Systematic Review: Malware Detection and Classification in Cybersecurity
Source abstract
Abstract
Malicious Software, commonly known as Malware, represents a persistent threat to cybersecurity, targeting the confidentiality, integrity, and availability of information systems. The digital era, marked by the proliferation of connected devices, cloud services, and the advancement of machine learning, has brought numerous benefits; however, it has also exacerbated exposure to cyber threats, affecting both individuals and corporations. This systematic review, which follows the PRISMA 2020 framework, aims to analyze current trends and new methods for malware detection and classification. The review was conducted using data from Web of Science and Scopus, covering publications from 2020 and 2024, with over 47 key studies selected for in-depth analysis based on relevance, empirical results and citation metrics. These studies cover a variety of detection techniques, including machine learning, deep learning and hybrid models, with a focus on feature extraction, malware behavior analysis and the application of advanced algorithms to improve detection accuracy. The results highlight important advances, such as the improved performance of ensemble learning and deep learning models in detecting sophisticated threats. Finally, this study identifies the main challenges and outlines opportunities of future research to improve malware detection and classification frameworks.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection · Information and Cyber Security
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Escuela de Ingeniería Informática, Pontificia Universidad Católica de Valparaíso, Valparaíso 2340025, Chile
Knowledge Discovery, Fraunhofer-Institute of Intelligent Analysis and Information Systems (IAIS), 53757 Sankt Augustin, Germany
Lamarr Institute for Machine Learning and Artificial Intelligence, 44227 Dortmund, Germany
Funding
Agencia Nacional de Investigación y Desarrollo
References (84)
Show source-provided references
1. A New Malware Classification Framework Based on Deep Learning Algorithms10.1109/ACCESS.2021.3089586 ↗
2. A Review of Cloud-Based Malware Detection System: Opportunities, Advances and Challenges10.24018/ejeng.2021.6.3.2372 ↗
3. Digital transformation and economic growth Efficiency improvement in the Digital media era: Digitalization of industry or Digital industrialization?10.1016/j.iref.2024.02.010 ↗
4. A novel machine learning approach for detecting first-time-appeared malware10.1016/j.engappai.2023.107801 ↗
5. Automatic extraction of named entities of cyber threats using a deep Bi-LSTM-CRF network10.1007/s13042-020-01122-6 ↗
6. Deloitte (2025, March 09). Beneath the Surface of a Cyberattack: A Deeper Look at Business Impacts. Available online: https://conventuslaw.com/report/beneath-the-surface-of-a-cyberattack-a-deeper-look/.
7. TetherView (2025, March 09). 10 Business Impacts of a Data Breach. Available online: https://tetherview.com/blog/the-devastating-business-impacts-of-a-cyber-breach.
8. Investopedia (2025, March 09). 10 Ways Cybercrime Impacts Business. Available online: https://www.investopedia.com/financial-edge/0112/3-ways-cyber-crime-impacts-business.aspx.
9. (2025, March 09). 6dg. Devastating Examples of the Consequences of a Cyber-Attack. Available online: https://www.6dg.co.uk/blog/consequences-of-a-cyber-attack/.
10. Cisco (2025, March 09). What Is Machine Learning in Security? 2023. Available online: https://www.cisco.com/site/us/en/learn/topics/security/what-is-machine-learning-in-security.html.
11. Kaspersky (2023). Artificial Intelligence and Machine Learning in Cybersecurity, Springer.
12. A state-of-the-art survey of malware detection approaches using data mining techniques10.1186/s13673-018-0125-x ↗
13. Deep learning approach to cybersecurity analysis
14. Sikorski, M., and Honig, A. (2012). Practical Malware Analysis: The Hands-on Guide to Dissecting Malicious Software, No Starch Press.
15. Symantec (2025, March 09). Internet Security Threat Report. Available online: https://docs.broadcom.com/docs/istr-24-executive-summary-en.
