SHAP-guided Feature Refinement for Efficient, Robust, and Interpretable Memory-Forensic Malware Detection

The evolution of malware continues to provide a challenge to existing detection methods, particularly those based on static analysis and signature-based heuristics. This paper investigates a memory-forensics-driven methodology for malware detection that includes feature refinement, model explainability, efficiency analysis, adversarial robustness testing, and family-disjoint validation. Using the CIC MalMem-2022 dataset, we examined 55 memory-resident features and reduced them to 13 using mutual information and SHapley Additive exPlanations-guided feature refinement (SHAP-GFR). We tested five classifiers: RF, XGBoost, (RF), eXtreme Gradient Boosting (XGBoost), multilayer perceptron (MLP), one-dimensional CNN (1D CNN), and a CNN-LSTM hybrid using a 70