# OpCode-Based Malware Classification Using Machine Learning and Deep Learning Techniques

arXiv: https://arxiv.org/abs/2504.13408 · HTML: https://mlsanity.com/paper/2504.13408/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 20 references that are in the map.
- First posted on arXiv 18 Apr 2025.

## Builds on (most cited first, 6 of 6)

- [Block Hunter: Federated Learning for Cyber Threat Hunting in Blockchain-based IIoT Networks](https://mlsanity.com/paper/2204.09829/) (2022)
- [The Dichotomy of Cloud and IoT: Cloud-Assisted IoT From a Security Perspective](https://mlsanity.com/paper/2207.01590/) (2022)
- [AI in Software Engineering: A Survey on Project Management Applications](https://mlsanity.com/paper/2307.15224/) (2023)
- [P3GNN: A Privacy-Preserving Provenance Graph-Based Model for APT Detection in Software Defined Networking](https://mlsanity.com/paper/2406.12003/) (2024)
- [A Federated Learning Approach for Multi-stage Threat Analysis in Advanced Persistent Threat Campaigns](https://mlsanity.com/paper/2406.13186/) (2024)
- [Safeguarding connected autonomous vehicle communication: Protocols, intra- and inter-vehicular attacks and defenses](https://mlsanity.com/paper/2502.04201/) (2025)

## Built on by (most cited first, 1 of 1)

- [A Structured State Space Sequence Model for Multi-Class Classification of Malware](https://mlsanity.com/paper/2610.01893/) (2026)

## Abstract (arXiv)

This technical report presents a comprehensive analysis of malware classification using OpCode sequences. Two distinct approaches are evaluated: traditional machine learning using n-gram analysis with Support Vector Machine (SVM), K-Nearest Neighbors (KNN), and Decision Tree classifiers; and a deep learning approach employing a Convolutional Neural Network (CNN). The traditional machine learning approach establishes a baseline using handcrafted 1-gram and 2-gram features from disassembled malware samples. The deep learning methodology builds upon the work proposed in "Deep Android Malware Detection" by McLaughlin et al. and evaluates the performance of a CNN model trained to automatically extract features from raw OpCode data. Empirical results are compared using standard performance metrics (accuracy, precision, recall, and F1-score). While the SVM classifier outperforms other traditional techniques, the CNN model demonstrates competitive performance with the added benefit of automated feature extraction.