A novel framework for cross-platform malware detection via AFSP and ADASYN-based balancing

Abstract

The rapid spread of malware and the growing complexity of attack methods demand accurate and scalable detection solutions, particularly in classification techniques in which both feature selection and model selection play a critical role. However, malware datasets are often high-dimensional and imbalanced, leading to biased models and suboptimal classification performance. This paper introduces CMF, a novel cross-platform malware detection framework that integrates Adaptive Feature Selection and Projection (AFSP) for dimensionality reduction, Adaptive Synthetic Sampling (ADASYN) for data balancing, and voting ensemble learning for classification. ADASYN consistently outperforms SMOTE by adaptively oversampling hard-to-learn boundary regions, improving minority class detection. Meanwhile, AFSP preserves feature structures while reducing dimensions, while PCA only retains maximal variance directions, making AFSP more effective for malware classification. Extensive experiments on four comprehensive available malware datasets demonstrate that CMF outperforms traditional and deep learning-based approaches, achieving superior accuracy and robustness. Notably, the highest improvement was close to 5% compared to the state-of-the-art on the CIC-MalMem-2022 (16 classes) dataset. CMF framework is highly effective detection of malware variants across multiple operating systems, for instance Windows, Linux, and Android, and heterogeneous cloud environments. This confirms CMF framework as a scalable and high-performance solution for real-world malware detection across environmental diversity.