Open research questions in Advanced Malware Detection Techniques

What the literature leaves open

• The results show three key findings: detection robustness varies substantially across artifact categories, static-feature-based detection is insufficient in several non-PowerShell categories, and high functionality preservation is achieved at scale (94% success rate).

  TransForge: A Genetic Algorithm Framework for Cross-Category Evaluation of Endpoint Detection Robustness to Code Transformations · 2026 · DOI

• Traditional security measures are not effective in distributed edge networks due to the limited processing power of edge devices. There is a need for real-time analysis capabilities, minimal computational overhead, and strong resilience against adversarial evasion techniques. Existing solutions do not address the preservation of data privacy across distributed nodes.

  EdgeFence: Federated Temporal Graph Neural Networks for Lightweight, Adversarial Malware Detection in Distributed Edge Networks · 2026 · DOI

• Existing Android malware detection datasets predominantly focus on static analysis. Most dynamic-based datasets fail to adopt a multi-view setting. Current malware detection strategies are insufficient to effectively safeguard users.

  Lightweight multi-view dynamic android malware detection via time-windowed feature extraction · 2026 · DOI

• The gap is the need for a method that can detect malware in Android environments while enhancing efficiency and privacy. The current methods have limitations in terms of efficiency and privacy.

  An explainable privacy-preserving method for mobile malware detection through federated machine learning · 2026 · DOI

• The existing adversarial attack methods for AMD systems still have some limitations. The adversary's capabilities are limited to perturbing in the problem space and querying efficiently. The adversary is assumed to have no prior knowledge of the target model. The experimental results are based on a simulation of a poisoning attack.

  AdvAttack: Adversarial attack against machine learning-based Android malware detection models · 2026 · DOI

• Further research is needed to improve the robustness of AMD models against adversarial attacks. The potential impact of adversarial samples on the long-term reliability and robustness of AMD models needs to be assessed. New algorithms for crafting adversarial samples need to be developed.

  AdvAttack: Adversarial attack against machine learning-based Android malware detection models · 2026 · DOI

• The need for a proactive hybrid solution that can prevent both known and unknown crypto ransomware attacks in real time, without relying on user intervention or internet connection.

  A proactive camouflage-based approach to prevent crypto-ransomware: the ransomware prevention Toolkit (RPTK) · 2026 · DOI

• Existing defenses are fundamentally reactive and have limitations such as reliance on user intervention and vulnerability to evasion techniques. The growing adoption of double-extortion tactics further exposes critical gaps in current defenses. There is a need for a proactive hybrid solution that can prevent both known and unknown crypto ransomware attacks in real time.

  A proactive camouflage-based approach to prevent crypto-ransomware: the ransomware prevention Toolkit (RPTK) · 2026 · DOI

• Future work will focus on refining our proposed method to provide even more detailed insights into malware functions, thereby enhancing the interpretability of malware detection results. This will ultimately support the key objective of automatically generating comprehensive analysis reports.

  MalHAPGNN: An Enhanced Call Graph-Based Malware Detection Framework Using Hierarchical Attention Pooling Graph Neural Network · 2025 · DOI

• To address these challenges and enhance the sustainability and effectiveness of disaster management apps, several recommendations can be made. Implementing robust data validation processes is essential to enhance the credibility of crowdsourced information. This can be achieved through algorithms that cross-check user reports with official data, ensuring that the information provided is accurate and reliable.

  Harnessing Mobile Technology for Flood Disaster Readiness and Response: A Comprehensive Review of Mobile Applications on the Google Play Store · 2025 · DOI

• The exploration of linguistic nuances in user reviews has introduced a novel dimension to bug detection, bridging the gap between user feedback and actionable insights for developers. The findings of this research have profound implications for the mobile gaming industry.

  Fine-Tuned RoBERTa Model for Bug Detection in Mobile Games: A Comprehensive Approach · 2025 · DOI

• The AOAFS may serve as the foundation for several potential future research studies. First, integrating the island model (i.e., an efficient distributed optimization model) into the AOAFS to improve its execution time.

  AOAFS: A Malware Detection System Using an Improved Arithmetic Optimization Algorithm · 2025 · DOI

• The need for advanced and adaptive threat detection strategies in cloud computing environments. The limitations of conventional architectures such as Convolutional Neural Networks (CNNs) and Recurrent Neural Networks (RNNs) in dealing with high dimensional, sparse, and heterogeneous data.

  Zero-Day Threat Mitigation via Deep Learning in Cloud Environments · 2025 · DOI

• One-class training offers a more economical and streamlined method for detecting malware by obviating the need for extensive malicious data collection and exhaustive labeling efforts. The robust performance of the one-class models, despite the reduced requirement for labeled data, marks a promising direction for efficient and cost-effective malware detection strategies.

  Malware Detection for Internet of Things Using One-Class Classification · 2024 · DOI

• Whether selective agentic planning becomes useful in larger, dynamically generated, cost-heterogeneous probe spaces remains to be established on historical corpora and across multiple model backbones.

  VeriCrypt-Agent: Evidence-Grounded Multi-Agent Verification for Cryptographic Dependency Updates · 2026 · DOI

• Based on the comprehensive performance evaluation, per-malware analysis, and computational time assessment presented in this study, several evidence-driven recommendations can be made for the practical deployment of IoT malware detection systems.

