SHAP-Guided Feature Refinement for Robust and Interpretable Malware Detection in Memory Forensics

SHAP-Guided Feature Refinement for Robust and Interpretable Malware Detection in Memory Forensics | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article SHAP-Guided Feature Refinement for Robust and Interpretable Malware Detection in Memory Forensics Isaac Kofi Nti, Owusu Nyarko-Boateng This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-7871553/v1 This work is licensed under a CC BY 4.0 License Status: Under Revision Version 1 posted 10 You are reading this latest preprint version Abstract The advancement in malware poses a major challenge to traditional detection methods, especially those that rely on static analysis and signature-based techniques. This study investigates a memory forensics-driven framework that combines feature engineering, explainability, and adversarial robustness analysis for malware detection. Using the CIC MalMem-2022 dataset, we analyzed 55 memory-resident features and refined them to 13 through mutual information and a novel SHAP-guided feature refinement (SHAP-GFR) process. We evaluated five models, namely Random Forest, XGBoost, Multilayer Perceptron (MLP), 1 Dimensional Convolutional Neural Network (1D CNN), and a CNN–Long Short-Term Memory (CNN-LSTM) hybrid under a 70:15:15 train/validation/test split. All models achieved high accuracy on clean data, with XGBoost reaching 99.98% at minimal latency (4.68 ms). Our SHAP and LIME analyses showed that service and handle-related features were very key in malware identification. Models’ robustness testing under Gaussian noise, Fast Gradient Sign Method (FGSM), and Projected Gradient Descent (PGD) revealed that while tree-based models’ performance decreased substantially, convolutional architectures (1D CNN) maintained strong performance (≈ 3% F1 drop). Leave-One-Family-Out (LOFO) validation demonstrated strong cross-family generalization. Our findings showed that tree ensembles were better at detecting attacks from entirely new malware families, while CNNs proved more effective against adversarial obfuscation. This work, therefore, establishes a new framework for evaluating malware detection systems. We provide a more comprehensive set of guidelines by focusing on efficiency, interpretability, and robustness for building systems that are not only accurate but also lightweight and resilient enough for real-world deployment. . Memory-forensic malware detection SHAP-guided feature selection Explainable AI for cybersecurity Adversarial robustness Machine learning in adversarial environments Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Under Revision Version 1 posted Editorial decision: Revision requested 09 Jan, 2026 Reviews received at journal 01 Dec, 2025 Reviews received at journal 08 Nov, 2025 Reviewers agreed at journal 07 Nov, 2025 Reviewers agreed at journal 07 Nov, 2025 Reviewers agreed at journal 05 Nov, 2025 Reviewers invited by journal 05 Nov, 2025 Editor assigned by journal 03 Nov, 2025 Submission checks completed at journal 16 Oct, 2025 First submitted to journal 15 Oct, 2025 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-7871553","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":541946731,"identity":"5e9cf214-40df-4d02-96ec-5ec7c9225df2","order_by":0,"name":"Isaac Kofi Nti","email":"","orcid":"","institution":"University of Cincinnati","correspondingAuthor":false,"prefix":"","firstName":"Isaac","middleName":"Kofi","lastName":"Nti","suffix":""},{"id":541946732,"identity":"2a048902-8bf6-4190-83c8-f084b8f4adc3","order_by":1,"name":"Owusu Nyarko-Boateng","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAw0lEQVRIiWNgGAWjYDACCQhV3w8iEwpI0MI4swGkxYAULRsOgChitJhLNx+T5vlzmNn4/OrEDw8MGOT5xQ7g12I551iaNG/bYTazG283SwAdZjhzdgJ+LQY3csxu8zYc5jG7cXYDSEuCwW1itAAdJmE84+zmHyRoYTtsYMDfu41IW+4cS/85ty09QeIG7zaLBAMJIvxyu/mwwZs/1gn8/Wc33/xRYSPPL01ACwJIgFVKEKscBPgPkKJ6FIyCUTAKRhIAAC8sRiI9D6nfAAAAAElFTkSuQmCC","orcid":"","institution":"University of Energy and Natural Resources Sunyani","correspondingAuthor":true,"prefix":"","firstName":"Owusu","middleName":"","lastName":"Nyarko-Boateng","suffix":""}],"badges":[],"createdAt":"2025-10-15 20:38:17","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-7871553/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-7871553/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":96243951,"identity":"2dc8485b-a86e-4eb6-9414-af91120d818f","added_by":"auto","created_at":"2025-11-19 07:17:22","extension":"docx","order_by":0,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":7416234,"visible":true,"origin":"","legend":"","description":"","filename":"ManuscriptV1.5Details.docx","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/1311534e75acd310bf3eb389.docx"},{"id":95957828,"identity":"83f5bf8b-27dc-4934-bc4b-bad4553f92ef","added_by":"auto","created_at":"2025-11-14 