Ricardo Sant'ANa

The increasing complexity of contemporary malware, driven by the use of advanced evasion and obfuscation techniques, combined with the rapid growth in the number of new variants emerging continuously, undermines the effectiveness of traditional signature-based detection mechanisms. In response to this scenario, this work proposes FORENSICS (Framework fOr malwaRe dEtectioN baSed on InstruCtion Sequences), an innovative deep learning-based framework that employs variable-length instruction sequences to detect malware efficiently and accurately. By integrating Natural Language Processing (NLP) techniques with Long Short-Term Memory (LSTM) neural networks, FORENSICS analyzes opcode sequences extracted from real-world malware and benign software artifacts. The framework introduces optimized methods for opcode extraction and representation, significantly reducing computational overhead while preserving detection performance. FORENSICS achieved 99.91% accuracy, 99.99% precision, and detection times ranging from 8 to 17 milliseconds, outperforming several state-of-the-art approaches across multiple metrics. Additionally, the framework demonstrated robustness in identifying zero-day malware samples, confirming its effectiveness in real-world cybersecurity scenarios. A new balanced dataset comprising over 40,000 labeled samples was created and made publicly available, facilitating reproducibility and encouraging further research. These results position FORENSICS as a robust, scalable, and highly effective solution for malware detection in modern threat landscapes.

After detecting a malicious artifact, classifying malware into specific families becomes an essential step to understand the threat's behavior, implement mitigation strategies, and develop proactive defenses. This task is particularly challenging due to the diversity of malware formats, the rapid evolution of obfuscation and packing techniques, as well as the scarcity of labeled data for training robust models. Additionally, the high volume of samples generated daily demands solutions that combine high accuracy and computational efficiency. Although transformer-based models are widely recognized as the state-of-the-art for sequence processing tasks, their high computational demands limit their practical application in resource-constrained environments. In this work, we present FORTUNATE, a lightweight framework that leverages LSTM networks with one-hot encoding to classify malware based on variable-length opcode sequences. The framework adopts an optimized opcode extraction process focused on reducing redundancies and representing data in compact vectors, minimizing computational costs. Experimental results indicate that FORTUNATE achieves accuracies of 99.82% for active malware and 99.81% for inactive malware, with an average classification time of only 56 ms per sample, significantly outperforming related works. The obtained results demonstrate that lightweight artificial intelligence approaches can deliver competitive performance in malware classification, especially in scenarios with computational constraints. FORTUNATE not only fills an important gap in malware classification but also establishes a foundation for future research aimed at optimizing the balance between accuracy, efficiency, and scalability.