 ICACT20260118 Slide.01
[Big Slide]
[YouTube] |
Chrome  Click!! |
 |
Hello everyone, my name is Viren Passi. For ICACT 2026, I am presenting our paper, ID 20260118, titled Ensemble-Driven Malware Detection with Anomaly Override Capabilities. This research is a collaboration with Dr. Sudhakar Kumar, Prof. Sunil K. Singh, and Mr. Shivam Jindal from Chandigarh College of Engineering and Technology, India. Our talk today focuses on a novel hybrid framework designed to significantly improve malware detection accuracy. |
| ICACT20260118 Slide.02
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
We started by analyzing the problem: malware is evolving faster than traditional defenses. With the rise of IoT and cloud computing, the attack surface has expanded dramatically. Traditional signature-based detection is failing against new, obfuscated threats, and standard single-classifier models often struggle to generalize across different malware families. |
| ICACT20260118 Slide.03
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
To solve this, we created a Smarter Together approach. As shown here, our framework combines two layers: an ensemble of Random Forest and XGBoost to classify known patterns, and an Anomaly Override using Isolation Forest. This hybrid model achieves 91.49% accuracy, significantly outperforming its individual components. |
| ICACT20260118 Slide.04
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Our primary goal was to engineer a superior hybrid detection system. Our key contributions include: a novel framework integrating three powerful algorithms, an intelligent feature selection process to boost learning efficiency, and a demonstrably superior performance compared to standalone classifiers. |
| ICACT20260118 Slide.05
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Good AI needs clean data. We used the Microsoft Malware Sample Dataset, starting with 257 features. To reduce noise, we applied a hybrid strategy using Mutual Information and ANOVA F-score. This filtered the data down to the top 50 most informative features, which improved both speed and performance. |
| ICACT20260118 Slide.06
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
This technical dossier provides a deeper look at our foundation. We worked with over 12,000 total samples across 9 distinct malware families, such as Ramnit and Vundo. Our objective was to support robust multi-class classification with a moderately balanced distribution of data. |
| ICACT20260118 Slide.07
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Here is how we partitioned the data. We used a standard 80-20 split. The training set includes labeled ground-truth samples, while the evaluation set contains nearly 11,000 unseen samples. We also applied zero-based indexing and dropped non-informative columns during preprocessing. |
| ICACT20260118 Slide.08
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
This is the blueprint of our two-stage architecture. Stage 1 is Ensemble Classification, where features are processed by Random Forest and XGBoost. Stage 2 is the Anomaly Override using Isolation Forest. Their outputs merge through a logic gate to reach the final malicious or benign decision. |
| ICACT20260118 Slide.09
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
For our experimental setup, we used a Linux-based environment with the Python Scikit-learn framework. Our validation protocol ensured all performance metrics were calculated strictly on unseen data. Our ultimate objective was to maximize accuracy while minimizing false negatives, which are critical in security. |
| ICACT20260118 Slide.10
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
In Stage 1, we fused predictions from two powerful models. We optimized Random Forest for robustness and XGBoost for its ability to generalize structured data. By averaging their output probabilities, we created a combined prediction vector that is more stable than any single model. |
| ICACT20260118 Slide.11
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
To create this soft decision, we used the formula shown here, where the hybrid probability is the average of RF and XGBoost probabilities. This combined vector reduces variance and helps mitigate the specific weaknesses or biases of individual models. |
| ICACT20260118 Slide.12
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Stage 2 deploys the Anomaly Override to catch what the ensemble might miss. If the Isolation Forest computes an anomaly score of -1, the system immediately overrides the ensemble and classifies the sample as malware. If it’s not an anomaly, we trust the ensembles prediction. |
| ICACT20260118 Slide.13
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
This schematic illustrates how the Isolation Forest works. While supervised models only recognize patterns they were trained on, the Isolation Forest identifies outliers based on attribute distribution. It rapidly isolates anomalies using fewer slices than normal data clusters, making it a perfect tool for zero-day threats. |
| ICACT20260118 Slide.14
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
We first established a baseline with individual models. Standalone Random Forest achieved 78.54% accuracy, while XGBoost achieved 72.91%. These results confirmed that while these models are useful, they struggle with the full complexity of modern malware on their own. |
| ICACT20260118 Slide.15
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Our hybrid framework demonstrates a significant leap in performance. By adding the anomaly override, accuracy jumped to 91.49%. As the orange bar shows, our method outperforms the standalone baselines by a wide margin, proving the strength of the combined approach. |
| ICACT20260118 Slide.16
[Big Slide]
|
Chrome Click!! |
 |
This matrix shows high precision across malware classes. The strong diagonal indicates a high number of true positives. For example, in Class 2, the model correctly identified all 54 samples with no errors, demonstrating very low confusion between different malware families. |
| ICACT20260118 Slide.17
[Big Slide]
|
Chrome Click!! |
 |
Our ROC curve confirms the model’s discriminatory power. With an Area Under the Curve (AUC) of 0.88, our model sits significantly above the random baseline. This confirms a robust ability to distinguish between malware classes across all classification thresholds. |
| ICACT20260118 Slide.18
[Big Slide]
|
Chrome Click!! |
 |
The success of our framework is a direct result of its hybrid design. The Ensemble layer creates a stable, generalized decision that smooths out errors. Meanwhile, the Anomaly Override acts as a safety net for novel threats, boosting resilience and systematically reducing false negatives. |
| ICACT20260118 Slide.19
[Big Slide]
|
Chrome Click!! |
 |
This slide summarizes the mathematical logic flow of our prediction mechanism. We first compute the anomaly score; if it meets the override rule of -1, the system forces a malware classification. This Priority Interrupt ensures that statistical outliers are always treated as threats. |
| ICACT20260118 Slide.20
[Big Slide]
|
Chrome Click!! |
 |
In summary, we achieved 91.49% accuracy and a 0.91 F1-score, significantly outperforming standalone models. Moving forward, we plan to incorporate dynamic behavioral properties for even more sophisticated analysis and test the framework on live malware traffic to evaluate real-time threat detection. |
| ICACT20260118 Slide.21
[Big Slide]
|
Chrome Click!! |
 |
Thank you all for your attention. We are now open to any questions you may have. |
