- [Benchmark of Data Preprocessing Methods for Imbalanced Classification](https://mlsanity.com/paper/2303.03094/) (2023)
- [Leveraging Reinforcement Learning in Red Teaming for Advanced Ransomware Attack Simulations](https://mlsanity.com/paper/2406.17576/) (2024)
- [A Novel Approach to Malicious Code Detection Using CNN-BiLSTM and Feature Fusion](https://mlsanity.com/paper/2410.09401/) (2024)
- [Generative AI-Based Effective Malware Detection for Embedded Computing Systems](https://mlsanity.com/paper/2404.02344/) (2024)
- [Malware Classification using a Hybrid Hidden Markov Model-Convolutional Neural Network](https://mlsanity.com/paper/2412.18932/) (2024)
- [EGAMA-RC: Risk-Calibrated Evidence-Gated Adaptive Malware Analysis for Robust and Interpretable Memory-Forensic Triage](https://mlsanity.com/paper/2608.22721/) (2026)
- [SkillAtlas: An Attack Trace Library for Agent Skills](https://mlsanity.com/paper/2609.13353/) (2026)

## Abstract (arXiv)

In this research, we compare malware detection techniques based on static, dynamic, and hybrid analysis. Specifically, we train Hidden Markov Models (HMMs ) on both static and dynamic feature sets and compare the resulting detection rates over a substantial number of malware families. We also consider hybrid cases, where dynamic analysis is used in the training phase, with static techniques used in the detection phase, and vice versa. In our experiments, a fully dynamic approach generally yields the best detection rates. We discuss the implications of this research for malware detection based on hybrid techniques.