Search papers, labs, and topics across Lattice.
This paper introduces EGAMA-RC, a risk-calibrated framework for memory-forensic malware triage that enhances operational decision-making by integrating uncertainty, novelty, and interpretability into the analysis process. By employing SHAP-guided feature refinement and a hybrid gate mechanism, EGAMA-RC achieves an impressive 93.12% acceptance rate of pooled samples with a 99.86% accuracy and minimal false-acceptance at 0.136%. The findings underscore that effective malware analysis hinges on risk-aware routing and novelty calibration, rather than relying solely on classification accuracy.
Achieving 99.86% accuracy with a 0.136% false-accept rate, EGAMA-RC redefines malware triage by prioritizing risk and novelty over mere classification performance.
Machine-learning malware detectors often achieve high clean-data accuracy, but operational triage also requires evidence about uncertainty, novelty, robustness, interpretability, latency, and review cost. This paper presents EGAMA-RC, a risk-calibrated evidence-gated framework for memory-forensic malware triage. Building on SHAP-guided feature refinement, EGAMA-RC combines dataset-specific refinement, model-pool evaluation, adversarial and open-family testing, novelty scoring, explanation-conditioned evidence, and runtime-aware routing. Low-risk samples are accepted automatically, while uncertain, high-risk, or potentially novel cases are routed to review, escalation, or novelty-aware handling. Across three malware datasets and a frozen multi-seed protocol, the selected hybrid gate accepts 93.12% of pooled samples with 99.86% accepted accuracy and a 0.136% false-accept rate. Novelty calibration reduces over-restrictive review behavior while preserving a low unsafe-accept profile. XGBoost provides lightweight fast-path inference with p50/p95 latency of 0.0054/0.0059 ms per sample. The results show that dependable malware analysis requires risk-calibrated routing, novelty awareness, and controlled analyst review, not classification accuracy alone.
