Combining two different machine learning approaches helped researchers detect malicious files that a strong individual model missed, according to a study published in Scientific Reports on October 12.
The team paired a transformer called GT-Former with LightGBM, a gradient boosting model, by averaging their rankings of suspicious files.
On a Windows malware challenge set, detection rose from 63.2% to 68.8% at a 1% false-positive rate. Detection of malware from previously unseen families increased from 89.1% to 91.8%.
The research examined three benchmarks covering Windows files, Android applications and other formats. It also delivered a useful correction to assumptions about newer AI architectures: LightGBM remained the strongest standalone model at strict operating thresholds.
The gains came from combining complementary predictions.
A separate Android evaluation showed why deployment details matter. An apparent advantage under thresholds calibrated using later test data shrank to just 0.1 percentage points when the researchers fixed the threshold on validation data and applied it unchanged.
The findings support testing malware detectors against evasive files, unfamiliar families and changes over time, rather than relying on impressive average accuracy alone.