23:19:10","extension":"json","order_by":1,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":4864,"visible":true,"origin":"","legend":"","description":"","filename":"fddadc6c4622477d994165ee139c8de4.json","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/a3c051bc8b23850f37b6e541.json"},{"id":96245337,"identity":"eda6b7ba-6910-47d5-8dbc-f1c4dd5fb339","added_by":"auto","created_at":"2025-11-19 07:20:23","extension":"xml","order_by":2,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":220594,"visible":true,"origin":"","legend":"","description":"","filename":"fddadc6c4622477d994165ee139c8de41enriched.xml","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/673b6a59dc670fda7c9fced8.xml"},{"id":95957832,"identity":"8efd6d55-2039-4f55-a9d9-582671a91247","added_by":"auto","created_at":"2025-11-14 23:19:10","extension":"eps","order_by":3,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":205,"visible":true,"origin":"","legend":"","description":"","filename":"drawingimage1.eps","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/c9e2c68e6ded3d1177d30628.eps"},{"id":96246044,"identity":"c9cb4e92-afc0-47a7-96e7-1fa25771f079","added_by":"auto","created_at":"2025-11-19 07:24:20","extension":"eps","order_by":4,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":205,"visible":true,"origin":"","legend":"","description":"","filename":"drawingimage1.eps","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/1457a6d909efa03bf0bd1b78.eps"},{"id":95957829,"identity":"0c6295a5-9646-4037-af39-b62742bea07b","added_by":"auto","created_at":"2025-11-14 23:19:10","extension":"eps","order_by":5,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":205,"visible":true,"origin":"","legend":"","description":"","filename":"drawingimage1.eps","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/3d29c441f58fe706e592063a.eps"},{"id":96244501,"identity":"d1243a1f-c3d4-4a60-95ae-6d4d056f495c","added_by":"auto","created_at":"2025-11-19 07:18:38","extension":"eps","order_by":6,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":49801,"visible":true,"origin":"","legend":"","description":"","filename":"drawingimage4.eps","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/3573aa8c4572ac4d53d7e813.eps"},{"id":96245597,"identity":"91918850-3f24-452b-8cc9-65524fac4d76","added_by":"auto","created_at":"2025-11-19 07:21:12","extension":"eps","order_by":7,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":49242,"visible":true,"origin":"","legend":"","description":"","filename":"drawingimage5.eps","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/0d9e8f384ab9558c47bfd3ab.eps"},{"id":95957836,"identity":"10235856-5bf8-4329-b3e7-d1607c7340fe","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"eps","order_by":8,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":54295,"visible":true,"origin":"","legend":"","description":"","filename":"drawingimage6.eps","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/fa118bf9ab7803102f831656.eps"},{"id":95957838,"identity":"0f8efb0b-fced-47b1-8a54-04aa43de6ea2","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"emf","order_by":9,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":17472,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage1.emf","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/6a8220de992b2a989d1c733b.emf"},{"id":95957845,"identity":"56d1f751-a278-41c8-a379-9939648a867b","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":10,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":19820,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage10.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/ce506be5141d0e04cbdab385.png"},{"id":96245255,"identity":"34fba818-9b20-4c4b-a498-f82d9991908d","added_by":"auto","created_at":"2025-11-19 07:20:09","extension":"png","order_by":11,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":22850,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage11.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/98d53358c7b444f26437f850.png"},{"id":95957840,"identity":"77b8ffc0-3b07-4078-ad68-28d25869283f","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":12,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":46703,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage12.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/7c4a901afe88b93c5b433358.png"},{"id":95957874,"identity":"6a453f77-871d-4769-8f1a-6090591f69f4","added_by":"auto","created_at":"2025-11-14 23:19:12","extension":"png","order_by":13,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":49508,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage13.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/51ef0373f4c727a0455867ee.png"},{"id":95957835,"identity":"2ff679fb-5009-49d8-85c6-fc2d5822677e","added_by":"auto","created_at":"2025-11-14 23:19:10","extension":"png","order_by":14,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":29649,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage14.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/5acf862bcd25c0be5c52fbf3.png"},{"id":95957868,"identity":"bd217eed-c58d-4e1a-b2e4-c4ab5cdc5287","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":15,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":77253,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage15.