  Systematic Evaluation of Machine Learning and Deep Learning Models for IoT Malware Detection Across Ransomware, Rootkit, Spyware, Trojan, Botnet, Worm, Virus, and Keylogger · 2026 · DOI

• Prior studies have analyzed adversarial perturbations in multi-class malware classification and reported both overall performance degradation and family-level misclassification.

  An advanced framework for malware detection using adversarial learning · 2026 · DOI

• Android, being the most popular operating system, is prone to cyberattacks. Detection and classification of malware has been the focus area of research throughout the process. The detection classification methods started with signature-based methods, progressed to machine learning-based methods, and finally to AI-based methods.

  Obfuscated Malware Detection and Classification in Network Traffic Leveraging Hybrid Large Language Models and Synthetic Data · 2025 · DOI

• Existing methods are unable to understand detailed and contextual relationships in modern software behavior. Static analysis is vulnerable to methods such as encryption and code obfuscation.

  Windows Malware Detection via Enhanced Graph Representations with Node2Vec and Graph Attention Network · 2025 · DOI

• Exploring other lightweight classification models for multi-view Android malware detection, - Investigating the application of the proposed approach to other types of malware, - Developing more efficient feature extraction methods for dynamic…

  Lightweight multi-view dynamic android malware detection via time-windowed feature extraction · 2026 · DOI

• Improving the accuracy of the learned global model, - Enhancing learning performance using diverse datasets, - Addressing the challenges of Federated Machine…

  An explainable privacy-preserving method for mobile malware detection through federated machine learning · 2026 · DOI

• Investigating the use of other LLMs and their impact on the proposed system, - Exploring the application of the proposed system to other domains, - Developing more efficient and effective methods for NLP preprocessing, - Evaluating the performance of the proposed system on larger and more diverse…

  Enhancing android malware detection with retrieval-augmented generation · 2026 · DOI

• Developing more effective approaches to address class-wise misclassification under adversarial settings - Exploring the application of the proposed framework to other domains - Investigating the use of other machine learning models to improve malware…

  An advanced framework for malware detection using adversarial learning · 2026 · DOI

• Class imbalance in datasets - Limited generalization due to behavioral inhomogeneity of benign examples - Requirement for deeper or more scalable architectures for large-scale…

  Windows Malware Detection via Enhanced Graph Representations with Node2Vec and Graph Attention Network · 2025 · DOI

• Investigate more advanced data balancing strategies - Improve the representation and learning of minority classes - Investigate adaptive learning methods and enhanced data augmentation…

  Zero-Day Threat Mitigation via Deep Learning in Cloud Environments · 2025 · DOI

Most-cited papers in Advanced Malware Detection Techniques

• A Comprehensive Review on Malware Detection Approaches · IEEE Access · 2020 · 585 citations
• The rise of machine learning for detection and classification of malware: Research developments, trends and challenges · Journal of Network and Computer Applications · 2020 · 528 citations
• Survey of machine learning techniques for malware analysis · Computers & Security · 2018 · 479 citations
• IMCFN: Image-based malware classification using fine-tuned convolutional neural network architecture · Computer Networks · 2020 · 467 citations
• DL-Droid: Deep learning based android malware detection using real devices · Computers & Security · 2019 · 375 citations
• Image-Based malware classification using ensemble of CNN architectures (IMCEC) · Computers & Security · 2020 · 347 citations
• A Review of Android Malware Detection Approaches Based on Machine Learning · IEEE Access · 2020 · 331 citations
• Ransomware threat success factors, taxonomy, and countermeasures: A survey and research directions · Computers & Security · 2018 · 305 citations
• A Survey of Android Malware Detection with Deep Neural Models · ACM Computing Surveys · 2020 · 295 citations
• Malware identification using visualization images and deep learning · Computers & Security · 2018 · 271 citations

Most recent work

• vul-rag : Enhancing LLM-based Vulnerability Detection via Knowledge-level RAG · ACM Transactions on Software Engineering and Methodology · 2026
• Large language model (LLM) for software security: Code analysis, malware analysis, reverse engineering · Journal of Information Security and Applications · 2026
• Systematic Evaluation of Machine Learning and Deep Learning Models for IoT Malware Detection Across Ransomware, Rootkit, Spyware, Trojan, Botnet, Worm, Virus, and Keylogger · Sensors · 2026
• Investigating Artificial Intelligence Approaches to Cybersecurity in Internet of Things Manufacturing Systems and a Deep Hybrid Learning Framework for Malware Detection · Journal of Manufacturing Science and Engineering · 2026
• Explainable android malware detection and malicious code localization using graph attention · Journal of Information Security and Applications · 2026
• DySec: A Machine Learning-Based Dynamic Analysis for Detecting Malicious Packages in PyPI Ecosystem · IEEE Transactions on Information Forensics and Security · 2026
• Android Zero-Day Guard: Zero-Shot Malware Detection Using Deep Learning and Generative Models · IEEE Transactions on Network and Service Management · 2026
• A hybrid machine learning intrusion detection method for metamorphic malware · International Journal of Information Security · 2026
• MLRan: A behavioural dataset for ransomware analysis and detection · Journal of Network and Computer Applications · 2026
• An automated multi-scale and multi-contextual MobileNetv3 for malware detection based on IoT · Array · 2026

Related topics in Computer Science