# Reliable Malware Analysis and Detection using Topology Data Analysis

arXiv: https://arxiv.org/abs/2211.01535 · HTML: https://mlsanity.com/paper/2211.01535/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 50 references that are in the map.
- First posted on arXiv 3 Nov 2022.

## Builds on (most cited first, 13 of 13)

- [Persistence Images: A Stable Vector Representation of Persistent Homology](https://mlsanity.com/paper/1507.06217/) (2015)
- [An introduction to Topological Data Analysis: fundamental and practical aspects for data scientists](https://mlsanity.com/paper/1710.04019/) (2017)
- [A Random Forest Guided Tour](https://mlsanity.com/paper/1511.05741/) (2015)
- [A roadmap for the computation of persistent homology](https://mlsanity.com/paper/1506.08903/) (2015)
- [A Stable Multi-Scale Kernel for Topological Machine Learning](https://mlsanity.com/paper/1412.6821/) (2014)
- [Understanding graph embedding methods and their applications](https://mlsanity.com/paper/2012.08019/) (2020)
- [Large Scale computation of Means and Clusters for Persistence Diagrams using Optimal Transport](https://mlsanity.com/paper/1805.08331/) (2018)
- [Kernel method for persistence diagrams via kernel embedding and weight factor](https://mlsanity.com/paper/1706.03472/) (2017)
- [Distributed computation of persistent homology](https://mlsanity.com/paper/1310.0710/) (2013)
- [Threat Assessment in Machine Learning based Systems](https://mlsanity.com/paper/2207.00091/) (2022)
- [A Parallel Random Forest Algorithm for Big Data in a Spark Cloud Computing Environment](https://mlsanity.com/paper/1810.07748/) (2018)
- [Persistent Homology and Graphs Representation Learning](https://mlsanity.com/paper/2102.12926/) (2021)
- [Topological Data Analysis for Anomaly Detection in Host-Based Logs](https://mlsanity.com/paper/2204.12919/) (2022)

## Built on by (most cited first, 1 of 1)

- [MeLeMaD: Adaptive Malware Detection via Chunk-wise Feature Selection and Meta-Learning](https://mlsanity.com/paper/2512.23987/) (2025)

## Abstract (arXiv)

Increasingly, malwares are becoming complex and they are spreading on networks targeting different infrastructures and personal-end devices to collect, modify, and destroy victim information. Malware behaviors are polymorphic, metamorphic, persistent, able to hide to bypass detectors and adapt to new environments, and even leverage machine learning techniques to better damage targets. Thus, it makes them difficult to analyze and detect with traditional endpoint detection and response, intrusion detection and prevention systems. To defend against malwares, recent work has proposed different techniques based on signatures and machine learning. In this paper, we propose to use an algebraic topological approach called topological-based data analysis (TDA) to efficiently analyze and detect complex malware patterns. Next, we compare the different TDA techniques (i.e., persistence homology, tomato, TDA Mapper) and existing techniques (i.e., PCA, UMAP, t-SNE) using different classifiers including random forest, decision tree, xgboost, and lightgbm. We also propose some recommendations to deploy the best-identified models for malware detection at scale. Results show that TDA Mapper (combined with PCA) is better for clustering and for identifying hidden relationships between malware clusters compared to PCA. Persistent diagrams are better to identify overlapping malware clusters with low execution time compared to UMAP and t-SNE. For malware detection, malware analysts can use Random Forest and Decision Tree with t-SNE and Persistent Diagram to achieve better performance and robustness on noised data.