# EGAMA-RC: Risk-Calibrated Evidence-Gated Adaptive Malware Analysis for Robust and Interpretable Memory-Forensic Triage

arXiv: https://arxiv.org/abs/2608.22721 · HTML: https://mlsanity.com/paper/2608.22721/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 46 references that are in the map.
- First posted on arXiv 24 Aug 2026.

## Builds on (most cited first, 8 of 8)

- [Dynamic Malware Analysis with Feature Engineering and Feature Learning](https://mlsanity.com/paper/1907.07352/) (2019)
- [A Comparison of Static, Dynamic, and Hybrid Analysis for Malware Detection](https://mlsanity.com/paper/2203.09938/) (2022)
- [MalProtect: Stateful Defense Against Adversarial Query Attacks in ML-based Malware Detection](https://mlsanity.com/paper/2302.10739/) (2023)
- [Explainable Artificial Intelligence (XAI) for Malware Analysis: A Survey of Techniques, Applications, and Open Challenges](https://mlsanity.com/paper/2409.13723/) (2024)
- [Explainable Malware Detection through Integrated Graph Reduction and Learning Techniques](https://mlsanity.com/paper/2412.03634/) (2024)
- [StratDef: Strategic Defense Against Adversarial Attacks in ML-based Malware Detection](https://mlsanity.com/paper/2202.07568/) (2022)
- [Detecting new obfuscated malware variants: A lightweight and interpretable machine learning approach](https://mlsanity.com/paper/2407.07918/) (2024)
- [On deceiving malware classification with section injection](https://mlsanity.com/paper/2208.06092/) (2022)

## Abstract (arXiv)

Machine-learning malware detectors often achieve high clean-data accuracy, but operational triage also requires evidence about uncertainty, novelty, robustness, interpretability, latency, and review cost. This paper presents EGAMA-RC, a risk-calibrated evidence-gated framework for memory-forensic malware triage. Building on SHAP-guided feature refinement, EGAMA-RC combines dataset-specific refinement, model-pool evaluation, adversarial and open-family testing, novelty scoring, explanation-conditioned evidence, and runtime-aware routing. Low-risk samples are accepted automatically, while uncertain, high-risk, or potentially novel cases are routed to review, escalation, or novelty-aware handling. Across three malware datasets and a frozen multi-seed protocol, the selected hybrid gate accepts 93.12% of pooled samples with 99.86% accepted accuracy and a 0.136% false-accept rate. Novelty calibration reduces over-restrictive review behavior while preserving a low unsafe-accept profile. XGBoost provides lightweight fast-path inference with p50/p95 latency of 0.0054/0.0059 ms per sample. The results show that dependable malware analysis requires risk-calibrated routing, novelty awareness, and controlled analyst review, not classification accuracy alone.