Alsubaei Faisal S, Almazroi Abdulwahab Ali, Atwa Walid Said, Almazroi Abdulaleem Ali, Ayub Nasir, Jhanjhi N Z
Department of Cybersecurity, College of Computer Science and Engineering, Jeddah, 21959, Saudi Arabia.
College of Computing and Information Technology at Khulais, Department of Information Technology, Jeddah, 21959, Saudi Arabia.
Sci Rep. 2025 Jul 13;15(1):25309. doi: 10.1038/s41598-025-08556-4.
Malware has become a big issue for digital infrastructure with the growing complexity and frequency of intrusions; it usually avoids conventional detection systems via obfuscation and dynamic behaviour patterns. Existing methods, particularly those relying on signature-based techniques, struggle to detect emerging threats, leading to significant vulnerabilities in enterprise and institutional environments. This study aims to develop an adaptive and efficient malware detection framework that addresses these limitations while supporting real-time analysis. To this end, we introduce SimCLR-GRU, a novel ensemble architecture that integrates SimCLR-based contrastive learning for feature extraction and a GRU module to capture sequential behavioural patterns. The framework also incorporates graph neural network (GNN)-based feature selection to reduce redundancy and optimise Fish School Search (FSS) to fine-tune key hyperparameters for improved learning performance. Experiments using a comprehensive Portable Executable (PE) malware dataset show that SimCLR-GRU achieves a classification accuracy of 99%, exceeding many baseline models with a 15% increase. An AUC of 98.2%, an F1-score of 96.8%, and a false positive rate of only 0.02% underline the model's generalizability, accuracy, and resilience. Moreover, the low inference latency of the model qualifies for implementation in real-time and resource-limited surroundings. SimCLR-GRU provides a scalable and decisive answer to modern cyberspace's changing malware detection problem.
随着入侵的复杂性和频率不断增加,恶意软件已成为数字基础设施的一个重大问题;它通常通过混淆和动态行为模式来躲避传统检测系统。现有方法,尤其是那些依赖基于签名技术的方法,难以检测新出现的威胁,这在企业和机构环境中导致了重大漏洞。本研究旨在开发一个自适应且高效的恶意软件检测框架,该框架在支持实时分析的同时解决这些局限性。为此,我们引入了SimCLR-GRU,这是一种新颖的集成架构,它集成了基于SimCLR的对比学习用于特征提取以及一个GRU模块来捕获序列行为模式。该框架还纳入了基于图神经网络(GNN)的特征选择以减少冗余,并优化鱼群搜索(FSS)来微调关键超参数以提高学习性能。使用全面的可移植可执行文件(PE)恶意软件数据集进行的实验表明,SimCLR-GRU实现了99%的分类准确率,比许多基线模型高出15%。98.2%的AUC、96.8%的F1分数以及仅0.02%的误报率突出了该模型的通用性、准确性和鲁棒性。此外,该模型较低的推理延迟使其有资格在实时和资源受限的环境中实施。SimCLR-GRU为现代网络空间不断变化的恶意软件检测问题提供了一个可扩展且决定性的解决方案。