[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-118398-en":3,"doc-seo-118398-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},118398,1099514067438,"River Wang","https://ap-avatar.wpscdn.com/avatar/100002539ee87300030?x-image-process=image/resize,m_fixed,w_180,h_180&k=1780474512215547542",6,"Technology","An Insight into the Machine-Learning-Based Fileless Malware Detection - Sensors 2023","Malware growth has shifted attacker development from file-based methods toward fileless malware, enabling stealth against conventional defenses. File-based malware relies on spreading via files, while fileless malware operates through benign processes and focuses on main memory rather than the hard disk. The work explains fileless malware concepts, lifecycle, and infection chains, then introduces a machine-learning detection approach. Memory dumps are extracted with Volatility from malicious and benign executions, features are learned via classification with k-fold cross-validation, and Random Forest is identified as the best model, achieving 93.33% accuracy and 0% false positives on multiple datasets.","sensors   \nArticle  \nAn Insight into the Machine-Learning-Based Fileless Malware Detection  \nOsama Khalid 1, Subhan Ullah 1, Tahir Ahmad 2, *, Saqib Saeed 3, Dina A. Alabbad 4, Mudassar Aslam 1, Attaullah Buriro 5 and Rizwan Ahmad 6  \nCitation: Khalid, O.; Ullah, S.;  \nAhmad, T.; Saeed, S.; Alabbad, D.A.; Aslam, M.; Buriro, A.; Ahmad, R. An Insight into the Machine-LearningBased Fileless Malware Detection. Sensors 2023, 23, 612. [https://](https://)[ ](https://)[doi.org/10.3390/s23020612](doi.org/10.3390/s23020612)  \nAcademic Editors: Nima Karimian and Hossein Sayadi  \nReceived: 29 November 2022  \nRevised: 28 December 2022  \nAccepted: 30 December 2022  \nPublished: 5 January 2023  \nCopyright: © 2023 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license ([https://](https://)[ ](https://)[creativecommons.org/licenses/by/](creativecommons.org/licenses/by/)[ ](creativecommons.org/licenses/by/)[4.0/](4.0/)) .  \n1 FAST School of Computing, National University of Computer and Emerging Sciences (NUCES-FAST), Islamabad 44000, Pakistan  \n2 Center for Cybersecurity, Brunno Kessler Foundation, 38123 Trento, Italy  \n3 SAUDI ARAMCO Cybersecurity Chair, Department of Computer Information Systems, College of Computer Science and Information Technology, Imam Abdulrahman Bin Faisal University, P.O. Box 1982, Dammam 31441, Saudi Arabia  \n4 SAUDI ARAMCO Cybersecurity Chair, Department of Computer Engineering, College of Computer Science and Information Technology, Imam Abdulrahman Bin Faisal University, P.O. Box 1982, Dammam 31441, Saudi Arabia  \n5 Faculty of Computer Science, Free University Bozen-Bolzano, 39100 Bolzano, Italy  \n6 School of Electrical Engineering and Computer Science, National University of Sciences and Technology (NUST), Islamabad 44000, Pakistan  \n* Correspondence: [ahmad@fbk.eu](ahmad@fbk.eu)  \nAbstract: In recent years, massive development in the malware industry changed the entire landscape for malware development. Therefore, cybercriminals became more sophisticated by advancing their development techniques from file-based to fileless malware. As file-based malware depends on files to spread itself, on the other hand, fileless malware does not require a traditional file system and uses benign processes to carry out its malicious intent. Therefore, it evades conventional detection techniques and remains stealthy. This paper briefly explains fileless malware, its lifecycle, and its infection chain. Moreover, it proposes a detection technique based on feature analysis using machine learning for fileless malware detection. The virtual machine acquired the memory dumps upon executing the malicious and non-malicious samples. Then the necessary features are extracted using the Volatility memory forensics tool, which is then analyzed using machine learning classification algorithms. After that, the best algorithm is selected based on the k-fold cross-validation score. Experimental evaluation has shown that Random Forest outperforms other machine learning classifiers (Decision Tree, Support Vector Machine, Logistic Regression, K-Nearest Neighbor, XGBoost, and Gradient Boosting) . It achieved an overall accuracy of 93.33% with a True Positive Rate (TPR) of 87.5% at zeroFalse Positive Rate (FPR) for fileless malware collected from five widely used datasets (VirusShare, AnyRun, PolySwarm, HatchingTriage, and JoESadbox) .  \nKeywords: malware; filelss malware; volatility; cybercrimes; machine learning; memory forensics  \n1. Introduction  \nMalware—a computer program that compromises a target system by infecting the other programs installed on that system [1], is a significant threat to the security of individuals and organizations [1] . Malware could be used to steal sensitive data, disrupt operations, and cause damage to systems. In most cases, malicious programs are created to make illegal money by asking for ransomware in ","cbCaimclrG6xVC0z","https://ap.wps.com/l/cbCaimclrG6xVC0z","pdf",1496220,1,20,"English","en",105,"# Abstract\n# 1. Introduction\n## Malware threats and attack techniques\n## Fileless malware characteristics and infection paths\n## Defensive practices and detection limitations\n# Proposed ML-based detection approach\n## Memory acquisition and feature extraction\n## Machine learning classification and model selection\n## Experimental evaluation results","[{\"question\":\"How does fileless malware differ from file-based malware in terms of infection and stealth?\",\"answer\":\"Fileless malware does not rely on traditional files; it targets main memory and uses benign processes, which helps it evade detection methods that depend on identifying malicious disk files.\"},{\"question\":\"What is the detection workflow proposed for fileless malware?\",\"answer\":\"The method runs malicious and non-malicious samples to acquire memory dumps, extracts features using the Volatility memory forensics tool, and then applies machine learning classification with k-fold cross-validation to select the best algorithm.\"},{\"question\":\"Which machine learning model performs best and what results were reported?\",\"answer\":\"Random Forest outperforms the other tested classifiers and reports an overall accuracy of 93.33%, with a True Positive Rate of 87.5% and zero false positives at the evaluated setting for five datasets.\"}]","An Insight into the Machine-Learning-Based Fileless Malware Detection - Sensors 2023 | PDF",1785683433,50,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"an-insight-into-the-machine-learning-based-fileless-malware-detection-sensors-2023","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/technology/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/an-insight-into-the-machine-learning-based-fileless-malware-detection-sensors-2023/118398/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-02",true,{"@type":65,"interactionType":66,"userInteractionCount":4},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"How does fileless malware differ from file-based malware in terms of infection and stealth?","Question",{"text":75,"@type":76},"Fileless malware does not rely on traditional files; it targets main memory and uses benign processes, which helps it evade detection methods that depend on identifying malicious disk files.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What is the detection workflow proposed for fileless malware?",{"text":80,"@type":76},"The method runs malicious and non-malicious samples to acquire memory dumps, extracts features using the Volatility memory forensics tool, and then applies machine learning classification with k-fold cross-validation to select the best algorithm.",{"name":82,"@type":73,"acceptedAnswer":83},"Which machine learning model performs best and what results were reported?",{"text":84,"@type":76},"Random Forest outperforms the other tested classifiers and reports an overall accuracy of 93.33%, with a True Positive Rate of 87.5% and zero false positives at the evaluated setting for five datasets.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,112,117,122,126,129,133],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":29,"slug":111},"technology",{"id":113,"doc_module":4,"doc_module_name":46,"category_name":114,"show_sort_weight":115,"slug":116},7,"Healthcare",40,"healthcare",{"id":118,"doc_module":4,"doc_module_name":46,"category_name":119,"show_sort_weight":120,"slug":121},8,"Research & Report",30,"research-report",{"id":123,"doc_module":4,"doc_module_name":46,"category_name":124,"show_sort_weight":21,"slug":125},9,"Religion & Spirituality","religion-spirituality",{"id":21,"doc_module":4,"doc_module_name":46,"category_name":127,"show_sort_weight":21,"slug":128},"World Cup","world-cup",{"id":130,"doc_module":4,"doc_module_name":46,"category_name":131,"show_sort_weight":130,"slug":132},10,"Lifestyle","lifestyle",{"id":134,"doc_module":4,"doc_module_name":46,"category_name":135,"show_sort_weight":106,"slug":136},19,"General","general"]