用逻辑回归+外部情报，三层次检测恶意链接与文件。
SecureScan: An AI-Driven Multi-Layer Framework for Malware and Phishing Detection Using Logistic Regression and Threat Intelligence Integration
- 三层架构：启发式过滤、机器学习分类、第三方情报验证
- 93.1%准确率，0.87精确率，0.92召回率，低误报
- 轻量模型加校准阈值，适合实际部署
现代恶意软件和钓鱼攻击日益复杂，传统基于签名的入侵检测系统效果下降。本文提出SecureScan，一种基于AI的三层检测框架，集成逻辑回归分类、启发式分析及通过VirusTotal API获取的外部威胁情报，对网址、文件哈希和二进制文件进行综合筛查。该架构优先高效处理：通过启发式方法过滤已知威胁，用机器学习分类不确定样本，对边界案例引入第三方情报验证。在基准数据集上，SecureScan实现93.1%的准确率，精确率为0.87，召回率为0.92，通过阈值校准实现良好泛化并减少过拟合。引入0.45-0.55的灰色区域逻辑与校准阈值，有效降低误报，提升实际运行稳定性。实验表明，经校准验证和外部情报增强的轻量统计模型，可达到与复杂深度学习系统相当的可靠性和性能。
原文摘要 · Abstract (English)
The growing sophistication of modern malware and phishing campaigns has diminished the effectiveness of traditional signature-based intrusion detection systems. This work presents SecureScan, an AI-driven, triple-layer detection framework that integrates logistic regression-based classification, heuristic analysis, and external threat intelligence via the VirusTotal API for comprehensive triage of URLs, file hashes, and binaries. The proposed architecture prioritizes efficiency by filtering known threats through heuristics, classifying uncertain samples using machine learning, and validating borderline cases with third-party intelligence. On benchmark datasets, SecureScan achieves 93.1 percent accuracy with balanced precision (0.87) and recall (0.92), demonstrating strong generalization and reduced overfitting through threshold-based decision calibration. A calibrated threshold and gray-zone logic (0.45-0.55) were introduced to minimize false positives and enhance real-world stability. Experimental results indicate that a lightweight statistical model, when augmented with calibrated verification and external intelligence, can achieve reliability and performance comparable to more complex deep learning systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。