Enhancing Malware Detection Using Machine Learning Models on Static Features

This research introduces a CPU-optimized static malware-detection framework for resource-constrained environments, such as endpoints and IoT devices. We address the significant challenge of high memory and computational demands by proposing a robust, memory-safe data ingestion pipeline. This pipeline exclusively extracts histogram-based static features, employs type compression, and utilizes batch-wise loading with global sample limits to prevent memory overflows on systems with only 16 GB of RAM and no GPU support. Our core contribution is a compact stacking ensemble composed of three high-efficiency gradient-boosting models: LightGBM, CatBoost, and XGBoost, with a LightGBM meta-learner. This novel ensemble structure enables efficient, CPU-only training and inference while ensuring strong detection performance. Evaluated on the EMBER 2024 dataset, the framework achieves 86.99% accuracy, 0.87 F1-score, and 0.9473 AUC. This work fills a critical gap by demonstrating that carefully optimized gradient-boosting ensembles can serve as a highly deployable alternative to resource-intensive Deep Learning methods in limited security situations.