Scalable Malware Detection Framework Using Performance Counters and Gradient Boosting

Facing the challenge of increasingly sophisticated malware, it is imperative to develop an effective and adaptable malware detection framework. Hardware-level information has been shown to be very effective in detecting malware in the system through dynamic behavioral analysis at runtime. However, previous approaches suffer from the overhead of complex neural network models, as well as difficulty in scaling toward new attacks. In this work, we introduce a novel approach that leverages the Light Gradient-Boosting Machine (LightGBM) model, known for its efficiency and support for fast transfer learning method, to create a scalable and highly accurate malware detection system. Our framework achieves an exceptional detection accuracy of more than 99.90% for multiclass classification. Through transfer learning, the model can quickly adapt to new malware data and environments, significantly reducing the time and resources needed for retraining. Our results highlight the potential of using the LightGBM model to improve the malware detection framework.