Leveraging VAE-Derived Latent Spaces for Enhanced Malware Detection with Machine Learning Classifiers

2025-03-24

AI Summary

This study addresses the challenge of enhancing both accuracy and efficiency of lightweight classifiers in malware detection. We propose leveraging low-dimensional latent representations learned by Variational Autoencoders (VAEs) to replace or augment hand-crafted features. Specifically, VAEs automatically extract robust, compressed latent features from raw malware samples, which are then fed into five conventional classifiers: decision trees, naive Bayes, logistic regression, random forests, and LightGBM. Experimental results—first systematically reported in this context—demonstrate that VAE-derived latent features significantly improve detection accuracy across all classifiers (with LightGBM and random forests achieving peak performance), while substantially reducing computational overhead and hyperparameter tuning complexity. Statistical significance tests confirm the robustness and reliability of these improvements. Our key contribution is a deployment-friendly, “VAE + traditional classifier” paradigm that requires no fine-tuning of deep models, striking an effective balance among detection accuracy, inference efficiency, and practical deployability.

Technology Category

• Machine Learning: Multi-class/Multi-label Learning & Extreme Classification
• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Web Mining and Content Analysis: Large pretrained models with web data
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

This paper assesses the performance of five machine learning classifiers: Decision Tree, Naive Bayes, LightGBM, Logistic Regression, and Random Forest using latent representations learned by a Variational Autoencoder from malware datasets. Results from the experiments conducted on different training-test splits with different random seeds reveal that all the models perform well in detecting malware with ensemble methods (LightGBM and Random Forest) performing slightly better than the rest. In addition, the use of latent features reduces the computational cost of the model and the need for extensive hyperparameter tuning for improved efficiency of the model for deployment. Statistical tests show that these improvements are significant, and thus, the practical relevance of integrating latent space representation with traditional classifiers for effective malware detection in cybersecurity is established.

Problem

• Evaluating ML classifiers for malware detection using VAE latent spaces
• Comparing performance of ensemble methods in malware detection
• Reducing computational cost via latent features for efficient deployment

Innovation

• VAE-derived latent spaces enhance malware detection
• Ensemble methods outperform other classifiers
• Latent features reduce computational costs