Delphi Scanner: efficient and interpretable static malware detection via API sequence modeling

2026-09-17

AI Summary

本文介绍Delphi Scanner，通过建模Windows API序列并使用CNN分类PE文件，结合规则层解释API行为，实现高效且可解释的静态恶意软件检测。

Abstract

Static malware detection for Windows Portable Executable files demands a careful balance between detection effectiveness, computational efficiency, and analytical interpretability. This paper introduces Delphi Scanner, a static malware detection system for Windows PE files that balances efficiency with behavioral interpretation. It uses a convolutional neural network (CNN) to model Windows API sequences to classify PE and a decoupled interpretation layer based on a rule-based layer to categorize APIs into high-level malicious capabilities. Evaluated on over 190,000 Windows PE files, the system achieves 95.35% accuracy with a 1.53~MB model footprint. Robustness experiments on 5,647 out-of-distribution MalwareBazaar samples, paired packed and unpacked executables, and three adversarial manipulation strategies confirm generalization beyond the training distribution and resistance to functionality-preserving evasion techniques. Overall, these results demonstrate that API sequence-based static analysis offers a practical, interpretable, and efficient foundation for malware triage in local deployment scenarios.

Problem

• static malware detection
• Windows PE files
• detection effectiveness
• computational efficiency
• analytical interpretability

Innovation

• convolutional neural network
• API sequence modeling
• decoupled interpretation layer
• static malware detection
• robustness