Machine learning techniques for real-time malware classification and threat detection in distributed systems

 Corresponding author: Elvis Nnaemeka Chukwuani Copyright © 2025 Author(s) retain the copyright of this article. This article is published under the terms of the Creative Commons Attribution License 4.0. Machine learning techniques for real-time malware classification and threat detection in distributed systems Elvis Nnaemeka Chukwuani 1, *, Ololade R Odunsi 2 and Chukwujekwu Damian Ikemefuna 3 1 Department of Computer Science, Bowling Green State University, USA. 2 Cybersecurity and Networks, University of New Haven, USA. 3 Cybersecurity, American National University, USA. World Journal of Advanced Research and Reviews, 2025, 26(03), 2378-2398 Publication history: Received on 15 May 2025; revised on 21 June 2025; accepted on 24 June 2025 Article DOI: https://doi.org/10.30574/wjarr.2025.26.3.2433 Abstract The proliferation of cyber threats across distributed systems—spanning cloud platforms, edge networks, and Internetof-Things (IoT) ecosystems—demands robust, adaptive mechanisms for malware classification and real-time threat detection. Traditional signature-based and rule-driven detection systems are increasingly ineffective against rapidly evolving threats, such as polymorphic malware and zero-day attacks. This study explores the application of advanced machine learning (ML) techniques to build a scalable, real-time malware classification and threat detection framework tailored for distributed environments. It integrates supervised learning models including Random Forests, Support Vector Machines (SVM), and Gradient Boosting with deep learning architectures such as Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) networks to extract temporal, behavioral, and structural features from system logs, network flows, and executable binaries. A hybrid ensemble approach enhances generalization across diverse data sources, while online learning capabilities facilitate continuous model updates from live threat intelligence feeds. The framework is deployed within a decentralized monitoring architecture that supports federated learning, ensuring data privacy across distributed endpoints while maintaining high detection accuracy. Evaluation was conducted using benchmark datasets (CICIDS, EMBER, and custom-labeled logs from industrial control systems), achieving a detection accuracy exceeding 96% and a low false-positive rate under real-time constraints. Notably, the model exhibited resilience to adversarial evasion tactics through adaptive retraining mechanisms. The proposed system not only automates threat classification but also enables anomaly detection and threat prioritization for security analysts. This research underscores the growing utility of ML-driven security solutions in managing the complex threat landscape of distributed digital infrastructures. Keywords: Real-time threat detection; Machine learning; Malware classification; Distributed systems; Deep learning; Federated learning 1. Introduction 1.1. The Growing Cyber Threat Landscape in Distributed Environments The digital ecosystem has undergone a significant transformation with the shift toward distributed computing architectures, including cloud-native applications, microservices, edge computing, and decentralized data storage. While these paradigms enhance system scalability and resource optimization, they simultaneously expand the attack surface, making systems more vulnerable to advanced and persistent threats [1]. Modern cyber threats increasingly target interconnected environments where the complexity of interactions obscures malicious activities until significant damage is done. World Journal of Advanced Research and Reviews, 2025, 26(03), 2378-2398 2379 Traditional perimeter-based security approaches often fail to provide visibility into these fragmented ecosystems. Threat actors now deploy polymorphic malware, fileless intrusions, and adversarial machine learning techniques that bypass signature-based detection mechanisms, exploiting trust assumptions between distributed nodes [2]. The proliferation of IoT and 5G infrastructures has further intensified this challenge by introducing heterogeneity in devices, platforms, and access protocols, complicating unified threat detection [3]. Moreover, attackers are leveraging automated reconnaissance tools, AI-powered evasion strategies, and multi-stage payloads that adapt in real-time to defensive tactics. Distributed denial-of-service (DDoS) attacks, ransomware-as-aservice (RaaS), and lateral movement within federated environments are becoming increasingly difficult to detect early without behavioral and contextual analysis [4]. Figure 1 illustrates how malware evolution has created detection blind spots in traditional systems, especially under distributed configurations. Classification gaps widen as threat vectors diversify across endpoints and cloud-native layers, emphasizing the need for more adaptive and intelligent detection strategies. Figure 1 Malware Evolution and Classification Gaps in Traditional vs. Distributed Systems These evolving dynamics underscore the urgency for next-generation cybersecurity frameworks capable of monitoring distributed environments holistically while enabling proactive threat detection. 1.2. Limitations of Traditional Malware Detection Systems Conventional malware detection systems, primarily based on signature matching and heuristic rules, struggle in the face of today’s rapidly mutating and obfuscated attack techniques [5]. These systems rely on previously identified patterns stored in threat databases, rendering them ineffective against zero-day exploits and malware variants that employ encryption, code packing, or dynamic evasion tactics [6]. In distributed environments, traditional solutions are further limited by centralized logging mechanisms and inconsistent visibility across endpoints. When malware propagates through federated networks or hybrid clouds, the lack of real-time correlation between logs and system behaviors inhibits early identification and response [7]. Another critical shortcoming lies in static analysis, which cannot effectively assess behaviorally dynamic threats that manifest only under specific