AI, Volume 7, Issue 2
2026 February - 43 articles
Cover Story: This study presents a two-stage host-based malware detection framework that integrates memory forensics, explainable ML, and ensemble classification, designed as a post-alert asynchronous SOC workflow balancing forensic depth and operational efficiency. In stage 1, a TabNet model is used for binary classification (benign vs. malware). In stage 2, a Voting Classifier ensemble (LGBM, XGB, HGB) model is used to identify the specific malware family (Trojan, Ransomware, Spyware). To balance the best trade-off between memory analysis and detection accuracy, only a curated subset of 24 memory features were selected to reduce acquisition/extraction time and validated via redundancy inspection. Finally, cross-environment experiments reveal severe domain shift and motivate drift-aware correction to improve robustness. View this paper - Issues are regarded as officially published after their release is announced to the table of contents alert mailing list .
- You may sign up for email alerts to receive table of contents of newly released issues.
- PDF is the official format for papers published in both, html and pdf forms. To view the papers in pdf format, click on the "PDF Full-text" link, and use the free Adobe Reader to open them.
