Existing techniques demand extensive feature engineering

The gap

Evidence profile

Sourced from the future work and limitations and stated research gap of the source papers, classified as general, spanning 2 journals.

Supporting evidence — 4 representative gaps

• 3D volumetric malware detection using morton curves and multi-channel semantic features (2026) · Scientific Reports · doi

  While the proposed volumetric framework demonstrates strong performance under the evaluated conditions, sev- eral methodological, architectural, and generalization-related questions remain open. Addressing these directions is essential for establishing the robustness and scalability of volumetric malware representations. 1. A systematic comparison between Hilbert and Morton mappings at full dataset scale remains an avenue for future investigation. 2. Extension to hierarchical or sliding-window volumetric encoding to handle binaries that exceed the current 643 volume without truncation. 3. The generalizability of the volumetric approach on Linux and Android malware. 4. Development of an operating system-agnostic volumetric encoding framework. 5. Evaluation under adversarial byte-level perturbations and structural obfuscation techniques to assess resil- ience of volumetric representations. 6. Extension from binary classification to fine-grained malware family attribution. 7. A rigorous matched-dataset comparison between the volumetric classifier and classical feature-engineering baselines (Random Forest, Gradient Boosting on EMBER-style11 PE features), training both on identical data and evaluating under a family-disjoint protocol, to establish whether the 3D representation provides measur- able benefit over hand-crafted features on out-of-distribution threats. Collectively, these directions aim to further validate the structural assumptions underlying volumetric encoding, improve cross-domain generalization, and strengthen robustness against adversarial manipulation. Advancing along these lines will help determine whether volumetric malware representations can serve as a scalable and security-resilient alternative to traditional feature-engineered approaches. Acknowledgements The authors would like to thank Vellore Institute of Technology, Vellore, for financial support through an Article Processing Charge (APC) waiver for this publication. Author contributions Parikshieth implemented and tested the hypothesis while Ramesh provided the oversight over the project and alongside Suganthan helped in preparation and revison of the manuscript. Funding This research received no specific grant from any funding agency in the public, commercial, or not-for-profit sec- tors. The Article Processing Charge was waived by Vellore Institute of Technology, Vellore. Data availability The datasets generated during the current study are available in the Hugging Face repository, h t t p s : / / h u g g i n g f a c e . c o / d a t a s e t s / z P a r i k / M o r V i s . The Python scripts required to generate tensors from raw binaries are also provided in Article in PressScientific Reportshttps://doi.org/10.1038/s41598-026-65582-6this repository. Tensors representing benign files can be generated using the provided scripts on user-installed applications.

  generalfuture work
  Keywords: volumetric malware vellore representations encoding article provided framework generalization directions robustness comparison dataset extension binaries
• Enhanced Consistency Bi-directional GAN (CBiGAN) for malware anomaly detection (2026) · Cybersecurity · doi

  While our approach demonstrates promising results, several limitations should be acknowledged. First, the model shows strong overall AUC and AUCPR, yet strug- gles to maintain low false positive rates at very high recall thresholds (e.g., FPR above 0.4 when TPR ≥ 95%), limit- ing its immediate applicability in high sensitivity deploy- ment settings. Second, the malware family labels in our dataset are unevenly distributed and in many cases not well characterized, leaving gaps in understanding the similarities among malware classes and their proximity to benign software. This lack of granularity makes it dif- ficult to assess whether high anomaly scores reflect true malicious behavior or benign outliers that share surface level patterns with malware. Third, by design our pipe- line emphasizes simplicity and reproducibility (minimal preprocessing, straightforward image conversion, and a single GAN-based model). While this design achieves comparability with more complex baselines, it inevitably sacrifices some performance and robustness that could be gained from multi-stage or hybrid systems. Fourthly, our evaluation does not fully explore model explainability: although reconstruction errors and feature discrepancies provide anomaly scores, they do not offer interpretable insights into which regions or features of a binary most strongly contribute to detection decisions. In addition, per family variability on the Microsoft dataset reveals texture bias and packing sensitivity, with strong results on families such as Kelihos V1 but weaker detection on Simda or Kelihos V3, suggesting domain shift between self collected (2018–2023) and older curated samples. Label noise and ground truth uncertainty from public feeds (e.g., PUPs, multi label overlaps) may also confound transfer evaluations. Temporal drift further limits gen- eralization, as models trained on recent threats may fail on legacy malware, while our imaging approach, though Wijayasiri et al. Cybersecurity (2026) 9:165 Page 15 of 16 preserving locality through Hilbert mapping, imposes hand crafted assumptions that underrepresent sparse yet semantically important code regions. Performance also shows hyperparameter and seed sensitivity, and calibra- tion remains imperfect at high recall thresholds. Moreo- ver, we were not able to conduct a robustness evaluation against packing or evasion based perturbations. We emphasize that robustness to adaptive adversarial manip- ulation remains an open problem for all static malware detectors, including both deep learning and signature- based systems.

