Delphi Scanner: efficient and interpretable static malware detection via API sequence modeling
Researchers introduce Delphi Scanner, a 1.53 MB CNN-based static malware detector for Windows PE files using API sequences, achieving 95.35% accuracy.
Delphi Scanner is a static malware detection system for Windows Portable Executable files that models API call sequences with a convolutional neural network and adds a rule-based interpretation layer categorizing APIs into high-level malicious capabilities. Evaluated on over 190,000 Windows PE files, it achieves 95.35% accuracy with a 1.53 MB model footprint suitable for local deployment. Robustness tests on 5,647 out-of-distribution MalwareBazaar samples, packed/unpacked pairs, and three adversarial manipulation strategies showed generalization and resistance to functionality-preserving evasion. The authors position it as an efficient, interpretable foundation for malware triage.
- CNN models Windows API sequences; rule-based layer provides interpretable capability categories.
- 95.35% accuracy on 190,000+ PE files with only a 1.53 MB model.
- Tested on 5,647 out-of-distribution MalwareBazaar samples and packed executables.
- Resists three functionality-preserving adversarial manipulation strategies.
- Products
- Delphi ScannerMalwareBazaar
From the original article
1 min read at arxiv.orgStatic malware detection for Windows Portable Executable files demands a careful balance between detection effectiveness, computational efficiency, and analytical interpretability. This paper introduces Delphi Scanner, a static malware detection system for Windows PE files that balances efficiency with behavioral interpretation.
By Bijied Brahimi · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.