# A Survey of Malware Detection Using Deep Learning

arXiv: https://arxiv.org/abs/2407.19153 · HTML: https://mlsanity.com/paper/2407.19153/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- Builds on 33 of its 117 references that are in the map.
- First posted on arXiv 27 Jul 2024.

## Builds on (most cited first, 30 of 33)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [ImageNet Large Scale Visual Recognition Challenge](https://mlsanity.com/paper/1409.0575/) (2014)
- [EfficientNet: Rethinking Model Scaling for Convolutional Neural Networks](https://mlsanity.com/paper/1905.11946/) (2019)
- [Rethinking the Inception Architecture for Computer Vision](https://mlsanity.com/paper/1512.00567/) (2015)
- ["Why Should I Trust You?": Explaining the Predictions of Any Classifier](https://mlsanity.com/paper/1602.04938/) (2016)
- [Neural Machine Translation by Jointly Learning to Align and Translate](https://mlsanity.com/paper/1409.0473/) (2014)
- [Efficient Estimation of Word Representations in Vector Space](https://mlsanity.com/paper/1301.3781/) (2013)
- [Going Deeper with Convolutions](https://mlsanity.com/paper/1409.4842/) (2014)
- [Xception: Deep Learning with Depthwise Separable Convolutions](https://mlsanity.com/paper/1610.02357/) (2016)
- [Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learning](https://mlsanity.com/paper/1602.07261/) (2016)
- [Learning Important Features Through Propagating Activation Differences](https://mlsanity.com/paper/1704.02685/) (2017)
- [Effective Approaches to Attention-based Neural Machine Translation](https://mlsanity.com/paper/1508.04025/) (2015)
- [Dynamic Routing Between Capsules](https://mlsanity.com/paper/1710.09829/) (2017)
- [A Benchmark for Interpretability Methods in Deep Neural Networks](https://mlsanity.com/paper/1806.10758/) (2018)
- [Unsupervised Learning of Sentence Embeddings using Compositional n-Gram Features](https://mlsanity.com/paper/1703.02507/) (2017)
- [Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN](https://mlsanity.com/paper/1702.05983/) (2017)
- [What Do You See? Evaluation of Explainable Artificial Intelligence (XAI) Interpretability through Neural Backdoors](https://mlsanity.com/paper/2009.10639/) (2020)
- [SoK: Explainable Machine Learning for Computer Security Applications](https://mlsanity.com/paper/2208.10605/) (2022)
- [Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art](https://mlsanity.com/paper/2112.12310/) (2021)
- [A Comparison of Static, Dynamic, and Hybrid Analysis for Malware Detection](https://mlsanity.com/paper/2203.09938/) (2022)
- [Transfer Learning for Image-Based Malware Classification](https://mlsanity.com/paper/1903.11551/) (2019)
- [DeepEDN: A Deep Learning-based Image Encryption and Decryption Network for Internet of Medical Things](https://mlsanity.com/paper/2004.05523/) (2020)
- [MalFox: Camouflaged Adversarial Malware Example Generation Based on Conv-GANs Against Black-Box Detectors](https://mlsanity.com/paper/2011.01509/) (2020)
- [OFEI: A Semi-black-box Android Adversarial Sample Attack Framework Against DLaaS](https://mlsanity.com/paper/2105.11593/) (2021)
- [Explainable Artificial Intelligence and Causal Inference based ATM Fraud Detection](https://mlsanity.com/paper/2211.10595/) (2022)
- [Classifying Malware Images with Convolutional Neural Network Models](https://mlsanity.com/paper/2010.16108/) (2020)
- [Zero-shot learning approach to adaptive Cybersecurity using Explainable AI](https://mlsanity.com/paper/2106.14647/) (2021)
- [CNN-LSTM and Transfer Learning Models for Malware Classification based on Opcodes and API Calls](https://mlsanity.com/paper/2405.02548/) (2024)

## Built on by (most cited first, 9 of 9)

- [Gen-AI for User Safety: A Survey](https://mlsanity.com/paper/2411.06606/) (2024)
- [PBP: Post-training Backdoor Purification for Malware Classifiers](https://mlsanity.com/paper/2412.03441/) (2024)
- [Optimized detection of cyber-attacks on IoT networks via hybrid deep learning models](https://mlsanity.com/paper/2502.11470/) (2025)
- [Information Security Based on LLM Approaches: A Review](https://mlsanity.com/paper/2507.18215/) (2025)
- [Automated Malware Family Classification using Weighted Hierarchical Ensembles of Large Language Models](https://mlsanity.com/paper/2604.02490/) (2026)
- [A Novel Active Learning Approach to Label One Million Unknown Malware Variants](https://mlsanity.com/paper/2507.02959/) (2025)
- [Benchmarking Machine Learning Models for IoT Malware Detection under Data Scarcity and Drift](https://mlsanity.com/paper/2601.18736/) (2026)
- [ThreatVisionAI: A Hybrid CNN-ViT Framework for Image-Based Malware Classification](https://mlsanity.com/paper/2607.03653/) (2026)
- [Unlearning to Protect: A Distilled Reinforcement Learning Framework with Privacy-Preserving Feature Unlearning and XAI for IoT Security](https://mlsanity.com/paper/2607.07635/) (2026)

## Abstract (arXiv)

The problem of malicious software (malware) detection and classification is a complex task, and there is no perfect approach. There is still a lot of work to be done. Unlike most other research areas, standard benchmarks are difficult to find for malware detection. This paper aims to investigate recent advances in malware detection on MacOS, Windows, iOS, Android, and Linux using deep learning (DL) by investigating DL in text and image classification, the use of pre-trained and multi-task learning models for malware detection approaches to obtain high accuracy and which the best approach if we have a standard benchmark dataset. We discuss the issues and the challenges in malware detection using DL classifiers by reviewing the effectiveness of these DL classifiers and their inability to explain their decisions and actions to DL developers presenting the need to use Explainable Machine Learning (XAI) or Interpretable Machine Learning (IML) programs. Additionally, we discuss the impact of adversarial attacks on deep learning models, negatively affecting their generalization capabilities and resulting in poor performance on unseen data. We believe there is a need to train and test the effectiveness and efficiency of the current state-of-the-art deep learning models on different malware datasets. We examine eight popular DL approaches on various datasets. This survey will help researchers develop a general understanding of malware recognition using deep learning.