  generallimitationsevidence 5/5
  Keywords: malware high model sensitivity based robustness approach shows strong recall thresholds family dataset benign anomaly
• Enhanced Consistency Bi-directional GAN (CBiGAN) for malware anomaly detection (2026) · Cybersecurity · doi

  Limitations While our approach demonstrates promising results, several limitations should be acknowledged. First, the model shows strong overall AUC and AUCPR, yet strug- gles to maintain low false positive rates at very high recall thresholds (e.g., FPR above 0.4 when TPR ≥ 95%), limit- ing its immediate applicability in high sensitivity deploy- ment settings. Second, the malware family labels in our dataset are unevenly distributed and in many cases not well characterized, leaving gaps in understanding the similarities among malware classes and their proximity to benign software. This lack of granularity makes it dif- ficult to assess whether high anomaly scores reflect true malicious behavior or benign outliers that share surface level patterns with malware. Third, by design our pipe- line emphasizes simplicity and reproducibility (minimal preprocessing, straightforward image conversion, and a single GAN-based model). While this design achieves comparability with more complex baselines, it inevitably sacrifices some performance and robustness that could be gained from multi-stage or hybrid systems. Fourthly, our evaluation does not fully explore model explainability: although reconstruction errors and feature discrepancies provide anomaly scores, they do not offer interpretable insights into which regions or features of a binary most strongly contribute to detection decisions. In addition, per family variability on the Microsoft dataset reveals texture bias and packing sensitivity, with strong results on families such as Kelihos V1 but weaker detection on Simda or Kelihos V3, suggesting domain shift between self collected (2018–2023) and older curated samples. Label noise and ground truth uncertainty from public feeds (e.g., PUPs, multi label overlaps) may also confound transfer evaluations. Temporal drift further limits gen- eralization, as models trained on recent threats may fail on legacy malware, while our imaging approach, though Wijayasiri et al. Cybersecurity (2026) 9:165 Page 15 of 16 preserving locality through Hilbert mapping, imposes hand crafted assumptions that underrepresent sparse yet semantically important code regions. Performance also shows hyperparameter and seed sensitivity, and calibra- tion remains imperfect at high recall thresholds. Moreo- ver, we were not able to conduct a robustness evaluation against packing or evasion based perturbations. We emphasize that robustness to adaptive adversarial manip- ulation remains an open problem for all static malware detectors, including both deep learning and signature- based systems.

  generallimitationsevidence 5/5
  Keywords: malware high model sensitivity based robustness limitations approach shows strong recall thresholds family dataset benign
• Intelligent malware detection on Android smartphones via a hybrid approach using gradient boosting and convolutional neural network (2026) · Scientific Reports · doi

  Existing techniques demand extensive feature engineering and representation, leading to higher computation times and error rates. The lack of a robust and effective hybrid approach that combines the strengths of Convolutional neural networks and Gradient Boosted Machines for Android malware detection. The need for a technique that can achieve notable improvements in accuracy, precision, recall, and AUC, and significant reductions in false positive rate and error rate.

  generalstated research gapevidence 5/5
  Keywords: existing techniques demand extensive feature engineering representation leading

Questions about this gap