用轻量模型融合三类特征，提升跨域恶意软件检测效果
Cross-Domain Malware Detection via Probability-Level Fusion of Lightweight Gradient Boosting Models
- 分三路训练LightGBM，再融合概率预测结果
- 跨域验证下宏F1达0.823，显著优于单一模型
- 计算开销低，适合实时部署，代码数据全公开
日益复杂的恶意软件要求具备跨数据源泛化能力的检测机制。传统单数据集模型在跨域场景下表现不佳，且计算成本高。本文提出一种轻量级恶意软件检测框架，利用三个不同数据集：EMBER（静态特征）、API调用序列（行为特征）和CIC混淆内存（内存模式）进行概率级融合。在每个数据集上分别训练LightGBM分类器，筛选关键特征以保证效率，并通过网格搜索确定最优权重融合各模型的概率输出。大量实验表明，该融合方法在跨域验证集上取得0.823的宏F1分数，显著优于单个模型，具备更强泛化能力。框架计算开销低，适合实时部署，所有代码与数据均已公开，确保可复现性。
原文摘要 · Abstract (English)
The escalating sophistication of malware necessitates robust detection mechanisms that generalize across diverse data sources. Traditional single-dataset models struggle with cross-domain generalization and often incur high computational costs. This paper presents a novel, lightweight framework for malware detection that employs probability-level fusion across three distinct datasets: EMBER (static features), API Call Sequences (behavioral features), and CIC Obfuscated Memory (memory patterns). Our method trains individual LightGBM classifiers on each dataset, selects top predictive features to ensure efficiency, and fuses their prediction probabilities using optimized weights determined via grid search. Extensive experiments demonstrate that our fusion approach achieves a macro F1-score of 0.823 on a cross-domain validation set, significantly outperforming individual models and providing superior generalization. The framework maintains low computational overhead, making it suitable for real-time deployment, and all code and data are provided for full reproducibility.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。