Cas illoCama goe al. Cybe secu i y (2025) 8:97
h ps://doi.o g/10.1186/s42400-025-00396-z
RESEARCH Open Access
© The Au ho (s) 2025. Open Access This a icle is licensed unde a C ea i e Commons A ibu ion 4.0 In e na ional License, which
pe mi s use, sha ing, adap a ion, dis ibu ion and ep oduc ion in any medium o o ma , as long as you gi e app op ia e c edi o he
o iginal au ho (s) and he sou ce, p o ide a link o he C ea i e Commons licence, and indica e i changes we e made. The images o
o he hi d pa y ma e ial in his a icle a e included in he a icle’s C ea i e Commons licence, unless indica ed o he wise in a c edi line
o he ma e ial. I ma e ial is no included in he a icle’s C ea i e Commons licence and you in ended use is no pe mi ed by s a u o y
egula ion o exceeds he pe mi ed use, you will need o ob ain pe mission di ec ly om he copy igh holde . To iew a copy o his
licence, isi h p:// c ea i eco mmons. o g/ licen ses/ by/4. 0/.
Cybe secu i y
DEFENDIFY: de ense ampli ied wi h ans e
lea ning o ob usca ed malwa e amewo k
Rod igo Cas illo Cama go1, Juan Mu cia Nie o1, Nicolás Rojas4, Daniel Díaz‑López1* , San iago Al é ez3,
Angel Luis Pe ales Gómez2, Pan aleone Nespoli2, Félix Gómez Má mol2 and Umi Ka abiyik5
Abs ac
The exis ence o malicious so wa e (malwa e) ep esen s a po en ial h ea o use s who connec o a la ge se
o se ices p o ided by mul iple p o ide s. Such malwa e is capable o s ealing, spying on, enc yp ing da a om use s,
and sp eading, p o oking impac s ha a e beyond a single ci izen’s de ice and eaching c i ical in o ma ion sys ems.
To de ec malwa e amilies, Machine Lea ning and Deep Lea ning echniques ha e been employed ecen ly, demon‑
s a ing p omising esul s. Howe e , hese echniques lack in de ec ing mo e ad anced malwa e ha employs ob us‑
ca ion echniques. In his pape , we p esen DEFENDIFY, a no el amewo k, empowe ed by Compu e Vision, Deep
Lea ning, and T ans e Lea ning echniques, ha is able o de ec comple ely ob usca ed malwa e wi h high pe o ‑
mance in e ms o accu acy and compu a ional consump ion. DEFENDIFY comp ises h ee modules: Da ase C ea‑
ion, Bina y Ob usca ion, and Model Gene a ion. These modules wo k oge he o de ec bo h ob usca ed and non‑
ob usca ed malwa e. The co e module, i.e., he Model Gene a ion, employs an en opy es e ha de e mines
whe he a sample is ob usca ed o no . Then, a Deep Lea ning model powe ed by T ans e Lea ning is employed
o de e mine i i is malwa e o goodwa e. We alida ed ou amewo k using eal da a ga he ed om malwa e
eposi o ies and legi ima e so wa e. The p oposed amewo k was con igu ed o es ou Con olu ional Neu al
Ne wo k a chi ec u es: ResNe 18, ResNe 34, E icien Ne B3, and E icien Ne V2S. Among hem, he ResNe 18 a chi‑
ec u e ob ained he bes pe o mance in de ec ing bo h non‑ob usca ed and ob usca ed samples wi h an F1‑sco e
o 99.34% and 97.5%, espec i ely.
Keywo ds Malwa e de ec ion, Malwa e ob usca ion, Compu e ision, T ans e lea ning, Deep lea ning, Ne wo king
sys em o a i icial in elligence
In oduc ion
Wi h he ise o new echnologies such as he In e -
ne o Things (IoT)(Gla oudis e al. 2020) and Big Da a
(BD) (Iaksch e al. 2021), ci ies ha e become inc eas-
ingly au oma ed, hus emb acing he sma ci ies pa a-
digm(Ris ej e al. 2020). This has undoub edly p o ided
a clea ad an age o all ci izens, enabling access o unim-
aginable se ices jus en yea s ago. Howe e , he e a ises
an u gen need o sa egua ding he digi al backbone. As
we imme se ou sel es in he ans o ma i e po en ial o
IoT and BD wi hin ci y in as uc u es, he ulne abili y
o cybe h ea s becomes inc easingly p onounced, and
he e o e, new dange s loom o e he inhabi an s o a
sma ci y.
*Co espondence:
Daniel Díaz‑López
danielo.diaz@u osa io.edu.co
1 School o Enginee ing, Science and Technology, Uni e sidad del Rosa io,
K 6 12c‑16, Bogo á 111711, Cundinama ca, Colombia
2 Facul y o Compu e Science, Uni e si y o Mu cia, Campus de
Espina do, 30100 Mu cia, Mu cia, Spain
3 Depa men o Ma hema ics, Ba celona Eas Enginee ing School,
Poly echnic Uni e si y o Ca alonia, 610101 Ba celona, Ca alonia, Spain
4 School o Enginee ing, Pon i ical Xa ie ian Uni e si y, Bogo á 610101,
Cundinama ca, Colombia
5 Depa men o Compu e and In o ma ion Technology, Pu due
Uni e si y, Wes La aye e, IN 610101, USA
Page 2 o 23
Cas illoCama goe al. Cybe secu i y (2025) 8:97
One o he c i ical h eads in sma ci ies is cybe se-
cu i y and, especially, he p oli e a ion o malwa e(Ma
2021). Speci ically, his e m is used o e e o mali-
cious p og ams designed o pe o m ha m ul ac ions on
use ’s de ices(Useche-Pelaez e al. 2018). These ac ions
may include spying on use s, s ealing sensi i e in o ma-
ion, damaging he ic im’s de ice, o execu ing o he
malicious ac ions, o ci e some examples(Ma ínez Ma -
ínez e al. 2021). Di e en sma ci y se ices could be
a ec ed by a malicious campaign, e.g. a ic manage-
men , pollu ion moni o ing, wa e quali y con ol, public
sa e y suppo , e c. Fu he mo e, he e a e also o ganized
campaigns designed o sp ead malwa e and a ge di e -
en ic ims, as dissemina ion and exploi a ion o malwa e
ha e become a p o i able business(Hakon e al. 2020).
As new o ms o malwa e a e cons an ly being c ea ed
and sp ead, he an i h ea indus y has sough o mi i-
ga e he isk o a machine being in ec ed wi h a malicious
p og am h ough a ious malwa e de ec ion echniques.
These echniques include he use o di e en ypes o
signa u es, such as hos -based, malwa e, and ne wo k
signa u es(Pelaez e al. 2018; Nespoli e al. 2019), o ML
algo i hms such as suppo ec o machine (SVM) and
Random Fo es , achie ing p omising esul s(Joshi e al.
2018).
Due o he ad ancemen in an i i us indus y, malwa e
e asion echniques ha e also been de eloped o educe
he e ec i eness o he p oposed de ec ion me hods.
Among o he s, a well-known e asion echnique le e -
ages he use o encode s o ob usca o s, which a e coding
unc ions ha change he appea ance o p og ams, hus
making hem un ecognizable o an i i uses and allow-
ing a acke s o bypass p o ec ion laye s when deli e ing
malwa e(Kim e al. 2018). Ne e heless, i is impo an
o no e ha no all encoded o ob usca ed bina ies a e
malicious p og ams. The e is also well-in en ioned so -
wa e, commonly e e ed o as goodwa e, ha is encoded
by i s de elope s o p o ec i om indus ial espionage
o ampe ing (To alini e al. 2019). In his pape , he
wo ds encoded/ob usca ed and non-encoded/non-ob us-
ca ed will be used indis inc ly.
In his scena io, some s udies p oposed he use o a i-
icial in elligence (AI), and especially machine lea ning
(ML) and deep lea ning (DL) echniques o de ec mal-
wa e. Among hese echniques, DL models ocused on
he compu e ision (CV) ield a e gaining p ominence
due o hei abili y o au oma ically ex ac ea u es ha
can cap u e sub le pa e ns in ob usca ed code ha migh
be in isible o adi ional analysis me hods.. The p o-
cedu e is o conside malwa e as images and use image
classi ica ion o de ec malwa e by iden i ying key ea-
u es o he image(Pe ei a-Koha su e al. 2019; Xue e al.
2019; Bensaoud e al. 2020). The mos c i ical limi a ion
o hese app oaches and hose based on adi ional ML
algo i hms o signa u es is ha hey do no allow one o
de ec comple ely ob usca ed malwa e. Fu he mo e, he
p ocedu es o ain hese models a e highly expensi e
ega ding he compu a ion ime since hey need o ain
an en i e DL model om sc a ch, p e en ing he wide
adop ion o hese sys ems in cu en echnological sce-
na ios o in u u e sma ci y a chi ec u es.
One echnique ha can imp o e he esul ob ained
in his ield is he ans e lea ning (TL)(Weiss e al.
2016), which consis s on apply he knowledge acqui ed
in one domain such as CV on ano he new domain such
as malwa e classi ica ion. By ans e ing lea ned ep e-
sen a ions om p e- ained models on image da ase s,
i is possible o adap hese insigh s o he speci ic ask
o malwa e de ec ion. This s a egy no only educes he
aining ime equi ed bu also signi ican ly enhances
de ec ion pe o mance, making i a mo e e icien and
e ec i e solu ion o iden i ying complex, hidden h ea s.
The majo mo i a ion o ou esea ch s ems om
h ee c i ical challenges in cu en malwa e de ec ion
app oaches. Fi s , he e is a signi ican gap in e ec i ely
de ec ing comple ely ob usca ed malwa e using s a ic
analysis echniques, which is essen ial o iden i ying
h ea s be o e execu ion. Second, he subs an ial com-
pu a ional esou ces equi ed o aining deep lea n-
ing models om sc a ch make many cu en solu ions
imp ac ical o widesp ead deploymen . Thi d, he e is a
lack o comp ehensi e amewo ks ha in eg a e di e -
en componen s necessa y o e ec i e de ec ion o bo h
ob usca ed and non-ob usca ed malwa e in eal-wo ld
scena ios.
Addi ionally, ano he ou s anding componen in
de ec ing malwa e samples is he en opy es e (Ba -
E dene e al. 2017). In pa icula , he en opy-based
ob usca ion es e can be desc ibed as a undamen al
componen as pa o he s a ic analysis p ocess, allowing
o he classi ica ion o bo h ob usca ed and non-ob us-
ca ed bina ies wi hou needing dynamic analysis.
Las bu no leas , a c i ical challenge o AI-powe ed
malwa e de ec ion is he lack o di e se and comp e-
hensi e da ase s (Allix e al. 2015), pa icula ly when
i comes o handling encoded o ob usca ed samples.
Wi hou access o a a ie y o da ase s, including non-
encoded, XOR-encoded, and Shika a Ga Nai-encoded
goodwa e and malwa e, AI models a e unable o ully
lea n he complexi ies o bo h ob usca ed and non-
ob usca ed h ea s. This gap se e ely limi s he abili y o
exis ing solu ions o gene alize ac oss di e en encoding
echniques used by malwa e au ho s o e ade de ec ion.
These challenges unde sco e he u gen need o a
no el, in eg a ed app oach ha can e ec i ely de ec
ob usca ed malwa e while emaining compu a ionally
Page 3 o 23
Cas illoCama goe al. Cybe secu i y (2025) 8:97
e icien . Ou esea ch is d i en by he ision o c ea ing a
p ac ical and deployable amewo k ha add esses hese
limi a ions by le e aging he s eng hs o bo h compu e
ision and ans e lea ning, while inco po a ing special-
ized componen s o handle di e en ypes o malwa e,
whe he ob usca ed o no .
In ligh o his, his pape p oposes DEFENDIFY, a
no el amewo k empowe ed by CV, DL, and TL(Rib-
ani and Ma engoni 2019), o de ec ob usca ed malwa e
samples. DEFENDIFY may be applied o p o ec use ’s
de ices, o pa icula sma ci izens’ de ices unde a
sma ci y scena io. In his sense, TL e e s o he use o
knowledge acqui ed om one ask o imp o e pe o -
mance on a ela ed bu di e en ask wi hou aining
again he whole DL model. Tha is, he models a e p e-
ained on a ious image da ase s, and he knowledge
acqui ed is hen used as baseline o classi y ob usca ed
and non-ob usca ed malwa e, a oiding a po en ially
expensi e aining phase. Wi h his in mind, and in o de
o make use o he knowledge ob ained om he p e-
ained CV a i ac s, he inges ed bina ies mus be ans-
o med in o images compa ible wi h he o iginal ne wo k
a chi ec u e. The eason o his is ha , al hough TL is
a powe ul lea ning ool, i has some es ic ions o use
he same ype o da a o ma wi h which he “ ans e ed”
knowledge was gene a ed.
Speci ically, DEFENDIFY consis s o h ee modules:
Da ase C ea ion, Bina y Ob usca ion, and Model Gene -
a ion. These modules wo k oge he o de ec comple ely
ob usca ed malwa e wi h a high pe o mance in e ms o
accu acy and compu a ional consump ion. The use o CV
echniques and con olu ional neu al ne wo ks (CNN) is
pa icula ly well-sui ed o image classi ica ion asks and
has shown p omising esul s in a ious CV applica ions.
In ou p oposal, he bina y code o ob usca ed malwa e is
con e ed in o image, aiming o p o ide a new pe spec-
i e o malwa e de ec ion, which can o e come he limi-
a ions o adi ional de ec ion me hods and imp o e he
de ec ion o ob usca ed malwa e.
To summa ize, he speci ic con ibu ions o his pape
a e as ollows:
1. A no el and gene ic amewo k powe ed by DL and
TL echnologies ha consis s o h ee modules o
de ec bo h ob usca ed and non-ob usca ed mal-
wa e. To be speci ic, he amewo k inco po a es an
en opy es e o di e en ia e ob usca ed and non-
ob usca ed samples, and wo DL models powe ed by
TL ha classi y goodwa e and malwa e.
2. The cons uc ion o h ee da ase s o non-encoded,
XOR-encoded and Shika a Ga Nai-encoded good-
wa e and malwa e samples. These da ase s we e gen-
e a ed by he amewo k i sel hanks o he Da ase
C ea ion module. In la e s eps, hese da ase s we e
con e ed in o images by he Bina y Ob usca ion
module using a speci ic codec.
3. The alida ion o DEFENDIFY in e ms o e alua-
ion pe o mance and compu a ional consump ion.
DEFENDIFY was con igu ed o es ou CNN a chi-
ec u es: ResNe 18, ResNe 34, E icien Ne B3, and
E icien Ne V2S. In e ms o e alua ion pe o mance,
he bes a chi ec u e was Res Ne 18 ha eached an
F1-sco e o 99.34% and 97.24% o non-ob usca ed
and ob usca ed malwa e de ec ion, espec i ely. In
e ms o compu a ional consump ion, he mos e i-
cien a chi ec u e was Res Ne 18 ollowed by Res -
Ne 34, E icien Ne B3, and inally E icien Ne V2S.
4. A unc ional ull- ledged p o o ype o DEFENDIFY,
o e ed as an IA-enabled sma se ice o he de ec-
ion o ad anced malwa e, which is accessible o he
scien i ic communi y who desi e o es i and ali-
da e i s p ac icali y and easiness- o-use. The p o o-
ype is accessible a : h ps:// huggi ng ace. co/ spaces/
esab/ malwa e_ de ec ion
The emainde o he manusc ip is s uc u ed as ollows.
“Le e aging compu e ision o cybe secu i y” sec ion
con ains a o e iew o how CV may suppo cybe secu-
i y challenges. “S a e o he a ” sec ion compa es he
main wo ks p oposed in his ield, highligh ing i s con-
ibu ions and echniques. Then, “DEFENDIFY ame-
wo k” sec ion desc ibes he de ails o he DEFENDIFY
amewo k. In “Expe imen s”, he expe imen s ha we e
ca ied ou a e shown in de ail. “Discussion” sec ion
in oduce a b ie discussion abou he wo k p esen ed in
his pape . A las , “Conclusions and u u e wo k” sec ion
concludes he wo k, summa izing he esul s and show-
ing he u u e di ec ions o his esea ch.
Le e aging compu e ision o cybe secu i y
Compu e ision (CV) has eme ged as a ans o ma i e
echnology in he ield o cybe secu i y due o i s abili y
o analyze and in e p e complex da a pa e ns. By con-
e ing da a in o isual ep esen a ions, CV echniques
o e inno a i e app oaches o iden i ying and mi iga -
ing cybe h ea s, pa icula ly in scena ios in ol ing mal-
wa e de ec ion and analysis.
One o he key ad an ages o CV is i s applicabili y
o s a ic malwa e analysis. By ans o ming bina y iles
in o g ayscale images, con olu ional neu al ne wo ks
(CNNs) can be employed o de ec pa e ns indica i e o
malicious code. These models excel a ecognizing ea-
u es associa ed wi h ob usca ion echniques o speci ic
malwa e amilies, enabling high-accu acy classi ica ion
e en in challenging cases (Li e al. 2022). Fo exam-
ple, CV-powe ed classi ie s can analyze code s uc u es
Page 4 o 23
Cas illoCama goe al. Cybe secu i y (2025) 8:97
o en opy pa e ns o iden i y hidden malicious bina-
ies, suppo ing s a ic code analysis o logs and ne wo k
ames collec ed om in o ma ion sys ems o ne wo k
de ices.
CV can also be u ilized o dynamic h ea de ec ion.
In ne wo k secu i y, CNNs can analyze a ic pa e ns o
iden i y anomalies, such as unusual po ac i i y o da a
ex il a ion a emp s. These me hods enhance he abili y
o de ec bo h known and ze o-day a acks, con ibu ing
o he p o ec ion o c i ical sys ems(Li e al. 2022).
Addi ionally, CV-based solu ions can suppo phish-
ing de ec ion by analyzing isual and s uc u al ea u es
o email campaigns. CNNs ained on phishing pa e ns
can il e suspicious con en , p o iding a p oac i e laye
o de ense agains social enginee ing a acks. This is
pa icula ly ele an o o ganiza ions exposed o high
olumes o communica ion da a, whe e manual analy-
sis would be in easible. Examples o simila app oaches
include applica ions by Mimecas Cybe G aph and
Co ense Cybe ish(Mimecas 2025; Cybe ish 2025).
Ano he applica ion o CV in cybe secu i y is i s ole
in coun e ing ad e sa ial a acks. A acke s o en a emp
o bypass machine lea ning models by in oducing sub le
pe u ba ions in inpu da a. CV echniques can enhance
model obus ness by employing ad anced a chi ec u es
and da a augmen a ion s a egies, educing he e ec i e-
ness o ad e sa ial mechanisms(Xi 2020).
Finally, CV is ins umen al in moni o ing physical
beha io s ha may indica e malicious in en . Techniques
such as mic o-exp ession analysis, pos u e ecogni ion,
o acial s ess de ec ion can be used o iden i y decep-
i e ac i i ies, which a e c i ical in scena ios like bo de
secu i y o physical access con ol(Rehman e al. 2022).
By in eg a ing CV in o cybe secu i y wo k lows,
esea che s and p ac i ione s can de elop obus de enses
agains e ol ing cybe h ea s. I s abili y o ex ac mean-
ing ul insigh s om complex da a makes i a aluable ool
in ad ancing malwa e de ec ion and enhancing o e -
all cybe secu i y, as will be seen in he pape a hand
h ough he p oposal o DEFENDIFY amewo k.
S a e o hea
In his sec ion, we e iew he a ailable li e a u e in he
ield o malwa e de ec ion. The adi ional app oach o
de ec hem can be classi ied in o signa u e-based, anom-
aly-based and speci ica ion based(Talukde and Taluk-
de 2020). I is wo h men ioning ha wi h he a i al o
ML and DL echniques, his ield has expe ienced a huge
change and many o he p oposed wo ks use he anomaly
de ec ion (AD) pa adigm (Sahin and Bah iya 2020; El
Me abe and Haj aoui 2019). One o he ad an ages o
his app oaches is ha hey can de ec new ypes o mal-
wa e wi hou collec ing i s signa u es.
Due o he widesp ead use o x86 a chi ec u es, mos
wo k on malwa e de ec ion ocuses on his a chi ec-
u e. Thus, he i s ques ion ha needs o be answe ed
is abou he ea u es used o eed ML and DL models o
malwa e de ec ion in such a chi ec u e. These ea u es
need o be su icien ly ep esen a i e o he samples o
disc imina e be ween malwa e and goodwa e. Un il now,
he e we e ou main g oups o ea u es o use in mal-
wa e de ec ion: Opcode sequence, po able execu able
(PE) heade , S ings, and API sequence (Guo and Fan
2019). Besides, he s udy p esen ed in(Xue e al. 2019)
shows a axonomy o ML me hods o Bina y Code Anal-
ysis, including an exhaus i e lis o he ea u es used in
malwa e de ec ion.
In his con ex , many o he ML echniques cu en ly
applied o malwa e de ec ion a e based on hese ea-
u es. Fo example, Rezaei e al. (2021) p opose a no el
me hod ha combines DL and ML echniques o lea n
di e en embedding ep esen a ions o bo h malwa e
and goodwa e. In pa icula , he aw by es o PE heade
a e embedded in o he dense neu al ne wo k (DNN), and
he ou pu is passed o a k-means model. The au ho s
highligh he low compu a ional o e head o i s solu-
ion due o he ligh weigh ne wo k used and he low
ime equi ed o ex ac by es om he PE heade . In he
same con ex , se e al ML-based app oaches ha e been
p oposed o malwa e de ec ion by le e aging ea u es
ex ac ed om PE heade s. Fo ins ance, Hussain e al.
(2022) in oduce a de ec ion sys em ha applies a i-
ous ML models, including Random Fo es , suppo ec-
o machine (SVM), and G adien Boos ing, o classi y
execu ables as clean o malicious based on PE heade
ea u es. The au ho s conduc a compa a i e analysis o
hese models, highligh ing ha Random Fo es achie es
he highes accu acy (99.44%), making i a p omising
candida e o eal-wo ld malwa e de ec ion applica ions.
In e ms o opcode sequence app oaches, se e al wo ks
ha e been p oposed. Fo example, Lee e al. (2023) p o-
posed a me hod ha ex ac s ixed-leng h and low-
dimensional ea u es om opcode ca ego y in o ma ion
o dis inguish be ween benign and malicious applica-
ion bina ies. The ex ac ed ea u es a e e alua ed using
mul iple ML models, including SVM, Decision T ee, and
Random Fo es , achie ing an accu acy o o e 98% o
bo h malwa e de ec ion and classi ica ion. The au ho s
highligh he obus ness o hei app oach, demons a -
ing i s e ec i eness in iden i ying di e en malwa e
amilies. In Kakisim e al. (2022), he au ho s p oposed
Sequen ial Opcode Embedding-based Malwa e De ec-
ion (SOEMD), a me hod ha cap u es common mali-
cious pa e ns using a Random Walk app oach o
edge and node selec ion. By cons uc ing a low-dimen-
sional ec o space wi h opcode embeddings, SOEMD
Page 5 o 23
Cas illoCama goe al. Cybe secu i y (2025) 8:97
enhances de ec ion e iciency. The model es ed in he
a chi ec u e we e K-Nea es Neighbou (k-NN), CNN
and LSTM. Expe imen al esul s show ha he p oposed
me hod ou pe o ms baseline app oaches, achie ing a
100% malwa e de ec ion a e.
In e ms o ea u e compa ison, Bal am e al. (2019)
p esen ed a de ailed s udy whe e di e en ML echniques
a e es ed using PE heade and S ings. To be speci ic, he
ML models es ed we e SVM, Linea Reg ession (LR),
Random Fo es (RF), XGBoos . Besides, based on hese
models, he au ho s also es ed wo ensemble models :
LR/XGBoos and LR/RF/Naï e Bayes. The au ho s con-
cluded ha models ha use s ing-based ea u es ou pe -
o m models ha use PE-based ea u es. The model ha
achie ed he bes pe o mance was he ensemble o LR/
XGBoos wi h an accu acy o 0.980 o s ing-based ea-
u es and 0.915 o PE-based ea u es.
Al hough bo h classical ML models and adi ional
ea u es-based DL me hods achie e good esul s, new
app oaches based on DL echniques a e explo ed in he
li e a u e. In pa icula , con e bina y iles in o images
and using hem as inpu o a CNN is achie ing good
esul s. In his con ex , Shauka e al. (2023) p oposed a
deep lea ning-based me hod ha isualizes PE iles as
colo ed images and ex ac s deep ea u es using a ine-
uned deep lea ning model. These ea u es a e hen clas-
si ied using an SVM, elimina ing he need o ex ensi e
ea u e enginee ing. The p oposed me hod achie es
99.06% accu acy on he Malimg da ase and demons a es
supe io pe o mance o e s a e-o - he-a app oaches,
wi h an a e age accu acy imp o emen o 16.56%. This
new app oaches based on DL models allow he de ec ion
o ob usca ed malwa e. This is clea ly show by Me caldo
e al. (2023) ha p oposed a me hod ha con e s sys em
call aces om legi ima e, malicious, and ob usca ed
And oid applica ions in o images o classi ica ion using
a CNN. Thei expe imen s demons a e he esilience
o deep lea ning models in de ec ing ob usca ed mal-
wa e, highligh ing he e ec i eness o dynamic analysis
combined wi h CNN-based classi ica ion. Addi ionally,
he au ho s employ explainabili y echniques o analyze
model p edic ions, ensu ing in e p e abili y and obus -
ness. Ano he example is exposed by Han e al. (2024),
whe e hey p oposed a deep lea ning-based me hod ha
le e ages dep h-wise CNN wi h a spa ial a en ion mech-
anism o classi y malwa e ob usca ed by i ual machine
(VM) code. Using a da ase gene a ed wi h VMP o ec ,
he p oposed model is ained on eal-wo ld ob us-
ca ed malwa e samples. Expe imen al esul s show ha
he app oach achie es nea ly 100% accu acy on egula
malwa e classi ica ion and 93.55% on ob usca ed mal-
wa e, demons a ing i s e ec i eness in handling com-
plex ob usca ion echniques. Ra i e al. (2022) p opose a
Mul i-View a en ion-based DL amewo k o malwa e
de ec ion, le e aging ea u es om PE heade s, impo s,
images, and API calls. Thei app oach ou pe o ms non-
a en ion-based ML models, achie ing 95% accu acy.
Addi ionally, hey e alua e malwa e de ec ion using g ay-
scale images om bina y iles, ob aining 98% accu acy
on a Windows da ase and 97% on an And oid malwa e
da ase . Finally, Con i e al. (2022) explo e DL models o
de ec ing and classi ying ob usca ion in And oid applica-
ions. They e alua e classical ML me hods alongside NLP
and image ecogni ion echniques on bina ies ob us-
ca ed using ou s a egies: T i ial (T), S ing Enc yp ion
(SE), Re lec ion (R), and Class Enc yp ion (CE). Among
he es ed models (SVM, DNN, and CNN), CNNs using
RGB images achie ed he highes F-sco es, wi h a peak
o 0.994 o CE. A hyb id app oach combining mul iple
models u he imp o ed pe o mance, eaching F-sco es
o 0.972 (T), 0.991 (SE), 0.980 (R), and 0.998 (CE).
Table1 compa es he solu ions discussed in he p e-
ious pa ag aphs oge he wi h he solu ion ha we
p opose. F om his compa ison, i is e iden ha ou
app oach is he only one o e ing a comp ehensi e ame-
wo k o malwa e de ec ion. Speci ically, ou con ibu-
ion in oduces se e al key inno a ions ha dis inguish i
om p io wo k:
• Use o T ans e Lea ning (TL) o ob usca ed mal-
wa e de ec ion: Ou me hod applies TL(Ribani and
Ma engoni 2019) o add ess he challenge o de ec -
ing ully ob usca ed malwa e. This app oach enables
us o ans e lea ned ep esen a ions om p e-
ained models on image da ase s o he speci ic ask
o malwa e de ec ion, he eby educing aining ime
and imp o ing o e all pe o mance.
• In eg a ion o an en opy-based ob usca ion es e :
Ou amewo k is unique in adop ing a s a ic analy-
sis app oach ha classi ies bo h ob usca ed and non-
ob usca ed bina ies wi hou equi ing execu ion
o he bina ies, hus mi iga ing he isks associa ed
wi h dynamic analysis. P io o eeding he samples
in o he CNN model, we pe o m an en opy es o
dis inguish be ween ob usca ed and non-ob usca ed
samples. This s ep is no el, as no p e ious wo k in e-
g a es an ob usca ion de ec ion module as pa o he
classi ica ion pipeline.
• De ec ion o ully ob usca ed malwa e using eal-
wo ld ob usca o s: While he wo ks p oposed
byCon i e al. (2022) and Han e al. (2024) bea s
some esemblance o ou me hod, he e a e wo
majo dis inc ions: i) hei solu ion does no p esen
a comple e amewo k, and ii) hey do no le e age
TL echniques. Addi ionally, unlike p e ious wo ks,
includingCon i e al. (2022), ou app oach is he i s
Page 6 o 23
Cas illoCama goe al. Cybe secu i y (2025) 8:97
o alida e he de ec ion o ully ob usca ed malwa e
using ob usca o s ha a e widely employed by eal-
wo ld a acke s. Speci ically, ou solu ion demon-
s a es obus ness agains Shika a Ga Nai, an ob us-
ca ion ool equen ly used in ac ual a ack scena ios,
which has no been add essed in p io s udies.
• Some ela ed wo ks use TL in malwa e de ec ion
labo s bu o di e en p oposals. Jian e al. Jiang
e al. (2020) p oposed a TL-based solu ion ha
aims o de ec a ia ions be ween he ep esen a-
ion o an o iginal ob usca ed malwa e and some
o i s a ia ions, conside ing ha bo h he o iginal
and he ob usca ed malwa e ha e an image ep e-
sen a ion. Ma as oni e al.Ma as oni e al. (2021)
p oposed a solu ion ha in en ionally applies code
ans o ma ions o malwa e o build an augmen ed
malwa e da ase , which is hen used o cons uc
a TL-based model o di e en ia e be ween ob us-
ca ed and no-ob usca ed malwa e samples. Thus,
hese las ela ed wo ks a e ocused on classi ying
ep esen a ions o malwa e, ins ead o a ull- ledged
solu ion ha no only de ec s ob usca ion bu
also de ec s i he sample is o is no malicious as
DEFENDIFY does.
In summa y, ou p oposal is he i s o o e a ully
in eg a ed amewo k o malwa e de ec ion ha com-
bines TL, a s a ic analysis app oach, and an en opy-
based ob usca ion es e , ensu ing obus pe o mance
e en agains ully ob usca ed malwa e, as alida ed
using eal-wo ld ob usca ion ools.
Table 1 Compa ison o di e en ela ed wo ks ha p opose malwa e de ec ion using ML/DL
Wo k Can de ec
comple ely
ob usca e malwa e
by means o s a ic
analysis?
Da ase ea u es ML/DL model Yea
Bal am e al. (2019)✕S ings
PE heade SVM
LR
RF
XGBoos
Ensemble (LR/XGboos )
Ensemble (LR/RF/NB)
2019
Rezaei e al. (2021)✕Raw by es o PE heade DNN
K‑Means 2021
Ra i e al. (2022)✕PE heade
PE impo s
API calls
By es o PE heade as images
a en ion‑based CNN, DNN, and LSTM 2022
Con i e al. (2022)✓Bina ies as g ay‑scale/RGB images
Fea u es ex ac ed om he s ings
Na u al language‑based ea u es
SVM
DNN
CNN
2022
Hussain e al. (2022)✕PE Heade RF
SVM
G adien Boos ing
2022
Kakisim e al. (2022)✕OP code RF
K‑NN
CNN
LSTM
2022
Lee e al. (2023)✕OP code RF
Decision T ee
SVM
2023
Shauka e al. (2023)✕Bina ies as RGB images CNN as ea u e ex ac o
and SVM 2023
Me caldo e al. (2023)✕sys em calls aces encoded as images CNN 2023
Shauka e al. (2023)✕ Bina ies as RGB images CNN as ea u e ex ac o
and SVM 2023
Han e al. (2024)✓Bina ies as RGB images CNN wi h a en ion
mechanism 2024
DEFENDIFY ✓Bina ies as g ey‑scale images CV a chi ec u es powe ed by TL 2025
Page 7 o 23
Cas illoCama goe al. Cybe secu i y (2025) 8:97
DEFENDIFY amewo k
In his sec ion, he componen s and modules ha com-
p ise he DEFENDIFY amewo k a e de ailed. As p e-
iously men ioned, he p oposed amewo k u ilizes
DL and TL echnologies o de ec ob usca ed malwa e.
DEFENDIFY consis s o h ee modules: Da ase C ea ion
(“Da ase c ea ion” sec ion), Bina y Ob usca ion (“Bina y
ob usca iony” sec ion), and Model Gene a ion (“Model
gene a ion” sec ion). Each o hese modules is u he
di ided in o a ious componen s ha wo k in coo di-
na ion o e icien ly de ec ob usca ed malwa e. A high-
le el desc ip ion o hese modules and componen s can
be obse ed in Fig.1.
Da ase c ea ion
In o de o pe o m i s de ec ion ac i i ies, DEFENDIFY
needs o ecollec and s o e a la ge numbe o samples
as inpu . To achie e his, he Da ase C ea ion module
comp ises a Malwa e Selec ion and a Goodwa e Selec-
ion componen . The i s is esponsible o ga he ing
malwa e bina ies, while he second is in cha ge o col-
lec ing goodwa e bina ies, as de ailed nex . Al hough
he cu en sec ion desc ibes he gene ic p ocedu e o
he da ase composi ion, a desc ip ion he da ase s used
in ou expe imen s which impac di ec ly he ob ained
pe o mance me ics is de ailed in “Da ase s used in he
expe imen s” sec ion.
Malwa e selec ion
The Malwa e Selec ion componen is in cha ge o one o
he mos impo an ac ions in DEFENDIFY, as i collec ,
il e and selec he inal se o malicious bina ies ha will
be used in he nex aining s eps. E en i he e a e so
many eposi o ies whe e malwa e may be collec ed, i is
impo an o conside key ea u es as he olume o sam-
ples, di e si y in he ypes o malwa e, us in he sou ce,
in eg i y o he samples, among o he s.Thus, he e is di -
e en malwa e eposi o ies (e.g., Malwa e The Zoo,1
x aul ,2 xunde g ound3 o Vi usSha e4) which may be
a good sou ces o be consumed by he Malwa e Selec ion
componen . F om he p e iously men ioned eposi o-
ies, Vi usSha e is pa icula ly in e es ing as i is an open
eposi o y o malwa e samples ha is in ended o p o ide
secu i y esea che s wi h samples o eal malicious code.
This eposi o y was c ea ed o p o ide access o samples
o li e malicious code wi h he aim o helping esea ch-
e s, o ensic analys s, and simila p o essionals, howe e ,
o p e en he sp ead o he samples dis ibu ed in his
eposi o y, he access o hose samples is deli e ed unde
indi idual eques . As we will see in “Da ase s used in he
expe imen s” sec ion, a da ase o 15821 malwa e sam-
ples was employed in ou expe imen s.
Goodwa e selec ion
The Goodwa e Selec ion componen p o ides DEFEN-
DIFY he capaci y o collec , il e and selec he inal se
o non-suspicious bina ies which will be used in he nex
aining s eps. The e is a big di e si y o goodwa e a ail-
able online, downloadable h ough he o iginal so wa e
publishe o hi d pa ies, add essed o di e en pu -
poses, and ypes o public. Rega ding he pu pose, he e
a e many e.g. lib a ies and handles used by ope a ing
Fig. 1 High‑le el iew o DEFENDIFY, he p oposed malwa e de ec ion amewo k
1 h ps:// gi hub. com/ y is / heZoo.
2 h p:// x au l . ne / Vi iL is . php.
3 h ps:// x- unde g ound. o g/.
4 h ps:// i us sha e. com.
Page 8 o 23
Cas illoCama goe al. Cybe secu i y (2025) 8:97
sys ems, end use u ili ies, se e so wa e, middlewa e,
e c. Thus, acquisi ion o goodwa e samples may be
achie ed h ough om he mos nai e app oach based on
a manual download o so wa e ypically used by use s,
un il mo e au oma ed ways ha collec la ge amoun s o
goodwa e using applica ion s o es such as he one a ail-
able a Mic oso S o e.5
One in e es ing way o composing a p ope goodwa e
da ase , usable in DEFENDIFY, is including bina ies ha
a e ound ypically in an ope a ing sys em, i.e. sys em
iles o Windows 10/11, and also including bina ies asso-
cia ed o end use u ili ies, i.e. o ice applica ions. As we
will see in “Da ase s used in he expe imen s” sec ion, a
da ase o 15628 goodwa e samples was employed in ou
expe imen s.
Bina y ob usca ion
Once he malwa e and goodwa e samples ha e been ec-
ollec ed, he subsequen s ep en ails he ob usca ion o
he samples. To his ex en , he Bina y Ob usca ion mod-
ule is esponsible o ob usca ing he samples ga he ed by
he Da ase C ea ion module. In pa icula , his module
comp ises he Encode s Selec ion, Ob usca o , and Da a
P ocessing componen s.
Encode s selec ion
This componen is in cha ge o selec ing he encode s
used o ob usca e bo h malwa e and goodwa e samples.
In his ega d, no e ha ob usca ion may be achie ed
wi h di e en ypes o encode s, mainly me amo phic
and polymo phic ones. Among he me amo phic ones,
he block-based XOR encode (Ceschin e al. 2021) is
one o he mos popula o i s simplici y, because i
euses he idea o a ma hema ical XOR ope a ion o
pe o m ansposi ion encoding, de ea ing in ha way,
he egula an i-malwa e mechanism based on signa-
u es. This encode uses he p ope y o an XOR ope a-
ion, i.e.,
A⊕B⊕B=A
, and p ocesses he bina y pe
block. Thus, he s eps o implemen block-based XOR a e
esumed nex :
1. De ine a key
kj
o be used in he cu en block encod-
ing.
2. Read and iden i y each cha ac e
ci
o he so wa e
shell code.
3. XOR each
ci
using
kj
.
One o he goals o an encode is o ob usca e he key
shellcode ope a ions exis ing in a bina y. Howe e ,
as XOR encoding is me amo phic, i causes known
suspicious shellcode ins uc ions, such as he co e-
sponding o exec/bin/bash o / cp/ ip po , become
encoded o well-known ou pu s. F om an o ensi e pe -
spec i e, a well-known ou pu ep esen s a bad signa-
u e because i can be easily iden i ied by an i-malwa e
solu ions.
Me amo phic encode s e ol ed o polymo phic ones,
meaning ha wo equal iles ecei ed as inpu by he
encode will no p oduce he same ou pu ile, being Shi-
ka a Ga Nai one o he mos ep esen a i e and used pol-
ymo phic encode s(Fa ley and Wang 2014). Shika a Ga
Nai is a polymo phic XOR addi i e eedback encode ha
uses me amo phic echniques, e.g., eo de ing and sub-
s i u ion, in conjunc ion wi h a chained sel -modi ying
key o p oduce a di e en ou pu each ime i is applied,
bypassing de ec ion mechanisms based on signa u e ec-
ogni ion(G aham 2021). Gi en ha Shika a Ga Nai uses
a chained sel -modi ying key h ough addi i e eedback,
in case he inpu o be decoded o he keys a e inco ec
a any i e a ion, all subsequen ou pu s will be inco ec .
The s eps o implemen Shika a Ga Nai a e esumed as
ollows:
1. De ine a key
kj
2. Ge he alue o he Ex ended Ins uc ion Poin e EIP
egis e using Floa ing-Poin Uni (FPU) ins uc ions.
3. En e in a loop ha uns o e a new ins uc ion
EIP+
0xF.
(a) Replace ins uc ion a
EIP+
0xF applying an
XOR ope a ion be ween
EIP+
0xF and
kj
.
(b) Change he key
kj
by adding i wi h he esul o
he p e iously modi ied ins uc ion a EIP0xF.
Al hough DEFENDIFY is gene ic enough o selec any
encode in he li e a u e, his wo k is ocused on XOR
and Shika a Ga Nai encode s. The eason o his deci-
sion was o co e bo h me amo phic and polymo phic
encode s, and because hey a e encode s employed com-
monlyBu i a and Le (2021).
Ob usca o
Once goodwa e and malwa e samples a e collec ed by he
Da ase C ea ion module, hese samples mus be ob us-
ca ed o he encode s selec ed o DEFENDIFY: XOR
and Shika a Ga Nai. The e a e di e en ools o execu e
so wa e ob usca ion, being he Me asploi F amewo k
(MF)6 one o he mos ecognized ones. MF is an open-
sou ce pene a ion es ing amewo k used by se e al
cybe secu i y expe s, including whi e-ha and black-ha
5 h ps:// apps. mic o so . com/ s o e/ apps/ windo ws.6 www. me as ploi . com/.
Page 9 o 23
Cas illoCama goe al. Cybe secu i y (2025) 8:97
hacke s, ha allows execu ing secu i y es sand de elop-
ing and es ing payloads and exploi codes. MF con ains
mul iple encode s, Shika a Ga Nai and XOR encode s
being he mos ep esen a i es. Also, MF p o ides di -
e en ools such as ms enom, an open-sou ce payload
gene a o ha combines o he ools like ms payload
and ms encode o c ea e an ob usca ed bina y.
Da a p ocessing
DEFENDIFY elies on compu e ision DL
algo i hms; hus, he p ima y p ocessing ha da a equi e
is hei ans o ma ion in o images, which can be con-
sumed by con olu ional models employing TL. This
componen can be implemen ed h ough di e en p o-
g amming languages, ollowing a p ocedu e simila o
he nex one: (1) he sample is loaded and ead by e by
by e, s o ing each by e-associa ed nume ical alue in a
lis ; (2) a de aul image size is calcula ed (wid h, heigh )
depending on he lis leng h, i.e., he ile size; (3) a g ay-
scale image is c ea ed by copying he by es one by one
in o an emp y image, wi h e e y by e co esponding
o one image pixel. Fo example, suppose ha we ha e
a 4-by e bina y ile, and a e eading i s by es, he ol-
lowing alues a e ob ained: [0,64,128,255]. I we wan
o a ange hese alues in o a
2×2
size image, we will
ob ain an in ege ma ix as he one shown in Eq.(1),
which ep esen s an image ha is sa ed and used la e o
eed he models.
The size o he image associa ed wi h each sample is
de e mined using a cus om unc ion ha uses he num-
be o by es in he sample as a pa ame e , as shown in
Table2. Based on he ecei ed lis o by es, he unc ion
de ines a co esponding image wid h, and i s heigh is
calcula ed by di iding he ile size by he image wid h as
p oposed inBensaoud e al. (2020).
(1)
Img
=
0 64
128 255
A Py hon lib a y ha can gene a e an image om a
Py hon lis o by es is Pillow.7 Using his lib a y, a bina y
image was c ea ed o each o he iles included in he
aining da ase , as explained in “Da ase c ea ion” sec-
ion, ob aining h ee new aining da ase s: i) an image
da ase ob ained om samples ob usca ed wi h Shi-
ka a Ga Nai, ii) an image da ase ob ained om samples
ob usca ed wi h XOR, and iii) an image da ase ob ained
om samples no ob usca ed. When DEFENDIFY ge s
deployed, his p ocedu e would be applied o any sample
ha needs o be classi ied a e passing he en opy es e
desc ibed in “En opy es e ” sec ion.
Fo example, he g ay-scale image in Fig.2 was gene -
a ed using he p ocedu e p e iously desc ibed o e a
andomly selec ed encoded bina y ile and is an exam-
ple o he possible ou pu s ha can be ob ained wi h he
algo i hm.
Model gene a ion
This module is esponsible o aining and alida ing a
model o de ec non-ob usca ed and ob usca ed malwa e.
We p opose di e en componen s o p ocess and classi y
new so wa e samples. These componen s a e as ollows
and desc ibed nex : En opy Tes e , De ec ion Model
Selec ion and T aining, and Model Valida ion.
Table 2 Image wid h acco ding o he sample size
Bina y ile size (KiB) Image
wid h
(px)
Less han 10 32
10–30 64
30–60 128
60–100 256
100–200 384
200–500 512
500–1000 768
Mo e han 1000 1024
Fig. 2 Example o g ay‑scale image ob ained om an encoded
sample
7 h ps:// py hon- pillow. o g/.
Page 16 o 23
Cas illoCama goe al. Cybe secu i y (2025) 8:97
(
31, 449
∗
2
∗
20%
=
12, 579
). The models we e unable
o p ocess 54 o he 12,579 samples o iginally included
in he es ing da ase , esul ing in a o al numbe o
classi ied samples o 12,525.
In addi ion, classi ica ion esul s ob ained o each
model a e summa ized in Table10, which indica es he
ela ion in e ms o pe cen age o each p edic ed class,
di iding he numbe o samples o each “ac ual class” by
he numbe o samples o each “p edic ed class”, pe each
es ed model.
The esul s o each me ic de ined in “Model alida-
ion” sec ion, calcula ed o each o he models consid-
e ed a e p esen ed in Table11.
As seen in he es ing esul s, all he models p esen
no iceable good esul s. Howe e , ResNe 18 s ands ou
Fig. 7 Con usion ma ices o XOR and Shika a Ga Nai samples
Table 10 Resul s ob ained in he classi ica ion o XOR and
Shika a Ga Nai samples
P edic ed class
Ac ual class. Goodwa e Malwa e
Goodwa e ResNe 18 95.36% ResNe 18 4.64%
ResNe 34 95.34% ResNe 34 4.66%
E icien Ne B3 95.44% E icien Ne B3 4.56%
E icien Ne V2S 94.93% E icien Ne V2S 5.07%
Malwa e ResNe 18 0.57% ResNe 18 99.43%
ResNe 34 0.60% ResNe 34 99.40%
E icien Ne B3 0.66% E icien Ne B3 99.34%
E icien Ne V2S 0.57% E icien Ne V2S 99.43%
Table 11 Me ics ob ained in he classi ica ion o XOR and
Shika a Ga Nai samples
Bold alues a e he highes alues ob ained pe each me ic
Model Me ic
Accu acy (%) P ecision (%) Recall (%) F1 sco e (%)
ResNe 18 97.42 95.65 99.43 97.5
ResNe 34 97.39 95.6 99.4 97.46
E ien Ne B3 97.41 95.72 99.34 97.49
E icien ‑
Ne V2S 97.21 95.25 99.43 97.3
Page 17 o 23
Cas illoCama goe al. Cybe secu i y (2025) 8:97
because i is he smalles ne wo k in e ms o compo-
nen s, compa ed o o he models conside ed, while main-
aining a 97.42% o accu acy. Fo such a eason, ResNe 18
could be conside ed as he bes op ion o build a classi ie
ha can di e en ia e malwa e om goodwa e wi h XOR
and Shika a Ga Nai ob usca ed bina ies.
Compu a ional cos s
An analysis o compu a ional cos s o ou p oposed
solu ion was done o each o he ou CNN a chi ec u es
p esen ed be o e. The expe imen s consis o classi ying
a ba ch o images wi h a size a ying be ween 1 sam-
ples and
104
Kb samples, while measu ing he ime and
memo y used o ul ill he ask. To educe andomness in
he esul s, each ba ch size was es ed wi h e e y model
20 imes. In Figs.8 and 9, he measu emen s o ime and
RAM a e p esen ed, wi h he mean o all 20 epe i ions
highligh ed as he da ke lines, and he 95% con idence
in e al o hese epe i ions is d awn as he lines’ ligh
con ou s.
Figu e8 shows he in e ence ime as a linea unc ion
wi h he numbe o p ocessed samples as he independ-
en a iable, and he slope depends on he CNN a chi ec-
u e used. In pa icula , we can obse e ha he smalles
line slope is associa ed wi h ResNe 18, which means ha
his model is he as es . Besides, he linea beha io indi-
ca es s abili y, because eeding mo e samples o he p o-
g am will no make i un inde ini ely o many seconds.
Figu e9 shows memo y consump ion as a loga i hmic-
like unc ion, al hough when he numbe o samples is
la ge enough (mo e han 1000 app oxima ely) i can be
conside ed cons an in p ac ice, wi h a alue depending
on he CNN a chi ec u e. Fo example, ResNe 18 has he
lowes RAM usage wi h a alue o app oxima ely 0.47
GiB. As he g ow h o memo y consump ion is oo slow
o be ele an , he p oposed solu ion is also s able in ela-
ion o RAM usage.
Finally, i is wo h no ing ha he 95% con idence in e -
al is oo small e en o be clea ly seen in he g aphics.
This means ha he expe imen esul s a e us wo hy
and can be easily ep oducible in a simila compu a ional
en i onmen .
P o o yping DEFENDIFY
Mode n and isiona y socie ies need o be buil o e
s ong ounda ions, and in his ega d, NSAI (Ne wo k
Sys em o A i icial In elligence) is one o he mos p om-
inen keys ones(Song e al. 2022). NSAI is a pa adigm
whe e AI is imme si e in all componen s o a ne wo k
sys em, including edge de ices, communica ion nodes
and on-p emise o cloud-based se e s. NSAI a chi-
ec u e is composed o 4 ie s: physical ne wo k (PN),
se ice-cus omized ne wo k (SCN), gene alized sma
se ice (GSS), and applica ion (APP).
In pa icula , GSS is one o he mos c i ical ie s, as i
may be seen as an in e media e ie ha acili a es appli-
ca ions o ope a e wi hou being awa e o he complex-
i y o communica ion and compu ing below. To achie e
he p e ious goal, GSS p o ides applica ion p og am-
ming in e aces (API) o be consumed by applica ions in
he uppe ie . GSS also has he au onomy o econ igu e
uppe and lowe componen s, i.e. APP and SCN se ings,
o gua an ee eliable se ices in a sma ci y.
DEFENDIDY may be in eg a ed in o GSS as a cybe se-
cu i y se ice as i p o ides an AI-enabled sma se ice
capable o de ec ing ob usca ed malwa e, independ-
en o i s loca ion in a dis ibu ed ne wo k. This se -
ice may wo k by au oma ing he de ec ion o malwa e
lowing o use de ices, o i may also be consumed on
demand h ough a sma se ice API ha allows use s
o upload iles o i and igge a classi ica ion p ocess as
Fig. 8 Time consume, in seconds, egis e ed by each CNN model
Fig. 9 RAM consume, in GiB, egis e ed by each CNN model
Page 18 o 23
Cas illoCama goe al. Cybe secu i y (2025) 8:97
desc ibed in “DEFENDIFY amewo k” sec ion. DEFEN-
DIFY would in o m use s abou he analysis esul s and
he p obabili ies ha he p o ided sample is goodwa e o
malwa e. Also, i migh be app op ia e o ha e he s o -
age a ailable o sa e new malwa e samples uploaded by
use s, allowing he da abase o g ow o e ime, imp o -
ing he de ec ion models.
Fo he sake o con ibu ing a unc ional p o o ype ha
shows in an in e ac i e way he unc ioning o ou p o-
posal, he deploymen o DEFENDIFY was es ed wi h
a minimalis p i a e web applica ion made using he
Py hon dash11 lib a y. This web applica ion consis s o an
on-demand simple in e ace whe e he use can upload
an execu able ile, ha is hen p ocessed as indica ed in
he da a low depic ed in Fig.1. Figu e10 shows a sc een-
sho o he web applica ion12 ha uns he p oposal
desc ibed in his pape .
Fu he mo e, DEFENDIFY’s ligh weigh a chi ec u e
and e icien models, such as ResNe 18, make i well-
sui ed o po en ial deploymen on esou ce-cons ained
edge de ices commonly ound in sma ci y en i on-
men s. Fo example, he amewo k could be adap ed
o un on pla o ms like Raspbe y Pi 5 o NVIDIA Je -
son O in, which a e popula choices o IoT and edge
AI applica ions. Deploying DEFENDIFY on hese edge
de ices would allow eal- ime malwa e de ec ion close
o he da a sou ce, educing la ency, and enhancing he
o e all secu i y pos u e o sma ci y ne wo ks.
Discussion
This wo k p esen s DEFENDIFY, a no el amewo k o
de ec ing ob usca ed malwa e using compu e ision and
deep lea ning echniques. The esul s demons a e ha
DEFENDIFY is able o de ec bo h ob usca ed and non-
ob usca ed malwa e samples accu a ely.
Compa ed o p io wo ks, DEFENDIFY is he i s
amewo k o inco po a e an en opy es e o di e en-
ia e be ween ob usca ed and non-ob usca ed bina ies.
This allows he amewo k o selec i ely use one o wo
deep lea ning models depending on whe he ob usca-
ion is de ec ed. O he wo ks such asCon i e al. (2022)
a emp o de ec ob usca ion in And oid applica ions
using deep lea ning, bu do no p o ide a comple e
amewo k solu ion.
The DL a chi ec u es explo ed in DEFENDIFY le e age
ans e lea ning o a oid expensi e aining p ocedu es
and enable high accu acy e en wi h limi ed aining da a.
The ResNe 18 a chi ec u e achie ed he bes esul s,
de ec ing non-ob usca ed and ob usca ed malwa e wi h
F1 sco es o 99.34% and 97.5%, espec i ely. This com-
pa es a o ably wi h ela ed wo k such as Ra i e al.
(2022) and Con i e al. (2022), epo ing malwa e de ec-
ion accu acy be ween 95–98%
A key ad an age o DEFENDIFY is he abili y o
de ec malwa e ob usca ed wi h eal-wo ld encode s
such as XOR and Shika a Ga Nai ha a e commonly
used by a acke s(Bu i a and Le 2021; Web oo 2020).
Fig. 10 Web in e ace wi h he deploymen o DEFENDIFY
11 h ps:// pypi. o g/ p oje c / dash/.
12 h ps:// huggi ng ace. co/ spaces/ esab/ malwa e_ de ec ion.
Page 19 o 23
Cas illoCama goe al. Cybe secu i y (2025) 8:97
Mos p io wo k does no e alua e on such ealis ically
ob usca ed da a. Tes ing on hese encode s makes he
amewo k mo e obus o new ob usca ion echniques
employed by malwa e c ea o s.
T ans e Lea ning (TL) o e s signi ican ad an-
ages o e aining deep lea ning models om sc a ch
o ob usca ed malwa e de ec ion. Recen esea ch
using non-TL app oaches, such as dep h-wise CNN
wi h a en ion mechanisms (Han e al. 2024) and
dynamic analysis CNN (Me caldo e al. 2023), ha e
demons a ed he iabili y o adi ional deep lea ning
me hods. Howe e , ou TL-based app oach achie es
supe io esul s in e ms o :
• Reduced malwa e da ase : DEFENDIFY employs
a ela i e small da ase o 31,449 images (goodwa e
and malwa e), due o i is inhe i ing he da a ea u es
o he ImageNe -1K da ase , which is composed o
mo e han 1.2 millions o images. To ain a CNN
wi hou TL equi es millions o samples o achie e
compa able esul s in e ms o accu acy as he ones
ob ained by DEFENDIFY (99.34% o non-ob us-
ca ed samples and 97.42% o ob usca ed samples).
• Reduced aining imes: Using T ans e Lea n-
ing may equi e a di e en aining ime depending
on he numbe o epochs and he capabili ies o he
compu a ional in as uc u e. In he case o DEFEN-
DIFY, hanks o TL i was possible o ain a CNN in
less han 5min wi h 4 epochs using a N idia Sa u n
Cloud T4-4XLa ge ins ance wi h 64 GB RAM, 16
CPU, 1 GPU and 1 TiB disk space. This ime me ic
could no be achie ed i TL is no used, as he ain-
ing could las weeks.
• Less compu a ional esou ces: T aining a CNN wi h
TL equi es ins ances wi h signi ican ly less compu-
a ional ea u es han aining wi hou TL, e.g. mid-
ange GPUs s mul i-GPUs, Quad-co e p ocesso s
(In el i5/i7, Ryzen 5/7) s High-pe o mance CPUs
(In el i9, Ryzen 9, Th ead ippe ), 16 Gb s 32 Gb o
RAM, 512 Gb s 1-2 Tb o s o age.
The e ec i eness o TL can be a ibu ed o le e ag-
ing p e- ained weigh s om la ge-scale image da ase s,
which p o ide obus ea u e ex ac ion capabili ies. This
ans e o knowledge is pa icula ly aluable in malwa e
de ec ion, whe e acqui ing la ge-scale labeled da ase s is
challenging. Ou esul s demons a e ha TL can e ec-
i ely b idge hese p ac ical limi a ions while main ain-
ing o imp o ing de ec ion pe o mance compa ed o
adi ional app oaches, o e ing a compelling balance o
pe o mance, e iciency, and p ac icali y o ob usca ed
malwa e de ec ion.
The compu a ional analysis demons a es ha DEFEN-
DIFY can scale e icien ly hanks o he ligh weigh
ResNe 18 model. The h oughpu exceeds 500 samples
pe second wi h unde 500MB memo y consump ion
on a GPU ins ance. This e iciency enables deploymen
o p oduc ion en i onmen s o p ac ical malwa e
de ec ion.
A las we may also conside he applica ion o DEFEN-
DIFY in he con ex o a sma ci y, whe e a malwa e
campaign is add essed o some c i ical sma ci y se ice,
like a a ic managemen se ice, impac ing he dynam-
ics o a sma ci y, due i would dec ease he p oduc i i y
o business ha depends on anspo like logis ics and
ca go anspo and would inc ease he pollu ion, jus
o men ion some e ec s. Conside ing a mo e indi idual
sphe e, we could also e alua e he impac ha would be
gene a ed by a malwa e campaign add essed o impac
a mobile anspo applica ion used by sma ci izens
o consul he schedule o buses o ains o e iew bes
ou es o each a des ina ion. As gene ally, he end use
de ice is he one mo e ulne able be ween he compo-
nen s o a sys em, p obably he malwa e campaign would
y o exploi a ulne abili y associa ed wi h such de ice
o a ec di ec ly he anspo applica ion, e.g. h ough
an abuse o he de ice adminis a ion API (T1616)(Mi e
2025a), o o a ec se ices consumed by he anspo
applica ion, e.g. al e ing he domain dynamic esolu ion
(T1637)(Mi e 2025b). In his case, DEFENDIFY may
de ain he implan a ion o he malwa e o some o hei
componen s h ough a h ea analysis pe o med di ec ly
in he use de ice o in a cen alized se ice.
Limi a ions
Ou esul s show he e ec i eness o using CNN and TL
o malwa e de ec ion, howe e , hese also b ing some
limi a ions in ou p oposal. Fi s , a limi a ion coming
om he use o CNN a chi ec u es is ha i s hie a chi-
cal ea u e ex ac ion may no pe ec ly align wi h he
ob usca ed malwa e’s s uc u al pa e ns. Second, TL
uses p e- ained weigh s om na u al image da ase s
like ImageNe , which may no be op imal o cap u e he
unique cha ac e is ics o bina y-de i ed images. These
wo limi a ions may impac ou p oposal abili y o de ec
ce ain ob usca ion pa e ns.
These limi a ions a e add essed by he p ope ies o
each one o he CNN a chi ec u es es ed in he DEFEN-
DIFY design: ResNe and E icien Ne . On he one hand,
ResNe a chi ec u e uses esidual connec ions o mainly
add ess he anishing g adien p oblem; howe e , such
connec ions also p ese e he ine-g ained pa e ns
exis ing in bina ies, such as he ones ha DEFENDIFY
analyzes. On he o he hand, E icien Ne uses Com-
pound Scaling mainly o scale a ne wo k a chi ec u e in
Page 20 o 23
Cas illoCama goe al. Cybe secu i y (2025) 8:97
a balanced way in e ms o dep h, wid h, and esolu ion.
In ha way, Compound Scaling allows a balance be ween
accu acy and compu a ional cos , bu i also con ibu es
in he abili y o he CNN o ex ac ea u es a di e en
spacial esolu ions, i.e. mul i-scale ea u e ex ac ion,
which is c ucial o ecognize unique malwa e cha ac-
e is ics and pa e ns independen o he imagebina y
size. Despi e hese inhe en limi a ions, ou expe imen s
depic a obus pe o mance ac oss ob usca ed and non-
ob usca ed samples, ResNe ob ains he highes Accu-
acy (99.34% o Non ob usca ed samples and 97.42%
o Ob usca ed samples), and E icien Ne ob ains he
highes P ecision (99.53% o Non ob usca ed samples
and 95.72% o Ob usca ed samples). Bo h a chi ec u es
success ully lea n hie a chical bina y pa e n ep esen a-
ions while main aining e iciency h ough esidual con-
nec ions (ResNe ) and compound scaling (E icien Ne ).
Ano he limi a ion is he amewo k’s pe o mance
agains ze o-day malwa e a acks, which by de ini ion
use no el echniques no seen in he aining da a. Thus,
he cu en implemen a ion may s uggle o de ec com-
ple ely new ob usca ion me hods o malwa e amilies.
Addi ionally, he amewo k’s adap abili y o di e en
compu ing en i onmen s, such as esou ce-cons ained
IoT de ices o high-pe o mance se e s, equi es u -
he in es iga ion. To add ess hese limi a ions, as u u e
wo k we plan o explo e con inual lea ning app oaches
o adap he models o new h ea s o e ime. Tech-
niques like ew-sho lea ning could also be in es iga ed
o imp o e de ec ion o no el malwa e amilies wi h lim-
i ed samples. Rega ding adap abili y, de eloping ligh -
weigh e sions o he amewo k op imized o di e en
ha dwa e a ge s would enhance i s p ac ical applicabili y
ac oss di e se compu ing en i onmen s.
In summa y, DEFENDIFY pushes he s a e-o - he-
a in ob usca ed malwa e de ec ion h ough a obus
amewo k combining an en opy es e , deep ans e
lea ning models, and e alua ion on ealis ically encoded
malwa e da a. Key ad an ages include high de ec ion
accu acy, lexibili y o di e en ob usca ion echniques,
and e icien compu a ion o p ac ical pu poses. While
challenges emain, pa icula ly o ze o-day a acks and
di e se compu ing en i onmen s, DEFENDIFY p o ides
a s ong ounda ion o u u e esea ch in adap i e and
obus malwa e de ec ion sys ems.
Conclusions and u u e wo k
Malwa e con inues o pose a c i ical h ea o he
secu i y o compu e s, mobile phones and IoT
de ices(Díaz-López e al. 2018). These malicious p o-
g ams can spy on use s, s eal sensi i e da a and e en
enc yp iles on in ec ed de ices(SánchezVenegas e al.
2019). Mo eo e , in esponse o ad anced p o ec i e
measu es, malwa e inc easingly employs ob usca ion
echniques ha hinde de ec ion, making i challeng-
ing o dis inguish malicious so wa e om benign p o-
g ams. In his con ex , adi ional Machine Lea ning
(ML) and Deep Lea ning (DL) echniques ha e p o en
ine ec i e and he esea ch communi y mus shi
ocus owa ds new me hods capable o de ec ing ob us-
ca ed malwa e.
In his pape , we in oduced DEFENDIFY, a amewo k
ha demons a es he po en ial o using compu e ision
and deep lea ning echniques o ob usca ed malwa e
de ec ion. By con e ing malwa e bina ies in o images
and applying ans e lea ning, DEFENDIFY achie es
high accu acy in de ec ing ob usca ed malwa e samples.
This indica es ha isual malwa e analysis combined
wi h deep lea ning cons i u es a p omising app oach
o o e coming he limi a ions o con en ional malwa e
de ec ion me hods in handling ob usca ed malwa e.
DEFENDIFY consis s o h ee main componen s,
namely: Da ase C ea ion, Bina y Ob usca ion, and
Model Gene a ion. Speci ically, he Da ase C ea ion
module collec s bo h malwa e and goodwa e samples.
The he Bina y Ob usca ion module hen selec s spec ic
encoding mehods o ob usca e he malwa e. A e he
encode s a e chosen, he module ob usca es he sam-
ples, ans o ms hem in o g eyscale images and c ea es
h ee aining se s. The i s one con ains Shika a Ga Nai
ob usca ed malwa e and goodwa e, he second con ains
XOR ob usca ed samples, and he hi d includes non-
ob usca ed samples. Finally, he Model Gene a ion mod-
ule inco po a es an en opy es e o de e mine whe he
samples a e ob usca ed. Le e aging his amewo k, wo
DL models powe ed wi h ans e lea ning and p e iously
ained, a e employed. The i s model de ec s malwa e
om non-ob usca ed samples, while he second model is
used o ob usca ed samples. To e ec i ely apply he TL
s a egy, DEFENDIFY u ilizes p e- ained weigh s o he
ea u e ex ac o s laye s and ains only he las classi ica-
ion laye s. Finally, pe o mance is e alua ed in DEFEN-
DIFY using Accu acy, P ecision, Recall, and F1-sco e
me ics.
Addi ionally, we alida ed he pe o mance and com-
pu a ional e iciency o ou app oach using eal-wo ld
malwa e and goodwa e samples. To his end, he Model
Gene a ion module was con igu ed o es ou DL a chi-
ec u es: ResNe 18, ResNe 34, E icien Ne B3, and E i-
cien Ne V2S. In e ms o e alua ion me ics, we ound
ha ResNe 18 ou pe o med he o he a chi ec u es o
bo h ob usca ed and non-ob usca ed samples, achie -
ing F1-sco es o 99.34% and 97.5%, espec i ely. Rega d-
ing compu a ional consump ion, Res Ne 18 equi ed he
leas esou ces, ollowed by Res Ne 34, E icien Ne B3,
and inally E icien Ne V2S.
Page 21 o 23
Cas illoCama goe al. Cybe secu i y (2025) 8:97
As u u e wo k, we plan o explo e in e p e abili y
echniques o iden i y he speci ic loca ion o malicious
code wi hin he malwa e samples. These echniques will
enhance us in he model by no only classi ying sam-
ples as malwa e o goodwa e, bu also p o iding explana-
ions o why a sample is ca ego ized in a pa icula way.
Addi ionally, we aim o add ess ce ain limi a ions o
he amewo k by imp o ing he di e si y o he da ase s
used, ensu ing b oade co e age o di e en ob usca ion
echniques and malwa e amilies. This will enhance he
model’s adap abili y o eme ging h ea s. Fu he mo e,
we plan o in es iga e me hods o s eng hen he ame-
wo k’s e ec i eness agains e e -e ol ing ob usca ion
echniques, ensu ing i s applicabili y o di e se malwa e
ypes. An addi ional limi a ion o ou cu en wo k is
ha i ocuses solely on x86 bina ies. Explo ing c oss-
a chi ec u e compa ibili y, such as assessing ARM bina-
ies on x86 pla o ms, is an impo an di ec ion o u u e
esea ch.
We also plan as u u e wo ks o de elop expe imen s
o pe o m a compa ison be ween he me hod (Bina y-
o-Pixel Mapping) o con e bina y iles in o images
employed cu en ly by DEFENDIFY, wi h o he me hods
like: con e sion o ins uc ions (opcodes) o images, isu-
aliza ion based on en opy, gene a ion o colo ed images
using a RGB mapping, con e sion o indi idual Po -
able Execu able (PE) sec ions, among o he s. Besides, i
could p o e use ul o implemen algo i hms ha do no
ely on bina y o image ans o ma ion p ocesses, using
adi ional neu al ne wo k a chi ec u es ha can handle
unp ocessed bina y in o ma ion, in o de o compa e he
esul s ob ained when images a e no used. In his way,
p ocessing pipelines simila o DEFENDIFY, bu ha do
no use TL o CNNs, may be de eloped as a u u e wo k.
Acknowledgemen s
We acknowledge all colleagues om School o Enginee ing, Science and
Technology a Uni e sidad del Rosa io (Colombia) and Facul y o Compu e
Science a Uni e sidad de Mu cia (Spain) who p o ided eedback o imp o e
he quali y o his pape .
Au ho con ibu ions
Concep ualiza ion: Rod igo Cas illo Cama go, San iago Al é ez, Daniel Díaz‑
López; Me hodology and alida ion: Angel Luis Pe ales Gómez, Pan aleone
Nespoli; Da a cu a ion, o mal analysis and in es iga ion: Juan Mu cia Nie o,
Rod igo Cas illo Cama go, Nicolás Rojas; W i ing ‑ o iginal d a p epa a‑
ion: Juan Mu cia Nie o, Rod igo Cas illo Cama go, Nicolás Rojas, Pan aleone
Nespoli; W i ing ‑ e iew and edi ing: Daniel Díaz‑López, Félix Gómez Má mol,
Umi Ka abiyik; Funding acquisi ion: Daniel Díaz‑López, Angel Luis Pe ales
Gómez, Pan aleone Nespoli, San iago Al é ez; Supe ision: San iago Al é ez,
Daniel Díaz‑López.
Funding
This wo k has been pa ially unded by he School o Enginee ing, Sci‑
ence and Technology a Uni e sidad del Rosa io (Colombia) h ough a
“Beca de Es ancia de Docencia e In es igación ‑ EDI 2022‑1”, by MCIN/AEI/
10.13039/501100011033, Nex Gene a ionEU/PRTR, UE, unde G an TED 2021‑
129300B‑I00, by MCIN / AEI / 10.13039 / 501100011033 / FEDER, UE, unde
G an PID2021 ‑ 122466OB ‑ I00, he s a egic p ojec DEFENDER om he
Spanish Na ional Ins i u e o Cybe secu i y (INCIBE), by he Reco e y, T ans o ‑
ma ion and Resilience Plan, Nex Gene a ion EU, and by he Spanish Minis y
o Uni e si ies linked o he Eu opean Union h ough he Nex Gene a ionEU
p og am, unde Ma ga i a Salas pos doc o al ellowship (172/MSJD/22). This
wo k has also been pa ially unded by he N idia Academic G an P og am
h ough GPU ins ances p o ided by Sa u n Cloud.
A ailabili y o da a and ma e ials
Ins uc ions on how o ob ain da ase s used in he expe imen s a e a ailable
a he p ojec eposi o y a h ps:// gi hub. com/ Ni ogu/ Ob us ca ed Malwa
eDe ec ion.
Code a ailabili y
Code de eloped o execu e he expe imen s p esen ed in his pape is a ail‑
able a he p ojec eposi o y a h ps:// gi hub. com/ Ni ogu/ Ob us ca ed Malwa
eDe ec ion.
Decla a ions
Compe ing in e es s
The au ho s decla e no compe ing in e es s.
Recei ed: 16 May 2024 Accep ed: 17 Ma ch 2025
Re e ences
Allix K, Bissyandé TF, Klein J e al (2015) A e you aining da ase s ye ele an ?
In: Piessens F, Caballe o J, Bielo a N (eds) Enginee ing secu e so wa e
and sys ems. Sp inge , Cham, pp 51–67
Bal am N, Hsieh G, McFall C (2019) S a ic malwa e analysis using machine
lea ning algo i hms on APT1 da ase wi h s ing and PE heade ea u es.
In: 2019 In e na ional con e ence on compu a ional science and compu‑
a ional in elligence (CSCI). IEEE, pp 90–95
Ba ‑E dene M, Pa k H, Li H e al (2017) En opy analysis o classi y unknown
packing algo i hms o malwa e de ec ion. In J In Secu 16(3):227–248.
h ps:// doi. o g/ 10. 1007/ s10207‑ 016‑ 0330‑4
Ben‑Bassa M, Klo e KL, Weil MH (1980) Sensi i i y analysis in Bayesian clas‑
si ica ion models: mul iplica i e de ia ions. IEEE T ans Pa e n Anal Mach
In ell PAMI 2(3):261–266. h ps:// doi. o g/ 10. 1109/ TPAMI. 1980. 47670 15
Bensaoud A, Abudawaood N, Kali a J (2020) Classi ying malwa e images wi h
con olu ional neu al ne wo k models. In J Ne w Secu 22(6):1022–1031
Be gs a J, Ba dene R, Bengio Y, e al (2011) Algo i hms o hype ‑pa ame e
op imiza ion. In: P oceedings o he 24 h in e na ional con e ence on
neu al in o ma ion p ocessing sys ems. Cu an Associa es Inc., G anada,
Spain, NIPS’11, pp 2546–2554
B eiman L (2001) Random o es s. Mach Lea n 45:5–32. h ps:// doi. o g/ 10.
1023/A: 10109 50718 922
Bu i a L, Le DT (2021) Cybe secu i y and ap g oups. In: 2021 Communica ion
and in o ma ion echnologies (KIT), pp 1–7. h ps:// doi. o g/ 10. 1109/ KIT52
904. 2021. 95837 44
Ceschin F, Bo acin M, Lüde s G, e al (2021) No need o each new icks o old
malwa e: winning an e asion challenge wi h xo ‑based ad e sa ial sam‑
ples. In: Re e sing and o ensi e‑o ien ed ends symposium. Associa ion
o Compu ing Machine y, Vienna, ROOTS’20, pp 13–22. h ps:// doi. o g/
10. 1145/ 34336 67. 34336 69
Con i M, Vinod P, Vi ella A (2022) Ob usca ion de ec ion in and oid applica ions
using deep lea ning. J In Secu Appl 70:103311
Co e T, Ha P (1967) Nea es neighbo pa e n classi ica ion. IEEE T ans In
Theo y 13(1):21–27. h ps:// doi. o g/ 10. 1109/ TIT. 1967. 10539 64
Cox D (1989) Analysis o bina y da a, 2nd edn. Monog aphs on s a is ics and
applied p obabili y. Chapman and Hall, London
Cybe ish (2025) Ze o phishing p o ec ion o MSPs and SMB | co ense p o ec .
h ps:// co en se. com/. Accessed 15 Ma 2025
Díaz‑López D, Blanco U ibe M, San iago Cely C e al (2018) De eloping secu e
IoT se ices: a secu i y‑o ien ed e iew o IoT pla o ms. Symme y.
h ps:// doi. o g/ 10. 3390/ sym10 120669
Page 22 o 23
Cas illoCama goe al. Cybe secu i y (2025) 8:97
El Me abe H, Haj aoui A (2019) A su ey o malwa e de ec ion echniques
based on machine lea ning. In J Ad Compu Sci Appl 10(1):366–373
Fa ley R, Wang X (2014) Codex : au oma ic ex ac ion o ob usca ed a ack
code om memo y dump. In: Chow SSM, Camenisch J, Hui LCK e al
(eds) In Secu . Sp inge , Cham, pp 502–514
Fishe RA (1936) The use o mul iple measu emen s in axonomic p oblems.
Ann Eugen 7(2):179–188. h ps:// doi. o g/ 10. 1111/j. 1469‑ 1809. 1936.
b021 37.x
Gé on A (2019) Hands‑on machine lea ning wi h sciki ‑lea n, ke as, and
enso low. O’Reilly Media Inc, New on
Gla oudis D, Iossi ides A, Cha zimisios P (2020) Su ey, compa ison and
esea ch challenges o IoT applica ion p o ocols o sma a ming.
Compu Ne w 168:107037
G aham D (2021) E hical hacking: a hands‑on in oduc ion o b eaking in.
No S a ch P ess, San F ancisco
Guo Y, Fan W (2019) Fea u e collec ion and selec ion in malwa e classi ica‑
ion. In: P oceedings o he 2019 in e na ional con e ence on a i icial
in elligence and ad anced manu ac u ing, pp 1–5
Hakon P, Fa eed Y, Sind e G (2020) The ansomwa e‑as‑a‑se ice economy
wi hin he da kne . Compu Secu 92:101762. h ps:// doi. o g/ 10. 1016/j.
cose. 2020. 101762
Han S, Yun H, Pa k Y (2024) Deep lea ning o cybe secu i y classi ica ion:
u ilizing dep h‑wise CNN and a en ion mechanism on VM‑ob usca ed
da a. Elec onics 13(17):3393
Hussain A, Asi M, Ahmad MB, e al (2022) Malwa e de ec ion using machine
lea ning algo i hms o windows pla o m. In: P oceedings o in e na‑
ional con e ence on in o ma ion echnology and applica ions: ICITA
2021. Sp inge , pp 619–632
Iaksch J, Fe nandes E, Bo sa o M (2021) Digi aliza ion and big da a in sma
a ming—a e iew. J Manag Anal 8(2):333–349
Jiang Y, Li R, Tang J e al (2020) Aomd oid: de ec ing ob usca ion a ian s
o and oid malwa e using ans e lea ning. In: Pa k N, Sun K, Fo es i S
e al (eds) Secu i y and p i acy in communica ion ne wo ks. Sp inge ,
Cham, pp 242–253
Joshi S, Upadhyay H, Lagos L, e al (2018) Machine lea ning app oach o
malwa e de ec ion using andom o es classi ie on p ocess lis da a
s uc u e. In: P oceedings o he 2nd in e na ional con e ence on
in o ma ion sys em and da a mining, pp 98–102
Kakisim AG, Gulmez S, Sogukpina I (2022) Sequen ial opcode embedding‑
based malwa e de ec ion me hod. Compu Elec Eng 98:107703
Ke G, Meng Q, Finley T, e al (2017) Ligh gbm: a highly e icien g adien
boos ing decision ee. In: Ad ances in neu al in o ma ion p ocessing
sys ems, ol 30. Cu an Associa es, Inc., Long Beach
Kim JY, Bu SJ, Cho SB (2018) Ze o‑day malwa e de ec ion using ans e ed
gene a i e ad e sa ial ne wo ks based on deep au oencode s. In Sci
460–461:83–102. h ps:// doi. o g/ 10. 1016/j. ins. 2018. 04. 092
Lee H, Kim S, Baek D e al (2023) Robus IoT malwa e de ec ion and clas‑
si ica ion using opcode ca ego y ea u es on machine lea ning. IEEE
Access 11:18855–18867
Li M, Han D, Li D e al (2022) MFVT: an anomaly a ic de ec ion me hod
me ging ea u e usion ne wo k and ision ans o me a chi ec u e.
EURASIP J Wi el Commun Ne w 1:39
Lyda R, Ham ock J (2007) Using en opy analysis o ind enc yp ed and
packed malwa e. IEEE Secu P i 5(2):40–45. h ps:// doi. o g/ 10. 1109/
MSP. 2007. 48
Ma C (2021) Sma ci y and cybe ‑secu i y; echnologies used, leading chal‑
lenges and u u e ecommenda ions. Ene gy Rep 7:7999–8012
Ma as oni N, Giacobazzi R, Dalla P eda M (2021) Da a augmen a ion and
ans e lea ning o classi y malwa e images in a deep lea ning con ex .
J Compu Vi ol Hack Techn 17(4):279–297. h ps:// doi. o g/ 10. 1007/
s11416‑ 021‑ 00381‑3
Ma ínez Ma ínez I, Flo ián Qui ián A, Díaz‑López D e al (2021) Malsei s:
o ecas ing malwa e sp ead based on compa men al models in
epidemiology. Complexi y 2021:5415724. h ps:// doi. o g/ 10. 1155/
2021/ 54157 24
Me caldo F, Cia amella G, San one A, e al (2023) Ob usca ed mobile
malwa e de ec ion by means o dynamic analysis and explainable
deep lea ning. In: P oceedings o he 18 h in e na ional con e ence on
a ailabili y, eliabili y and secu i y, pp 1–10
Mimecas (2025) Cybe g aph da ashee –mimecas . h ps:// www. mimec as .
com/ esou ces/ da as hee s/ cybe g aph/. Accessed 15 Ma 2025
Mi e (2025a) Abuse ele a ion con ol mechanism: de ice adminis a o
pe missions. h ps:// a ack. mi e. o g/ echn iques/ T1626/ 001/. Accessed
15 Ma 2025
Mi e (2025b) Dynamic esolu ion. h ps:// a ack. mi e. o g/ echn iques/
T1637/. Accessed 15 Ma 2025
Nespoli P, Useche Peláez D, Díaz‑López D e al (2019) Cosmos: collabo a‑
i e, seamless and adap i e sen inel o he in e ne o hings. Senso s.
h ps:// doi. o g/ 10. 3390/ s1907 1492
Pelaez DU, Díaz‑López D, Nespoli P, e al (2018) T is: a h ee‑ ings IoT sen inel
o p o ec agains cybe ‑ h ea s. In: 2018 Fi h in e na ional con e ence
on in e ne o hings: sys ems, managemen and secu i y, pp 123–130.
h ps:// doi. o g/ 10. 1109/ IoTSMS. 2018. 85544 32
Pe ei a‑Koha su J, Quijano‑Sánchez L, Libe a o e F e al (2019) De ec ing
and moni o ing ha e speech in wi e . Senso s 19(21):4654
Pla J (2000) P obabilis ic ou pu s o suppo ec o machines and com‑
pa isons o egula ized likelihood me hods. Ad La ge Ma gin Classi
10:61–74
Ra i V, Alazab M, Sel aganapa hy S e al (2022) A mul i‑ iew a en ion‑
based deep lea ning amewo k o malwa e de ec ion in sma
heal hca e sys ems. Compu Commun 195:73–81
Rehman A, Saba T, Khan MZ e al (2022) In e ne ‑o ‑ hings‑based suspicious
ac i i y ecogni ion using mul imodali ies o compu e ision o sma
ci y secu i y. Secu Commun Ne w 2022:8383461
Rezaei T, Mana i F, Hamzeh A (2021) A PE heade ‑based me hod o mal‑
wa e de ec ion using clus e ing and deep embedding echniques. J In
Secu Appl 60:102876
Ribani R, Ma engoni M (2019) A su ey o ans e lea ning o con olu ional
neu al ne wo ks. In: 2019 32nd SIBGRAPI con e ence on g aphics, pa ‑
e ns and images u o ials (SIBGRAPI‑T). IEEE, pp 47–57
Ris ej J, Lacinák M, Ond ejka R (2020) On sma ci y and sa e ci y concep s.
Mob Ne w Appl 25:836–845
Sahin M, Bah iya S (2020) A su ey on malwa e de ec ion wi h deep lea n‑
ing. In: 13 h in e na ional con e ence on secu i y o in o ma ion and
ne wo ks, pp 1–6
Sánchez Venegas C, Aguado Bedoya C, Díaz‑López D e al (2019) Using
e e se enginee ing o handle malwa e. Ing Solida 15(2):1–26. h ps://
doi. o g/ 10. 16925/ 2357‑ 6014. 2019. 02. 02
Shauka K, Luo S, Va adha ajan V (2023) A no el deep lea ning‑based
app oach o malwa e de ec ion. Eng Appl A i In ell 122:106030
Smi h LN (2017) Cyclical lea ning a es o aining neu al ne wo ks. a Xi :
1506. 01186
Song L, Hu X, Zhang G e al (2022) Ne wo king sys ems o AI: on he con‑
e gence o compu ing and communica ions. IEEE In e ne Things J
9(20):20352–20381. h ps:// doi. o g/ 10. 1109/ JIOT. 2022. 31722 70
Talukde S, Talukde Z (2020) A su ey on malwa e de ec ion and analysis
ools. In J Ne w Secu Appl 12(2): 21
Tan M, Le Q (2019) E icien Ne : e hinking model scaling o con olu ional
neu al ne wo ks. In: Chaudhu i K, Salakhu dino R (eds) P oceedings o
he 36 h in e na ional con e ence on machine lea ning, p oceedings o
machine lea ning esea ch, ol 97. PMLR, Long Beach, Cali o nia, USA,
pp 6105–6114. h ps:// p oce edings. ml . p ess/ 97/ an19a. h ml
Tan M, Le QV (2020) E icien ne : e hinking model scaling o con olu ional
neu al ne wo ks. a Xi : 1905. 11946
Tan M, Le QV (2021) E icien ne 2: smalle models and as e aining. a Xi :
2104. 00298
To alini F, Ochoa M, Sun J, e al (2019) Ca e ul‑packing: a p ac ical and
scalable an i‑ ampe ing so wa e p o ec ion en o ced by us ed
compu ing. In: P oceedings o he nin h ACM con e ence on da a and
applica ion secu i y and p i acy. Associa ion o Compu ing Machine y,
Richa dson, Texas, USA, CODASPY ’19, pp 231–242. h ps:// doi. o g/ 10.
1145/ 32920 06. 33000 29
Useche‑Pelaez DE, Sepul eda‑Alza e D, Díaz‑López D e al (2018) Building
malwa e classi ica o s usable by s a e secu i y agencies. I eckne
15:107–121
Web oo (2020) Web oo h ea epo . Tech. ep., Web oo . h ps:// mypage.
web o o . com/ s/ 557‑ FSI‑ 195/ images/ 2020% 20Web oo % 20Th ea %
20Rep o _ US_ FINAL. pd
Weiss K, Khoshgo aa TM, Wang D (2016) A su ey o ans e lea ning. J. Big
Da a 3(1):1–40
Page 23 o 23
Cas illoCama goe al. Cybe secu i y (2025) 8:97
Xi B (2020) Ad e sa ial machine lea ning o cybe secu i y and compu e
ision: cu en de elopmen s and challenges. Wiley In e discip Re :
Compu S a 12(5):e1511
Xue H, Sun S, Venka a amani G e al (2019) Machine lea ning‑based analysis o
p og am bina ies: a comp ehensi e s udy. IEEE Access 7:65889–65912
Publishe ’s No e
Sp inge Na u e emains neu al wi h ega d o ju isdic ional claims in pub‑
lished maps and ins i u ional a ilia ions.