16. A survey on malware detection using data mining techniques10.1145/3073559 ↗
17. A survey of data mining and machine learning methods for cyber security intrusion detection10.1109/COMST.2015.2494502 ↗
18. Survey of machine learning techniques for malware analysis10.1016/j.cose.2018.11.001 ↗
19. Anderson, H.S., Woodbridge, J., and Filar, B. (2016, January 28). DeepDGA: Adversarially-tuned domain generation and detection. Proceedings of the 2016 ACM Workshop on Artificial Intelligence and Security, Vienna, Austria.10.1145/2996758.2996767 ↗
20. Deep learning applications for cyber security
21. A comprehensive review on malware detection approaches10.1109/ACCESS.2019.2963724 ↗
22. Zhu, Z., and Dumitras, T. (2016). FeatureSmith: Automatically Engineering Features for Malware Detection by Mining the Security Literature. IEEE Trans. Inf. Forensics Secur., 13.10.1145/2976749.2978304 ↗
23. Pascanu, R., Stokes, J., Sanossian, H., Marinescu, M., and Thomas, A. (2015, January 19–24). Malware classification with recurrent networks. Proceedings of the 2015 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), South Brisbane, Australia.10.1109/ICASSP.2015.7178304 ↗
24. Declaración PRISMA 2020: Una guía actualizada para la publicación de revisiones sistemáticas10.1016/j.recesp.2021.06.016 ↗
25. Kitchenham, B., and Charters, S. (2025, March 09). Guidelines for Performing Systematic Literature Reviews in Software Engineering. EBSE Technical Report EBSE-2007-01, Keele University. Available online: https://legacyfileshare.elsevier.com/promis_misc/525444systematicreviewsguide.pdf.
26. The Morris worm: A fifteen-year perspective10.1109/MSECP.2003.1236233 ↗
27. Evolution of Malware Threats and Techniques: A Review
28. (2025, March 09). Executive Summary. Available online: https://en.wikipedia.org/wiki/Executive_summary.
29. Enhancing cloud security through the integration of deep learning and data mining techniques: A comprehensive review10.21533/pen.v11.i3.144 ↗
30. Clustered federated learning architecture for network anomaly detection in large scale heterogeneous IoT networks10.1016/j.cose.2023.103299 ↗
31. A Survey on Cross-Architectural IoT Malware Threat Hunting10.1109/ACCESS.2021.3091427 ↗
32. Technique for IoT Malware Detection Based on Control Flow Graph Analysis
33. An Automated Vision-Based Deep Learning Model for Efficient Detection of Android Malware Attacks10.1109/ACCESS.2022.3140341 ↗
34. EfficientNet Convolutional Neural Networks-Based Android Malware Detection10.1016/j.cose.2022.102622 ↗
35. Ullah, F., Alsirhani, A., Alshahrani, M., Alomari, A., Naeem, H., and Shah, S. (2022). Explainable Malware Detection System Using Transformers-Based Transfer Learning and Multi-Model Visual Representation. Sensors, 22.10.3390/s22186766 ↗
36. A Novel Deep Learning-Based Approach for Malware Detection10.1016/j.engappai.2023.106030 ↗
37. Malware Detection in Cloud Computing Infrastructures10.1109/TDSC.2015.2457918 ↗
38. Intelligent Behavior-Based Malware Detection System on Cloud Computing Environment10.1109/ACCESS.2021.3087316 ↗
39. Zero-Day Ransomware Attack Detection Using Deep Contractive Autoencoder and Voting Based Ensemble Classifier
40. KVMInspector: KVM Based introspection approach to detect malware in cloud environment
41. A Review of State-of-the-Art Malware Attack Trends and Defense Mechanisms10.1109/ACCESS.2023.3328351 ↗
42. Jang, S., Li, S., and Sung, Y. (2020). FastText-based local feature visualization algorithm for merged image-based malware classification framework for cyber security and cyber defense. Mathematics, 8.10.3390/math8030460 ↗
43. Choi, S. (2020). Combined kNN Classification and Hierarchical Similarity Hash for Fast Malware Detection. Appl. Sci., 10.10.3390/app10155173 ↗
44. Kumar, R., and Subbiah, G. (2022). Zero-Day Malware Detection and Effective Malware Analysis Using Shapley Ensemble Boosting and Bagging Approach. Sensors, 22.10.3390/s22072798 ↗
45. Application of Ensemble Learning Methods in Malware Detection
46. Prajapati, P., and Stamp, M. (2021). An Empirical Analysis of Image-Based Learning Techniques for Malware Classification. Malware Analysis Using Artificial Intelligence and Deep Learning, Springer.10.1007/978-3-030-62582-5_16 ↗
47. Functionality-Preserving Adversarial Machine Learning for Robust Classification in Cybersecurity and Intrusion Detection Domains: A Survey10.3390/jcp2010010 ↗