runtime conditions. This limitation leaves systems exposed to logic bombs, privilege escalations, and delayed payload execution commonly deployed by sophisticated adversaries [8]. Furthermore, the siloed nature of legacy security architectures prevents cross-domain telemetry sharing, which is essential in distributed contexts where network, application, and host-level events must be aggregated to detect multilayered attacks. Addressing these limitations necessitates a shift toward intelligent detection strategies that integrate anomaly detection, behavioral modeling, and real-time risk scoring across distributed systems. World Journal of Advanced Research and Reviews, 2025, 26(03), 2378-2398 2380 1.3. Objectives and Scope of the Study This study seeks to explore and evaluate intelligent behavioral and access pattern-based analytics as a foundational component for enhancing real-time malware detection in distributed environments. It focuses on integrating advanced machine learning models with distributed system telemetry to detect anomalies indicative of malicious behavior even in the absence of prior signatures [9]. The research aims to define a framework that combines unsupervised learning techniques, contextual anomaly scoring, and dynamic feature extraction to identify subtle deviations in access behavior, system resource utilization, and data flows. The scope includes both infrastructure-level analytics (e.g., system calls, file I/O patterns) and user-level behaviors (e.g., authentication anomalies, privilege misuse) across hybrid environments [10]. Additionally, the study outlines the architectural considerations for deploying such analytics in real-time while maintaining system performance and scalability. Emphasis is placed on detection agility, cross-domain telemetry fusion, and interpretability to support decision-making by cybersecurity analysts. 2. Foundations of malware and threat detection 2.1. Understanding Malware: Types and Behaviors Malware—malicious software engineered to disrupt, damage, or gain unauthorized access—has evolved significantly in both sophistication and diversity. Traditional classifications include viruses, worms, Trojans, ransomware, spyware, rootkits, and adware, each with distinct propagation methods and payload characteristics. Viruses typically attach to legitimate files, worms self-replicate through network vulnerabilities, and Trojans disguise themselves as benign applications [6]. Table 1 Malware Behavior Patterns Across System Layers in Distributed Networks System Layer Observed Malware Behavior Typical Attack Techniques Examples Application Layer Code injection, API misuse, privilege escalation DLL hijacking, Remote Code Execution (RCE) Emotet, Dridex Operating System Process hollowing, kernel manipulation, fileless execution Rootkits, Registry manipulation TrickBot, ZeroAccess Network Layer C2 (Command and Control) communication, DNS tunneling, data exfiltration Packet sniffing, ARP spoofing APT28, DarkHotel Cloud/Virtualization Container escape, VM introspection evasion, identity spoofing Credential reuse, hypervisor attacks CloudSniper, Escapee Edge Devices (IoT) Firmware tampering, lateral movement, unauthorized device control Default credential abuse, firmware overwrite Mirai, Mozi Data Layer Ransomware encryption, integrity manipulation, unauthorized read/write access SQL injection, cryptographic attacks REvil, Maze User Behavior Layer Session hijacking, social engineeringinduced access, anomalous activity timing Phishing, behavioral mimicry Zeus Panda, BazarLoader Contemporary malware increasingly leverages polymorphism and metamorphism to alter their code signatures dynamically, evading signature-based detection. In parallel, fileless malware operates in-memory, exploiting trusted system tools like PowerShell or WMI without writing to disk, thereby bypassing conventional antivirus solutions [7]. Behaviorally, advanced malware may exhibit stealth tactics such as delayed activation, process hollowing, or environment-aware execution to avoid sandboxes. Attackers also employ modular malware, which updates its capabilities post-infiltration via command-and-control (C2) servers, enabling dynamic responses to security defenses. Behavior-based classification becomes crucial in identifying World Journal of Advanced Research and Reviews, 2025, 26(03), 2378-2398 2381 such threats, focusing on indicators such as unusual file access sequences, registry modifications, or elevated CPU and network usage patterns over time [8]. Malware behavior is context-sensitive—it adapts based on OS environments, privilege levels, and even the presence of monitoring tools. As threat actors tailor malware for distributed targets like cloud workloads, containers, and edge nodes, recognizing nuanced behavior patterns across system layers becomes critical for timely detection [9]. Table 1 outlines representative malware behaviors and their corresponding manifestations across user, system, and network layers within distributed architectures. 2.2. Anatomy of Distributed Systems and Attack Vectors Distributed systems are composed of multiple autonomous computing entities that interact to achieve a shared goal. Architectures may include microservices, serverless functions, multi-cloud environments, and IoT ecosystems, where data and computation are fragmented across geographies and domains. These environments introduce significant complexity in cybersecurity operations [10]. One of the defining characteristics of distributed systems is the absence of a single, consolidated control point. This decentralization increases the number of attack surfaces, particularly through API endpoints, container orchestration platforms (e.g., Kubernetes), and unsecured data transmission channels. Malware campaigns exploit these surfaces through techniques such as API injection, container escape, and inter-container snooping [11]. In hybrid environments, lateral movement becomes a high-risk vector. Once malware gains access via phishing or supply-chain exploits, it may traverse systems by leveraging shared credentials, poorly configured role-based access controls, or legacy authentication protocols. Network segmentation is often insufficient, especially when applications require frequent inter-service communication with relaxed firewall rules [12]. Another vector of concern is orchestration-layer compromise, where misconfigured YAML files or open container registries offer direct exploitation pathways. Infrastructure-as-code vulnerabilities and unsecured third-party libraries further exacerbate exposure in CI/CD pipelines and DevOps workflows [13]. Understanding the anatomy of these distributed systems is fundamental to modeling threat surfaces. Without proper behavioral baselining, subtle anomalies—such as unauthorized service calls or time-shifted authentication attempts— go unnoticed until system-wide breaches occur. Security telemetry must thus span all architectural layers, from application logic to network routing, to ensure robust malware detection in these environments. 