{"id":"https://openalex.org/W7123888073","doi":"https://doi.org/10.48550/arxiv.2601.07305","title":"Memory-Based Malware Detection under Limited Data Conditions: A Comparative Evaluation of TabPFN and Ensemble Models","display_name":"Memory-Based Malware Detection under Limited Data Conditions: A Comparative Evaluation of TabPFN and Ensemble Models","publication_year":2026,"publication_date":"2026-01-12","ids":{"openalex":"https://openalex.org/W7123888073","doi":"https://doi.org/10.48550/arxiv.2601.07305"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2601.07305","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2601.07305","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2601.07305","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5088454523","display_name":"Valentin Leroy","orcid":"https://orcid.org/0000-0003-1449-5422"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Leroy, Valentin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5017915900","display_name":"Shuvalaxmi Dass","orcid":"https://orcid.org/0000-0001-9254-8134"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dass, Shuvalaxmi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5122983885","display_name":"Sharif Ullah","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ullah, Sharif","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9244999885559082,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9244999885559082,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.030700000002980232,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.007600000128149986,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7562999725341797},{"id":"https://openalex.org/keywords/ensemble-learning","display_name":"Ensemble learning","score":0.545799970626831},{"id":"https://openalex.org/keywords/ensemble-forecasting","display_name":"Ensemble forecasting","score":0.5320000052452087},{"id":"https://openalex.org/keywords/big-data","display_name":"Big data","score":0.42320001125335693},{"id":"https://openalex.org/keywords/computation","display_name":"Computation","score":0.4124000072479248},{"id":"https://openalex.org/keywords/random-forest","display_name":"Random forest","score":0.38269999623298645},{"id":"https://openalex.org/keywords/data-modeling","display_name":"Data modeling","score":0.373199999332428}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8016999959945679},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7562999725341797},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.6258000135421753},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6144999861717224},{"id":"https://openalex.org/C45942800","wikidata":"https://www.wikidata.org/wiki/Q245652","display_name":"Ensemble learning","level":2,"score":0.545799970626831},{"id":"https://openalex.org/C119898033","wikidata":"https://www.wikidata.org/wiki/Q3433888","display_name":"Ensemble forecasting","level":2,"score":0.5320000052452087},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.42820000648498535},{"id":"https://openalex.org/C75684735","wikidata":"https://www.wikidata.org/wiki/Q858810","display_name":"Big data","level":2,"score":0.42320001125335693},{"id":"https://openalex.org/C45374587","wikidata":"https://www.wikidata.org/wiki/Q12525525","display_name":"Computation","level":2,"score":0.4124000072479248},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.38269999623298645},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.373199999332428},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.35429999232292175},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.33309999108314514},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.33090001344680786},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.2865000069141388},{"id":"https://openalex.org/C175801342","wikidata":"https://www.wikidata.org/wiki/Q1988917","display_name":"Data analysis","level":2,"score":0.26409998536109924},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.2547000050544739},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.25450000166893005}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2601.07305","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2601.07305","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2601.07305","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2601.07305","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Artificial":[0],"intelligence":[1],"and":[2,15,83,135],"machine":[3],"learning":[4],"have":[5],"significantly":[6],"advanced":[7],"malware":[8,43],"research":[9],"by":[10],"enabling":[11],"automated":[12],"threat":[13],"detection":[14],"behavior":[16],"analysis.":[17],"However,":[18,113],"the":[19,28,37,133,136],"availability":[20],"of":[21,30,39,139],"exploitable":[22],"data":[23,49],"is":[24],"limited,":[25],"due":[26],"to":[27,57,105],"absence":[29],"large":[31],"datasets":[32],"with":[33,102],"real-world":[34],"data.":[35],"Despite":[36],"progress":[38],"AI":[40],"in":[41,99,116,125],"cybersecurity,":[42],"analysis":[44],"still":[45],"suffers":[46],"from":[47],"this":[48,59,61,114],"scarcity,":[50],"which":[51],"limits":[52],"model":[53,66],"generalization.":[54],"In":[55],"order":[56],"tackle":[58],"difficulty,":[60],"workinvestigates":[62],"TabPFN,":[63],"a":[64,103,126],"learning-free":[65],"designed":[67],"for":[68],"low-data":[69,100],"regimes.":[70],"We":[71],"evaluate":[72],"its":[73,122],"performance":[74,111,117],"against":[75],"established":[76],"baselines":[77],"such":[78],"as":[79],"Random":[80],"Forest,":[81],"LightGBM":[82],"XGBoost,":[84],"across":[85,109],"multiple":[86,110],"class":[87],"configurations.":[88],"Our":[89],"experimental":[90],"results":[91],"indicate":[92],"that":[93],"TabPFN":[94,141],"surpasses":[95],"all":[96],"other":[97],"models":[98],"regimes,":[101],"2%":[104],"6%":[106],"improvement":[107],"observed":[108],"metrics.":[112],"increase":[115],"has":[118],"an":[119],"impact":[120],"on":[121],"computation":[123],"time":[124],"particular":[127],"case.":[128],"These":[129],"findings":[130],"highlight":[131],"both":[132],"promise":[134],"practical":[137],"limitations":[138],"integrating":[140],"into":[142],"cybersecurity":[143],"workflows.":[144]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-01-14T00:00:00"}