48. Adversarial Machine Learning Techniques for Robust Malware Detection
49. Learning Techniques-Based Malware Detection: A Comprehensive Review
50. Cyber Threat Intelligence: Challenges and Opportunities
51. Ferdous, J., Islam, R., Mahboubi, A., and Islam, M.Z. (2025). A Survey on ML Techniques for Multi-Platform Malware Detection: Securing PC, Mobile Devices, IoT, and Cloud Environments. Sensors, 25.10.3390/s25041153 ↗
52. An Ameliorated Multiattack Network Anomaly Detection in Distributed Big Data System-Based Enhanced Stacking Multiple Binary Classifiers10.1109/ACCESS.2022.3174482 ↗
53. Functionality-Preserving Adversarial Examples for Cybersecurity
54. Challenges in Adversarial Attacks on Intrusion Detection Systems
55. Functionality-Preserving Adversarial Attacks in Visual and Network Domains
56. Adversarial Examples: Surprising Robustness of Neural Networks in Cybersecurity
57. Functionality-preserving adversarial machine learning for robust classification in cybersecurity and intrusion detection domains: A survey
58. Systematic Review of Adversarial Attacks in Intrusion Detection
59. Attacks and Defenses in Intrusion Detection Systems: A Survey on the Adversarial Perspective
60. A Machine Learning-Based Framework for Ransomware Detection and Mitigation
61. Adversarial Detection in Intrusion Detection Systems: A Review
62. Boosting Training for PDF Malware Classifier via Active Learning10.1002/int.22451 ↗
63. Securing the Digital World: Protecting Smart Infrastructures and Digital Industries with Artificial Intelligence (AI)-Enabled Malware and Intrusion Detection
64. Kim, H.-m., and Lee, K.-h. (2022). IIoT Malware Detection Using Edge Computing and Deep Learning for Cybersecurity in Smart Factories. Appl. Sci., 12.10.3390/app12157679 ↗
65. Fileless Malware Threats: Recent Advances, Analysis Approach Through Memory Forensics and Research Challenges10.1016/j.eswa.2022.119133 ↗
66. Akhtar, M.S., and Feng, T. (2023). Evaluation of Machine Learning Algorithms for Malware Detection. Sensors, 23.10.3390/s23020946 ↗
67. Image-Based Malware Representation Approach with EfficientNet Convolutional Neural Networks for Effective Malware Classification
68. Mitigating Adversarial Evasion Attacks of Ransomware Using Ensemble Learning10.1016/j.compeleceng.2022.107903 ↗
69. Alqahtani, A., and Sheldon, F. (2022). A Survey of Crypto Ransomware Attack Detection Methodologies: An Evolving Outlook. Sensors, 22.10.3390/s22051837 ↗
70. An Effectiveness Analysis of Transfer Learning for the Concept Drift Problem in Malware Detection10.1016/j.eswa.2022.118724 ↗
71. Detection of Phishing Attacks Using Sequential and Parallel Machine Learning Techniques
72. Deep Learning Approaches for Malware Detection
73. Anomaly Detection in Networks Using Machine Learning
74. Detection of Cyber Attacks in IoT Environments Using Machine Learning Techniques
75. Detection of Ransomware Using Machine Learning Techniques
76. Nagy, N., Aljabri, M., Shaahid, A., Ahmed, A., Alnasser, F., Almakramy, L., Alhadab, M., and Alfaddagh, S. (2023). Phishing URLs Detection Using Sequential and Parallel ML Techniques: Comparative Analysis. Sensors, 23.10.3390/s23073467 ↗
77. Nashaat, M., Shahid, M., Nashaat, M., and Alshayeb, M. (2023). Distributed Deep Neural Network-Based Middleware for Cyber-Attacks Detection in Smart IoT Ecosystem: A Novel Framework and Performance Evaluation Approach. Electronics, 12.10.3390/electronics12020298 ↗
78. Phishing URLs Detection Using Machine Learning Techniques
79. Seneviratne, S., Shariffdeen, R., Rasnayaka, S., and Kasthuriarachchi, N. (2022). Self-Supervised Vision Transformers for Malware Detection. IEEE Access, 4.10.1109/ACCESS.2022.3206445 ↗
80. A Systematic Literature Review on the Cyber Security
81. Cyber security and information: A systematic literature review
82. Saeed, S., Suayyid, S.A., Al-Ghamdi, M.S., Al-Muhaisen, H., and Almuhaideb, A.M. (2023). A Systematic Literature Review on Cyber Threat Intelligence for Organizational Cybersecurity Resilience. Sensors, 23.10.3390/s23167273 ↗
83. Al-Haija, Q.A., Odeh, A., and Qattous, H. (2022). PDF Malware Detection Based on Optimizable Decision Trees. Electronics, 11.10.3390/electronics11193142 ↗
84. Peeking Inside the Black-Box: A Survey on Explainable Artificial Intelligence (XAI)10.1109/ACCESS.2018.2870052 ↗