Publication Date
Spring 2026
Degree Type
Master's Project
Degree Name
Master of Science in Computer Science (MSCS)
Department
Computer Science
First Advisor
Fabio Di Troia
Second Advisor
Navrati Saxena
Third Advisor
Thomas Austin
Keywords
Malware Detection, Benford’s Law, Anomaly Detection, Feature Selection, Hybrid Classification
Abstract
Benford’s Law (BL) states that leading digits of naturally occurring data follows a logarithmic distribution. Deviations from this distribution can serve as lightweight, interpretable signal for feature selection in malware detection. This paper presents an evaluation of three different feature selection strategies that use distance-based BL conformance measures across three classification pipelines: a pure unsupervised BL classifier that applies fixed thresholds to classify, a hybrid approach in which BL scores are served as input features for supervised machine learning, and a cascade selective hybrid model that routes high confidence flows through BL rules and defers ambiguous flows to a trained classifier. Experiments are performed on two publicly available datasets: CIC-MalMem 2022 and an Android network traffic dataset. On CIC-MalMem, class-aware feature selection yields F1 > 95% and MCC > 0.9 across both hybrid and cascade pipelines, while the pure BL classifier achieves F1 = 0.903 and MCC = 0.805 without supervised training. In contrast, the Android dataset yields F1 as high as 96% but near zero MCC, revealing that the 13:1 malicious class imbalance prevents meaningful class separation. Second digit BL conformance also shows discriminative capability, though its compressed distribution favors supervised over pure BL approaches. Computationally, the Pure BL pipeline is the fastest of the three, completing inference in sub-second time. The cascade architecture reduces total classification time compared to the full hybrid by routing high-confidence flows directly through BL rules, bypassing the trained classifier.
Recommended Citation
Panyala, Vaibhav Reddy, "Benford’s Law for Malware Detection: Class-Aware Feature Selection with Cascade Hybrid Classification" (2026). Master's Projects. 1817.
DOI: https://doi.org/10.31979/etd.qy78-gwsq
https://scholarworks.sjsu.edu/etd_projects/1817