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/a2ad88afdeac777bb56f5c37.png"},{"id":95957843,"identity":"379498c9-42b1-4679-b132-520a2e2df3e6","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":16,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":68904,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage16.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/2892f2887f731f62b8d99d6d.png"},{"id":95957848,"identity":"af85e2ab-9d59-41a6-8d94-2cc0190261be","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":17,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":52954,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage17.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/72797785bc148840f55b2be2.png"},{"id":95957877,"identity":"e390a667-3d11-4a66-8744-649ed0eac5f7","added_by":"auto","created_at":"2025-11-14 23:19:12","extension":"png","order_by":18,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":92390,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage18.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/0a35afbfa8ad631bd2ed7e85.png"},{"id":96246244,"identity":"d524b44f-d01b-4ef0-969b-bb61cb3ae3d3","added_by":"auto","created_at":"2025-11-19 07:25:10","extension":"png","order_by":19,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":140643,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage19.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/3a10229c848315c5f2fae50d.png"},{"id":95957853,"identity":"869e2a45-651d-47c6-a1df-b225f81ee223","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":20,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":28892,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage2.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/7ca0fa78a97f6b198af4b4b5.png"},{"id":95957862,"identity":"1f721c59-964f-405e-8bb6-c7be19fa44cc","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":21,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":61310,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage20.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/5e315ee5c388055564db42d8.png"},{"id":96245646,"identity":"0c0e362a-db48-4fdd-bf74-3b805a936d60","added_by":"auto","created_at":"2025-11-19 07:21:31","extension":"png","order_by":22,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":60316,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage21.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/d06d1f930245a4a91acb9746.png"},{"id":96245426,"identity":"f4a5123b-3bb0-4410-92bf-c627ddbe2426","added_by":"auto","created_at":"2025-11-19 07:20:37","extension":"png","order_by":23,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":61189,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage22.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/9caa0b23c519ddda88174d9a.png"},{"id":95957850,"identity":"74911cc9-11a7-4b18-a02d-02cd7cf9d2d9","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"jpeg","order_by":24,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":5245,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage23.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/f5d6c3a022631a09339b0ebe.jpeg"},{"id":95957846,"identity":"0a32c56a-8ae3-4847-a290-51e6aa171319","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":25,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":25395,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage3.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/a39849c225a5fda7c277be5b.png"},{"id":95957849,"identity":"e0e9ea5c-65a9-4ddc-8f32-4ad3152d8857","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":26,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":19086,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage4.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/2259969dea3c82b5d468639f.png"},{"id":95957841,"identity":"5cc5e419-f119-432b-906f-75031d9c115d","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":27,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":31387,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage5.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/55e6c6cb10137d48b23aebc0.png"},{"id":95957844,"identity":"5d89491a-56ad-41b5-9826-35c83d96e51d","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":28,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":13645,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage6.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/6b946daedda650f69fb0cfde.png"},{"id":95957847,"identity":"f9c42948-15f6-47b5-9efa-2fe6736e2b34","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":29,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":16159,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage7.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/ccb010234504d923413a8f23.png"},{"id":96245076,"identity":"dc20b77c-242b-48d4-9ca6-00915de0caf5","added_by":"auto","created_at":"2025-11-19 07:19:49","extension":"png","order_by":30,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":12361,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage8.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/c4a64e63f08e8e0d42a8bbf6.png"},{"id":95957855,"identity":"7f2f162a-e670-4b07-bd42-d2545ed54973","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":31,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":18232,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage9.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/031eb083c6ae0057a294e993.png"},{"id":95957871,"identity":"0464f046-6b28-4df5-ba6e-47f66f82c8a4","added_by":"auto","created_at":"2025-11-14 23:19:12","extension":"png","order_by":32,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":4830,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage1.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/9fac5830ec1e2de4abfd6f5f.png"},{"id":96245378,"identity":"9ba59300-01f9-4215-b465-1ba6356b3599","added_by":"auto","created_at":"2025-11-19 07:20:31","extension":"png","order_by":33,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":5136,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage10.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/6666e9f790833ff300b3c631.png"},{"id":95957852,"identity":"0300739a-cf0c-4455-8ee0-dec5a22593f7","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":34,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":5500,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage11.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/0b53c641470eeb156c283aad.png"},{"id":95957857,"identity":"2ba10398-0ce0-4b4d-a658-b5ac5bcc5eab","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":35,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":11849,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage12.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/c6af9204cbfd9d9cf40cb582.png"},{"id":95957870,"identity":"d33643ab-150a-4915-b4c3-aecc9c54fb2e","added_by":"auto","created_at":"2025-11-14 23:19:12","extension":"png","order_by":36,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":12863,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage13.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/284bb94c0f44dd5ccadfd443.png"},{"id":95957860,"identity":"b410c209-c461-431f-8f88-648dc6b9ed40","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":37,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":14067,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage14.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/5b945e77d0f0fd4910ce8733.png"},{"id":95957872,"identity":"a8c5afe3-e271-4e95-980c-500c43ac52a3","added_by":"auto","created_at":"2025-11-14 23:19:12","extension":"png","order_by":38,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":17715,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage15.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/03ba2a3e5cce7f2eedb0a82b.png"},{"id":95957873,"identity":"9dde5f24-7f87-4f87-b1f8-2a10ae7ef355","added_by":"auto","created_at":"2025-11-14 23:19:12","extension":"png","order_by":39,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":14198,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage16.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/f9183c67d0728714c0b9c2c5.png"},{"id":95957851,"identity":"eeabca9d-a2c4-4cd5-a539-994ace9b5376","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":40,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":11073,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage17.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/9e13ffafac4a5c66a916807e.png"},{"id":96245352,"identity":"93560017-e5fe-4c6f-98b9-3f3dfb384524","added_by":"auto","created_at":"2025-11-19 07:20:25","extension":"png","order_by":41,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":28375,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage18.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/b745ea56dad15aa22bb79f2f.png"},{"id":96246194,"identity":"15e5bccd-36da-48c9-8e55-4c3c3f460062","added_by":"auto","created_at":"2025-11-19 07:25:02","extension":"png","order_by":42,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":33527,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage19.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/7701ba6dc5ae38053eb52bf3.png"},{"id":95957861,"identity":"cf88a4ca-c4ae-4324-86a6-859c450d69c2","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":43,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":16236,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage2.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/29f5700662b443cff94c6655.png"},{"id":95957875,"identity":"42c4c3d1-10b8-41d3-b8d8-c2f17a88e767","added_by":"auto","created_at":"2025-11-14 23:19:12","extension":"png","order_by":44,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":26088,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage20.