A Feature-Based Machine Learning Ensemble Model for Enhanced Malware Detection in Digital Banking Security

Source abstract

The rapid expansion of digital banking has introduced significant cybersecurity vulnerabilities, particularly from sophisticated malware threats that exploit polymorphic and zero-day evasion techniques. Traditional signature-based defenses demonstrate critical inadequacy in detecting novel threats, creating exploitable security gaps that threaten financial integrity and customer trust. This research addresses these challenges by developing and validating a high performance, feature-based malware detection framework specifically tailored for digital banking security. The primary objectives are to develop an optimized Machine Learning ensemble algorithm for robust static malware classification, implement a feature-based approach utilizing Portable Executable (PE) file analysis, integrate Explainable AI (XAI) techniques for model transparency, and rigorously evaluate performance using standard metrics. The research employs Object-Oriented Analysis and Design alongside a quantitative experimental methodology, utilizing the EMBER dataset of Windows PE files. Static features including header information, section entropy, and import table characteristics were extracted and optimized using Recursive Feature Elimination with Cross-Validation (RFECV), reducing the feature space to 11 critical attributes. The proposed RF-XGBoost Ensemble Model was implemented using Python and compared against benchmark classifiers including Support Vector Machine, K-Nearest Neighbors, and Logistic Regression. The experimental results demonstrate exceptional performance: the RF-XGBoost Ensemble achieved an accuracy of 96.16% and an F1-score of 96.20%, significantly outperforming the weakest benchmark (Logistic Regression at 67.89% accuracy). Critically, the ensemble model achieved a False Negative rate of only 2.34% with just 10 missed threats, compared to 41 for SVM and 92 for Logistic Regression, demonstrating superior security robustness. The near-perfect AUC-ROC of 99.87% confirms excellent discriminatory power. Feature importance analysis identified general_size, section_127, and header_0 as the most influential PE attributes, providing security analysts with clear, actionable insights for threat mitigation and regulatory compliance. This research delivers substantial contributions to both cybersecurity and digital banking domains by establishing a new standard for robust, interpretable, and operationally efficient malware detection, effectively addressing the "black box" problem while maintaining high accuracy with minimal computational overhead suitable for real-time deployment.