Delphi Scanner: efficient and interpretable static malware detection via API sequence modeling

arXiv:2609.19900 · cs.CR, cs.LG · Submitted 2026-09-17 · Read on arXiv

cs.CR, cs.LG

Submitted: 2026-09-17

Updated: 2026-09-17

Code: https://github.com/0xf1d0/delphi_scanner

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Robustness — 20× in this paper · explained in 5 episodes
• Transformer — 19× in this paper · explained in 2 episodes
• Accuracy — 16× in this paper · explained in 1 episode
• Generalization — 15× in this paper · explained in 13 episodes
• Feature Extraction — 11× in this paper · explained in 2 episodes
• Interpretability — 8× in this paper · explained in 15 episodes
• Computational overhead — 4× in this paper · explained in 2 episodes
• Import Address Table — 4× in this paper
• Portable Executable — 4× in this paper
• Explainability — 3× in this paper · explained in 3 episodes
• Aggregation — 2× in this paper · explained in 1 episode
• Convolutional Neural Networks — 2× in this paper
• Core — 2× in this paper · explained in 2 episodes
• Distribution Shift — 2× in this paper · explained in 6 episodes
• Modularity — 2× in this paper · explained in 9 episodes
• Trace — 2× in this paper · explained in 2 episodes
• Transformer Architecture — 2× in this paper · explained in 2 episodes
• 1D CNN — 1× in this paper · explained in 2 episodes
• Abstraction — 1× in this paper · explained in 1 episode
• Adversarial Attacks — 1× in this paper · explained in 1 episode
• Alignment — 1× in this paper · explained in 1 episode
• Benchmark — 1× in this paper · explained in 2 episodes
• Concept Drift — 1× in this paper · explained in 4 episodes
• Decoupling — 1× in this paper · explained in 2 episodes
• F1 Score — 1× in this paper · explained in 3 episodes
• Fidelity — 1× in this paper · explained in 2 episodes
• Gated Recurrent Units — 1× in this paper
• Graph Construction — 1× in this paper · explained in 3 episodes
• Long Short-Term Memory — 1× in this paper
• Modular Architecture — 1× in this paper · explained in 4 episodes
• Regularization — 1× in this paper · explained in 3 episodes
• Sample Efficiency — 1× in this paper · explained in 4 episodes
• Tokenization — 1× in this paper · explained in 2 episodes

Sources

• EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models
• Towards A Rigorous Science of Interpretable Machine Learning
• SoK: Leveraging Transformers for Malware Analysis
• Malware Detection by Eating a Whole EXE
• Classifying Sequences of Extreme Length with Constant Memory Applied to Malware Detection
• Feature graph construction with static features for malware detection

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs