Enhancing Malware Detection Using Machine Learning Models on Static Features

Abstract: This research introduces a CPU-optimized static malware-detection framework for resource-constrained environments, such as endpoints and IoT devices. We address the significant challenge of high memory and computational demands by proposing a robust, memory-safe data ingestion pipeline. This pipeline exclusively extracts histogram-based static features, employs type compression, and utilizes batch-wise loading with global sample limits to prevent memory overflows on systems with only 16 GB of RAM and no GPU support. Our core contribution is a compact stacking ensemble composed of three high-efficiency gradient-boosting models: LightGBM, CatBoost, and XGBoost, with a LightGBM meta-learner. This novel ensemble structure enables efficient, CPU-only training and inference while ensuring strong detection performance. Evaluated on the EMBER 2024 dataset, the framework achieves 86.99% accuracy, 0.87 F1-score, and 0.9473 AUC. This work fills a critical gap by demonstrating that carefully optimized gradient-boosting ensembles can serve as a highly deployable alternative to resource-intensive Deep Learning methods in limited security situations.

Ashwag Alotaibi and Mounir Frikha. “Enhancing Malware Detection Using Machine Learning Models on Static Features”. International Journal of Advanced Computer Science and Applications (IJACSA) 17.2 (2026). http://dx.doi.org/10.14569/IJACSA.2026.01702105

@article{Alotaibi2026,
title = {Enhancing Malware Detection Using Machine Learning Models on Static Features},
journal = {International Journal of Advanced Computer Science and Applications},
doi = {10.14569/IJACSA.2026.01702105},
url = {http://dx.doi.org/10.14569/IJACSA.2026.01702105},
year = {2026},
publisher = {The Science and Information Organization},
volume = {17},
number = {2},
author = {Ashwag Alotaibi and Mounir Frikha}
}