Representation-Architecture Tradeoffs in Behavioral Malware Detection


Ameya Srivastava, Auritra Dey, Pavitra Kumar, Devesh C Jinwala
Department of Computer Science and Engineering, S.V. National Institute of Technology, Surat, India
[PDF] [Code]

Abstract

We present a controlled evaluation of representation-architectures for Windows PE API-based behavioral malware detection under a unified experimentation framework. We implement and compare sequential, graph, and attention-based models with their corresponding adversarially regularized variants using identical datasets, preprocessing pipelines, and evaluation protocols. Models are evaluated on both in-distribution and out-of-distribution (OOD) classification performance, robustness against adversarial evasion simulations, and computational efficiency. We find that sequential models remain efficient and achieve strong in-distribution performance, while OOD evaluation results show class-specific tradeoffs between malware recall and benign specificity across models. The effects of adversarial regularization are inconsistent and architecture-specific.

Comments