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/19bcfd8b62c2f62a3b795f04.png"},{"id":95957878,"identity":"ea7420ce-64b1-48c0-84ad-96ed3bcfb4e2","added_by":"auto","created_at":"2025-11-14 23:19:12","extension":"png","order_by":45,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":26169,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage21.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/0bce108e63f5dc617a1997ad.png"},{"id":96244807,"identity":"e557441b-9952-402f-a9c5-42f17686a94b","added_by":"auto","created_at":"2025-11-19 07:19:17","extension":"png","order_by":46,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":26070,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage22.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/75c1061dfcdb59338849122d.png"},{"id":95957864,"identity":"83a90484-ddb4-4840-a7e5-e0e9b46bf342","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":47,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":1945,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage23.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/ecbab920deede8bfb03258c3.png"},{"id":96245260,"identity":"0a989358-482b-4dad-9137-a897c0132f33","added_by":"auto","created_at":"2025-11-19 07:20:10","extension":"png","order_by":48,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":6004,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage3.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/43bdc495a0da12deb9e8309a.png"},{"id":95957869,"identity":"b1b90fa1-8da9-4c36-8d12-4e5a9b0cf26f","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":49,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":4937,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage4.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/918402f569577b8e28e9a9db.png"},{"id":95957858,"identity":"8166b1f7-c5d7-4956-a1c3-4993ad918a57","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":50,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":7904,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage5.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/12b88031d0eb5e37265cb390.png"},{"id":95957867,"identity":"08462380-a22b-41b0-9581-19e58264ed9b","added_by":"auto","created_at":"2025-11-14 23:19:11","extension":"png","order_by":51,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":3216,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage6.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/a8f9d0e268574a4b0c42bf1e.png"},{"id":95957882,"identity":"57af7f7a-51d6-4de1-be2a-7ab005168055","added_by":"auto","created_at":"2025-11-14 23:19:12","extension":"png","order_by":52,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":4922,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage7.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/fca510fae0fddbcdd9b7426e.png"},{"id":95957881,"identity":"7354fba3-21a8-4df7-841b-9ae1b131eb01","added_by":"auto","created_at":"2025-11-14 23:19:12","extension":"png","order_by":53,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":3415,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage8.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/fd0993ab285d0ec861cc681a.png"},{"id":96245870,"identity":"99ec53e8-b5b4-41e8-b1d6-67fb2a943e42","added_by":"auto","created_at":"2025-11-19 07:23:22","extension":"png","order_by":54,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":4700,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage9.png","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/f7dbaef6675a2f05a068c6db.png"},{"id":96245607,"identity":"c0800406-8607-4068-a6fe-3b1adf6bb474","added_by":"auto","created_at":"2025-11-19 07:21:15","extension":"xml","order_by":55,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":222754,"visible":true,"origin":"","legend":"","description":"","filename":"fddadc6c4622477d994165ee139c8de41structuring.xml","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/9efbefd58d34d43697fb6d66.xml"},{"id":95957883,"identity":"af04de7e-194d-4f90-8b9d-af1b94f62b76","added_by":"auto","created_at":"2025-11-14 23:19:12","extension":"html","order_by":56,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":245592,"visible":true,"origin":"","legend":"","description":"","filename":"earlyproof.html","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1/0fd10c9d6fcf639f27047636.html"},{"id":96255939,"identity":"fb121a1b-7c33-4bb5-8dcc-7635038f7a13","added_by":"auto","created_at":"2025-11-19 07:49:09","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1261448,"visible":true,"origin":"","legend":"","description":"","filename":"ManuscriptV1.5Details.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7871553/v1_covered_ce03373e-ad30-4e5b-ad5e-aa76fa492963.