Malware can leave different clues in what it does and what it stores in memory. Researchers have combined both in an AI detector that reported 98.6% accuracy on a dataset assembled from VirusTotal and CNET.
Published October 23 in Cybersecurity, the study pairs two ways of observing suspicious software. A sandbox records sequences of application programming interface calls, revealing how a program interacts with its environment. Separately, memory dumps collected from outside the virtual machine are converted into images.
A convolutional neural network analyzes those images, while a long short-term memory network processes the call sequences. The system then combines their learned representations to classify the software.
The reported advantage came from joining complementary evidence: the combined model outperformed approaches using a single type of feature.
That makes the work a useful addition to research on combining malware detectors, particularly as AI changes the cybersecurity threat landscape.
The result remains a dataset evaluation, rather than proof of protection against every unseen attack. For practical deployment, the central question is whether the gain survives changing malware families and operating conditions. Still, the approach offers a concrete route to better detection.