Malware detection using dynamic analysis with a modified Harris Hawk optimizer

The rapid advancement of technology has significantly enhanced innovation, productivity, and connectivity across industries but has also empowered cybercriminals to develop increasingly sophisticated malware. This advanced malware poses serious challenges to cybersecurity, as traditional detection methods often fail to recognize new, unknown, or obfuscated attacks. Dynamic Malware Analysis (DMA) offers a promising behavioral approach by observing program execution in a controlled environment; however, its effectiveness declines with large, high-dimensional data due to redundant and irrelevant features that increase computational overhead and reduce accuracy. To overcome these limitations, this study proposes an improved machine learning framework that integrates an enhanced Harris Hawks Optimizer (HHO) for efficient feature selection. The enhanced HHO employs a crossover mechanism and optimized initialization strategy to boost both computational performance and detection precision. Using the CIC-MalMem-2022 dataset, the framework was tested across multiple classifiers, demonstrating significant gains. Notably, Extra Trees and Random Forest achieved superior results, with accuracy improving from 99.96% to 100% and from 99.93% to 99.98%, respectively, confirming the robustness of the proposed approach.