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"SHAP-Guided Feature Refinement for Robust and Interpretable Malware Detection in Memory Forensics","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"eurasip-journal-on-information-security","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"jins","sideBox":"Learn more about [EURASIP Journal on Information Security](https://jis-eurasipjournals.springeropen.com/)","snPcode":"13635","submissionUrl":"https://submission.nature.com/new-submission/13635/3","title":"EURASIP Journal on Information Security","twitterHandle":"@SpringerEng","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"BMC/SO AJ","inReviewEnabled":true,"inReviewRevisionsEnabled":true},"keywords":"Memory-forensic malware detection, SHAP-guided feature selection, Explainable AI for cybersecurity, Adversarial robustness, Machine learning in adversarial environments","lastPublishedDoi":"10.21203/rs.3.rs-7871553/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-7871553/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eThe advancement in malware poses a major challenge to traditional detection methods, especially those that rely on static analysis and signature-based techniques. This study investigates a memory forensics-driven framework that combines feature engineering, explainability, and adversarial robustness analysis for malware detection. Using the CIC MalMem-2022 dataset, we analyzed 55 memory-resident features and refined them to 13 through mutual information and a novel SHAP-guided feature refinement (SHAP-GFR) process. We evaluated five models, namely Random Forest, XGBoost, Multilayer Perceptron (MLP), 1 Dimensional Convolutional Neural Network (1D CNN), and a CNN\u0026ndash;Long Short-Term Memory (CNN-LSTM) hybrid under a 70:15:15 train/validation/test split. All models achieved high accuracy on clean data, with XGBoost reaching 99.98% at minimal latency (4.68 ms). Our SHAP and LIME analyses showed that service and handle-related features were very key in malware identification. Models\u0026rsquo; robustness testing under Gaussian noise, Fast Gradient Sign Method (FGSM), and Projected Gradient Descent (PGD) revealed that while tree-based models\u0026rsquo; performance decreased substantially, convolutional architectures (1D CNN) maintained strong performance (\u0026asymp;\u0026thinsp;3% F1 drop). Leave-One-Family-Out (LOFO) validation demonstrated strong cross-family generalization. Our findings showed that tree ensembles were better at detecting attacks from entirely new malware families, while CNNs proved more effective against adversarial obfuscation. This work, therefore, establishes a new framework for evaluating malware detection systems. We provide a more comprehensive set of guidelines by focusing on efficiency, interpretability, and robustness for building systems that are not only accurate but also lightweight and resilient enough for real-world deployment.\u003c/p\u003e\u003cp\u003e.\u003c/p\u003e","manuscriptTitle":"SHAP-Guided Feature Refinement for Robust and Interpretable Malware Detection in Memory Forensics","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-11-14 23:19:05","doi":"10.21203/rs.3.rs-7871553/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"decision","content":"Revision requested","date":"2026-01-09T06:16:50+00:00","index":"","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-12-01T13:11:00+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-11-08T13:16:28+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"48850761453436554671724817951193841911","date":"2025-11-07T13:08:36+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"141992690344929900071354266402231593328","date":"2025-11-07T08:35:37+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"310227386101867641475115622138953042063","date":"2025-11-05T10:45:53+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2025-11-05T09:26:27+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2025-11-04T01:47:07+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2025-10-16T11:48:27+00:00","index":"","fulltext":""},{"type":"submitted","content":"EURASIP Journal on Information Security","date":"2025-10-15T20:36:19+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"eurasip-journal-on-information-security","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"jins","sideBox":"Learn more about [EURASIP Journal on Information Security](https://jis-eurasipjournals.springeropen.com/)","snPcode":"13635","submissionUrl":"https://submission.nature.com/new-submission/13635/3","title":"EURASIP Journal on Information Security","twitterHandle":"@SpringerEng","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"BMC/SO AJ","inReviewEnabled":true,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"0f3e06c6-24c6-4d4a-b1ab-ddbb35120119","owner":[],"postedDate":"November 14th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"in-revision","subjectAreas":[],"tags":[],"updatedAt":"2026-05-02T01:38:43+00:00","versionOfRecord":[],"versionCreatedAt":"2025-11-14 23:19:05","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-7871553","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-7871553","identity":"rs-7871553","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}