An Insight into the Machine-Learning-Based Fileless Malware Detection - Sensors 2023

Aug 2, 2026

Malware growth has shifted attacker development from file-based methods toward fileless malware, enabling stealth against conventional defenses. File-based malware relies on spreading via files, while fileless malware operates through benign processes and focuses on main memory rather than the hard disk. The work explains fileless malware concepts, lifecycle, and infection chains, then introduces a machine-learning detection approach. Memory dumps are extracted with Volatility from malicious and benign executions, features are learned via classification with k-fold cross-validation, and Random Forest is identified as the best model, achieving 93.33% accuracy and 0% false positives on multiple datasets.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages20

Reading Time50 min

AccessFree to download

Abstract

1. Introduction

Malware threats and attack techniques

Fileless malware characteristics and infection paths

Defensive practices and detection limitations

Proposed ML-based detection approach

Memory acquisition and feature extraction

Machine learning classification and model selection

Experimental evaluation results

sensors Article An Insight into the Machine-Learning-Based Fileless Malware Detection Osama Khalid 1, Subhan Ullah 1, Tahir Ahmad 2, *, Saqib Saeed 3, Dina A. Alabbad 4, Mudassar Aslam 1, Attaullah Buriro 5 and Rizwan Ahmad 6 Citation: Khalid, O.; Ullah, S.; Ahmad, T.; Saeed, S.; Alabbad, D.A.; Aslam, M.; Buriro, A.; Ahmad, R. An Insight into the Machine-LearningBased Fileless Malware Detection. Sensors 2023, 23, 612. [https://](https://)[ ](https://)[doi.org/10.3390/s23020612](doi.org/10.3390/s23020612) Academic Editors: Nima Karimian and Hossein Sayadi Received: 29 November 2022 Revised: 28 December 2022 Accepted: 30 December 2022 Published: 5 January 2023 Copyright: © 2023 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license ([https://](https://)[ ](https://)[creativecommons.org/licenses/by/](creativecommons.org/licenses/by/)[ ](creativecommons.org/licenses/by/)[4.0/](4.0/)) . 1 FAST School of Computing, National University of Computer and Emerging Sciences (NUCES-FAST), Islamabad 44000, Pakistan 2 Center for Cybersecurity, Brunno Kessler Foundation, 38123 Trento, Italy 3 SAUDI ARAMCO Cybersecurity Chair, Department of Computer Information Systems, College of Computer Science and Information Technology, Imam Abdulrahman Bin Faisal University, P.O. Box 1982, Dammam 31441, Saudi Arabia 4 SAUDI ARAMCO Cybersecurity Chair, Department of Computer Engineering, College of Computer Science and Information Technology, Imam Abdulrahman Bin Faisal University, P.O. Box 1982, Dammam 31441, Saudi Arabia 5 Faculty of Computer Science, Free University Bozen-Bolzano, 39100 Bolzano, Italy 6 School of Electrical Engineering and Computer Science, National University of Sciences and Technology (NUST), Islamabad 44000, Pakistan * Correspondence: [ahmad@fbk.eu](ahmad@fbk.eu) Abstract: In recent years, massive development in the malware industry changed the entire landscape for malware development. Therefore, cybercriminals became more sophisticated by advancing their development techniques from ﬁle-based to ﬁleless malware. As ﬁle-based malware depends on ﬁles to spread itself, on the other hand, ﬁleless malware does not require a traditional ﬁle system and uses benign processes to carry out its malicious intent. Therefore, it evades conventional detection techniques and remains stealthy. This paper brieﬂy explains ﬁleless malware, its lifecycle, and its infection chain. Moreover, it proposes a detection technique based on feature analysis using machine learning for ﬁleless malware detection. The virtual machine acquired the memory dumps upon executing the malicious and non-malicious samples. Then the necessary features are extracted using the Volatility memory forensics tool, which is then analyzed using machine learning classiﬁcation algorithms. After that, the best algorithm is selected based on the k-fold cross-validation score. Experimental evaluation has shown that Random Forest outperforms other machine learning classiﬁers (Decision Tree, Support Vector Machine, Logistic Regression, K-Nearest Neighbor, XGBoost, and Gradient Boosting) . It achieved an overall accuracy of 93.33% with a True Positive Rate (TPR) of 87.5% at zeroFalse Positive Rate (FPR) for ﬁleless malware collected from ﬁve widely used datasets (VirusShare, AnyRun, PolySwarm, HatchingTriage, and JoESadbox) . Keywords: malware; ﬁlelss malware; volatility; cybercrimes; machine learning; memory forensics 1. Introduction Malware—a computer program that compromises a target system by infecting the other programs installed on that system [1], is a signiﬁcant threat to the security of individuals and organizations [1] . Malware could be used to steal sensitive data, disrupt operations, and cause damage to systems. In most cases, malicious programs are created to make illegal money by asking for ransomware in

FAQs

How does fileless malware differ from file-based malware in terms of infection and stealth?

Fileless malware does not rely on traditional files; it targets main memory and uses benign processes, which helps it evade detection methods that depend on identifying malicious disk files.

What is the detection workflow proposed for fileless malware?

The method runs malicious and non-malicious samples to acquire memory dumps, extracts features using the Volatility memory forensics tool, and then applies machine learning classification with k-fold cross-validation to select the best algorithm.

Which machine learning model performs best and what results were reported?

Random Forest outperforms the other tested classifiers and reports an overall accuracy of 93.33%, with a True Positive Rate of 87.5% and zero false positives at the evaluated setting for five datasets.

Aug 2, 2026

Upload by River Wang