#machine learning #cybersecurity

Delphi Scanner: efficient and interpretable static malware detection via API sequence modeling

Bijied Brahimi Vincent Cohadon Gabriel Glazman Rayan Al Mohaize Omran Berjawi Rida Khatoun

Sep 2026 · arXiv.org · Vol abs/2609.19900 · 0 citations · 30 references

Computer Science

TL;DR

Delphi Scanner is introduced, a static malware detection system for Windows PE files that balances efficiency with behavioral interpretation that uses a convolutional neural network to model Windows API sequences to classify PE and a decoupled interpretation layer based on a rule-based layer to categorize APIs into high-level malicious capabilities.

Abstract

Static malware detection for Windows Portable Executable files demands a careful balance between detection effectiveness, computational efficiency, and analytical interpretability. This paper introduces Delphi Scanner, a static malware detection system for Windows PE files that balances efficiency with behavioral interpretation. It uses a convolutional neural network (CNN) to model Windows API sequences to classify PE and a decoupled interpretation layer based on a rule-based layer to categorize APIs into high-level malicious capabilities. Evaluated on over 190,000 Windows PE files, the system achieves 95.35% accuracy with a 1.53~MB model footprint. Robustness experiments on 5,647 out-of-distribution MalwareBazaar samples, paired packed and unpacked executables, and three adversarial manipulation strategies confirm generalization beyond the training distribution and resistance to functionality-preserving evasion techniques. Overall, these results demonstrate that API sequence-based static analysis offers a practical, interpretable, and efficient foundation for malware triage in local deployment scenarios.

DOI arXiv Semantic Scholar

View source

Similar papers

Conference Aug 2026

Explainable Malware Detection from Noisy API Sequences with RAG-Based MITRE ATT&CK Mapping

As sophisticated evasion techniques like polymorphism and staged execution increasingly neutralize conventional signature-based defenses, dynamic API sequence analysis has emerged as an effective approach for malware detection. However, extracting actionable intelligence from noisy execution logs while maintaining mode...

Dat Quoc Phan, Tien Duc Anh Hao, Nghi Hoang Khoa et al. · International Conference on... · 0 citations

Bolstering Binary Datasets for Malware Detection Through Programmatic Data Augmentation

Michael D. Wong, Edward Raff, James Holt et al. · 0 citations

Conference Open access Aug 2026

DeepGuard: Explainable Behavioral Malware Detection Using Hybrid CNN-BiLSTM-Attention Deep Learning on Dynamic API Call Sequences

Overall, DeepGuard is presented as an efficient, scalable, and explainable framework for modern behavioral anti-malware systems, and this revised version explicitly documents its current validation scope, reproducibility details, and the empirical analyses planned to further substantiate these results.

Vidya Gavekar, Amar Anant Shinde, S. Lodha et al. · International Conference on... · 0 citations

Detection and Explanation of PowerShell Malware with Large Language Models

The application of LLMs for detecting malicious PowerShell scripts and producing human-interpretable explanations for their classification decisions are investigated, showing that LLMs are capable of identifying and explaining malicious PowerShell scripts, although performance varies across different models.

Meng Wang, Emma Topolovec, B. Arana et al. · 0 citations

Open access Sep 2026

Visualization based malware classification under extreme class imbalance: a transfer learning approach with systematic ablation

Malware detection and classification continues to be a major concern of cybersecurity since threat attackers are refining to come up with more advanced and elusive malicious code. Visualization-based solutions that transform raw binary executables into grayscale images and the use of convolutional neural networks t...

G. P. Raghudathesh, M. Pavan Kumar, Thimmaraja Yadava G et al. · Scientific Reports · 0 citations

Preprint Sep 2026

PhantomCall: Evading ML Malware Detectors via Function Call Graph Perturbation

Phan- tomCall is presented, a black-box attack that perturbs the FCG of Windows PE malware by injecting fully executable dummy functions at targeted call sites, adding new nodes and edges to both the CFG and FCG while preserving program semantics.

Md Ajwad Akil, Adrian Shuai Li, Imtiaz Karim et al. · 0 citations

Delphi Scanner: efficient and interpretable static malware detection via API sequence modeling

Abstract

Similar papers

Explainable Malware Detection from Noisy API Sequences with RAG-Based MITRE ATT&CK Mapping

Bolstering Binary Datasets for Malware Detection Through Programmatic Data Augmentation

DeepGuard: Explainable Behavioral Malware Detection Using Hybrid CNN-BiLSTM-Attention Deep Learning on Dynamic API Call Sequences

Detection and Explanation of PowerShell Malware with Large Language Models

Visualization based malware classification under extreme class imbalance: a transfer learning approach with systematic ablation

PhantomCall: Evading ML Malware Detectors via Function Call Graph Perturbation

Related blog posts

Learn the rules: The hacker mindset

How to predict the behavior of molecules from scant data

ToyBlocks: A controlled world for robot learning and evaluation

Agentic cheminformatics with Google Antigravity