Delphi Scanner detects Windows malware with fast interpretable API analysis
Delphi Scanner: efficient and interpretable static malware detection via API sequence modeling
Cryptography and SecurityMachine Learning
Summary
Detecting malware without running programs is tricky because tools need to find bad files accurately, work fast, and explain why a file is suspicious. The authors created Delphi Scanner, which looks at the sequence of Windows functions a file wants to use to decide if it’s malware. Their method uses a neural network to classify files and a rule layer to explain malware behaviors. Tests on large and varied file sets show it works well, is small in size, and can resist tricks malware tries to hide.
What this means in practice
- •For cybersecurity teams: Deploy local malware scanning tools that quickly identify and explain suspicious Windows executables based on their API call patterns.
- •For security software developers: Integrate efficient, interpretable malware classification modules into antivirus software to improve accuracy and explanation of detection decisions.$Commercial implications: Enables development of commercial antivirus products with lightweight, explainable malware detection capabilities for Windows systems.
Authors
Bijied Brahimi, Vincent Cohadon, Gabriel Glazman, Rayan Al Mohaize, Omran Berjawi, Rida Khatoun
Abstract
Static malware detection for Windows Portable Executable files demands a careful balance between detection effectiveness, computational efficiency, and analytical interpretability. This paper introduces Delphi Scanner, a static malware detection system for Windows PE files that balances efficiency with behavioral interpretation. It uses a convolutional neural network (CNN) to model Windows API sequences to classify PE and a decoupled interpretation layer based on a rule-based layer to categorize APIs into high-level malicious capabilities. Evaluated on over 190,000 Windows PE files, the system achieves 95.35% accuracy with a 1.53~MB model footprint. Robustness experiments on 5,647 out-of-distribution MalwareBazaar samples, paired packed and unpacked executables, and three adversarial manipulation strategies confirm generalization beyond the training distribution and resistance to functionality-preserving evasion techniques. Overall, these results demonstrate that API sequence-based static analysis offers a practical, interpretable, and efficient foundation for malware triage in local deployment scenarios.