Delphi Scanner: efficient and interpretable static malware detection via API sequence modeling
Bijied Brahimi, Vincent Cohadon, Gabriel Glazman, Rayan Al Mohaize, Omran Berjawi, Omran Berjawi, Rida Khatoun, Rida Khatoun
cs.CR · cs.LG
Quick verdict
CNN on PE API sequences: 95.35% accuracy, 1.53MB, sub-ms inference; promising but weakened by dataset accounting inconsistencies and misstated FP/FN rates.
Summary
The paper presents Delphi Scanner, a desktop static malware detector for Windows PE files that classifies binaries from Import Address Table API sequences using a multi-scale 1D CNN (512-token sequences, 10k vocabulary), coupled with a decoupled rule-based layer that maps imported APIs to seven MITRE ATT&CK capability categories without influencing verdicts. On roughly 190,364 deduplicated PE files (Practical Security Analytics, VirusShare, MalBehavD-V1, Windows System32) split 80/20, the CNN reaches 95.35% accuracy and 0.9536 F1 with a 1.53 MB model and 0.56 ms ONNX inference, marginally ahead of GRU, Transformer, LSTM and CNN-LSTM baselines trained under one shared configuration. Robustness checks report 89.13% recall on 5,647 MalwareBazaar samples, 92.08% versus 97.16% recall on 106 paired packed/unpacked UPX binaries, and at least 95% recall under three simple manipulation attacks. Limitations are significant: the dataset accounting is internally inconsistent (Table 3 versus Table 7), Table 8's FP/FN percentages are not conditional error rates, no significance tests or temporal splits guard the tiny architecture gaps, and adversarial testing covers only crude attacks with about 100 samples each.
Review complete
Assessment at a glance
6
risk flags identified
● high 2
● medium 3
● low 1
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- A multi-scale 1D CNN over static IAT API sequences achieves 95.35% accuracy and 0.9536 F1 on ~190k PE files with a 1.53 MB model and 0.56 ms ONNX inference, matching or beating GRU, Transformer, LSTM and CNN-LSTM under a unified configuration.
- The model generalizes out-of-distribution, retaining 89.13% recall on 5,647 unretrained MalwareBazaar samples.
- Detection is robust to packing and to three functionality-preserving manipulations, with recall of 92.08% on UPX-packed samples and ≥95% under API injection, DOS padding, and section padding.
- A decoupled rule-based layer maps imported APIs to seven MITRE ATT&CK-mapped capability categories at negligible inference cost, providing analyst-facing explanation without influencing verdicts.
Strengths
Honest out-of-distribution reporting
The 89.13% recall on 5,647 MalwareBazaar samples (§5.6) is reported against the 94.68% in-distribution malware recall and explicitly attributed to distribution shift rather than spun as success; temporal bias is acknowledged in §7.3.
Clean paired packing experiment
The 106 packed/unpacked UPX pairs from identical malware instances (§4.5) isolate the packing effect precisely: 92.08% vs 97.16% recall, a 5.08pp drop mechanistically explained by reduced IAT visibility (§5.6).
Fully specified, deployable pipeline
Decoupled explanation design
Fair architecture comparison setup
Weaknesses
Dataset accounting does not add up
FP/FN rates miscomputed in Table 8
No statistical rigor behind the ranking
Leakage-prone evaluation protocol
Narrow evasion and benign coverage
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
Delphi Scanner is a system-plus-benchmark paper: a desktop static malware detector for Windows PE files that classifies binaries from Import Address Table (IAT) API sequences using a multi-scale 1D CNN, paired with a decoupled rule-based layer mapping APIs to seven MITRE ATT&CK capability categories (Table 1). Headline claims: 95.35% accuracy / 0.9536 F1 on ~190,364 deduplicated PE files with a 1.53 MB model and 0.56 ms ONNX inference (Table 6); 89.13% recall on 5,647 out-of-distribution MalwareBazaar samples; 92.08% vs 97.16% recall on 106 paired packed/unpacked UPX binaries; ≥95% recall under three manipulation attacks; and cost-free interpretability. The text is complete enough to audit the arithmetic, which is where the paper both succeeds and fails.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 6 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
How accurate is Delphi Scanner at detecting malware?
On about 190,000 Windows PE files (80/20 train/test split), the CNN model reaches 95.35% accuracy and 0.9536 F1, with roughly 4% false positives and 5.3% false negatives when computed per class. On 5,647 newer MalwareBazaar samples outside the training distribution, recall drops to 89.13%.
Does Delphi Scanner detect packed malware?
Partially. In a paired experiment on 106 malware binaries, recall was 97.16% for unpacked copies versus 92.08% for UPX-packed copies. Packing hides most imports, leaving only the unpacking stub's API pattern, so detection degrades but does not collapse.
Is Delphi Scanner's code and model available?
Yes. The paper links an open-source repository (github.com/0xf1d0/delphi_scanner) containing the Rust/Tauri desktop app, the PE parsing and inference code, and the 1.53 MB ONNX model. The training datasets are only partly public: the primary source is a commercial dataset, VirusShare requires registration, and MalwareBazaar is open.
How does Delphi Scanner explain its verdicts?
A rule-based layer, fully decoupled from the classifier, matches imported API names against seven malicious-capability categories (e.g., process injection, keylogging, registry persistence) mapped to MITRE ATT&CK technique IDs, and surfaces them as severity-ranked indicators. These indicators never change the malware/benign verdict.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 4–7 (training curves and UI screenshots) cannot be verified from extracted text; assessments rely on tables and prose only.
- The extracted text appears essentially complete (bibliography included), but section 3.2's table numbering and any supplementary material beyond the PDF were not available.
- Dataset license/redistribution terms for the primary Practical Security Analytics source could not be checked, affecting exact-reproduction feasibility.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.