Integrating Principal Component Analysis and Chi-Square Feature Selection for Explainable Memory-Based Malware Detection Using Machine Learning
Keywords:
Malware Detection, Hybrid Feature Generation, Principal Component Analysis , Memory Forensics, CybersecurityAbstract
Antimalware fails to detect modern malware because advanced threats use obfuscation and polymorphism to evade detection. Machine learning offers alternatives through pattern recognition, but redundant and correlated features in cybersecurity datasets limit the performance and generalizability of Machine Learning based malware detectors. Principal Component Analysis and Chi-Square have proven effective individually but their combined use for malware detection remains underexplored. Hybrid PCA–Chi-Square Feature Engineering (HPCF) framework that fuses PCA components with Chi-Square features into a single compact representation was employed in this study. Feature engineering, hyperparameter optimization and model training were nested inside a stratified ten-fold cross-validation pipeline to prevent information leakage and ensure reproducibility. The fused feature set was used to train optimized Decision Tree, Support Vector Machine and K-Nearest Neighbor classifiers, evaluated using Accuracy, Precision, Recall, F1-score, ROC-AUC, Matthews Correlation Coefficient, Friedman’s test and Wilcoxon Signed-Rank Test. HPCF produced a smaller feature vector while largely preserving predictive performance, with Support Vector Machine and K-Nearest Neighbor significantly outperforming Decision Tree with CICMalmem dataset. The framework was further trained on PE dataset to assess cross dataset generalizability. SHAP and LIME explanations showed that memory artefacts related to process handles, service activity, and dynamic link library characteristics were the strongest predictors of malicious behavior. The results demonstrate an efficient trade-off between dimensionality reduction, feature relevance, computational cost and model interpretability. The proposed HPCF framework offers a transparent, reproducible and explainable approach to memory-based malware detection and a basis for future work on more resilient, reliable artificial intelligence systems for cyber-threat detection.