2.3. Real-Time Detection Requirements and Constraints The dynamic and expansive nature of distributed systems necessitates real-time detection frameworks capable of identifying anomalies and threats before lateral propagation occurs. Unlike batch or forensic analysis, real-time detection requires continuous data ingestion, rapid processing, and context-aware decisioning under stringent performance constraints [14]. Key requirements include • High-frequency telemetry collection across disparate components (e.g., API calls, system logs, user sessions, container behavior). • Low-latency analytics pipelines to ensure malware actions are intercepted before causing damage. • Scalable architectures that support horizontal expansion in response to infrastructure growth without loss of analytical integrity. • Contextual awareness, where detection mechanisms correlate activity across layers and temporal windows to infer malicious intent. However, deploying real-time detection in distributed environments is challenged by the sheer volume and velocity of data generated. An enterprise-scale deployment may yield millions of events per second, overwhelming traditional Security Information and Event Management (SIEM) tools unless optimized for stream processing [15]. Furthermore, resource constraints in edge devices and ephemeral containers limit the feasibility of heavy-weight monitoring agents. Lightweight probes and agentless collection models become necessary, but they often sacrifice depth World Journal of Advanced Research and Reviews, 2025, 26(03), 2378-2398 2382 of visibility. In cloud-native systems, ephemeral infrastructure complicates detection further—containers may exist for seconds, making persistence-based detection ineffective [16]. Behavioral baselining must adapt to diverse workload types and user roles, necessitating unsupervised learning models that dynamically learn normalcy per microenvironment. These models must avoid false positives that can cause alert fatigue and undermine operational responsiveness. A robust framework integrates statistical anomaly detection, rule-based logic, and machine learning classifiers with continual feedback loops to tune thresholds and prioritize actionable alerts. Cross-domain correlation, such as linking login anomalies with process injection patterns, increases confidence in detections [17]. Table 1, referenced earlier, supports this requirement by offering a reference guide to typical behavior markers across different architectural layers—helping to contextualize threats rapidly during real-time analysis. Ultimately, the challenge is balancing detection granularity, processing speed, and interpretability to ensure defenders can act on insights without being overwhelmed. The next section introduces the architectural components and algorithms enabling intelligent behavioral detection in such environments. 3. Machine learning paradigms for malware classification 3.1. Supervised Learning: SVM, Random Forest, Gradient Boosting Supervised learning remains a cornerstone of intelligent malware detection due to its ability to learn from labeled datasets comprising known malware and benign instances. Models like Support Vector Machines (SVMs), Random Forests (RFs), and Gradient Boosting Machines (GBMs) are particularly effective in scenarios where labeled behavioral or signature data is available for training [11]. SVMs operate by constructing hyperplanes that separate data into classes with maximum margin, often applied to feature vectors representing system call frequencies, byte n-grams, or opcode sequences. Their robustness against overfitting in high-dimensional spaces makes them suitable for malware family classification where decision boundaries are clear [12]. Random Forests, which are ensembles of decision trees trained on random subsets of features and data samples, offer improved generalizability and resistance to noise. In distributed detection systems, RFs can be used to identify malware based on combinations of process behavior, registry alterations, and network activity [13]. Their interpretability is beneficial for security analysts needing traceable justifications for detections. Gradient Boosting Machines like XGBoost or LightGBM perform sequential model training by minimizing residual errors. These are highly sensitive to subtle features and perform well in capturing nuanced behavior differences across malware classes. However, they require careful tuning to avoid overfitting in highly dynamic threat environments [14]. Training supervised models at scale involves curating robust feature engineering pipelines—converting raw telemetry into structured inputs such as entropy measures, API sequence embeddings, and access frequency distributions. However, these approaches are inherently limited in detecting zero-day malware, where behavior deviates from known patterns. World Journal of Advanced Research and Reviews, 2025, 26(03), 2378-2398 2383 Figure 2 Comparative Pipeline of ML-Based Malware Classifiers Figure 2 outlines the end-to-end pipeline for various machine learning classifiers, comparing feature inputs, model complexity, and latency performance—key metrics for deployment in real-time malware detection architectures. 3.2. Unsupervised Learning: Clustering and Anomaly Detection In contrast to supervised learning, unsupervised techniques operate without labeled data, making them highly suitable for discovering previously unseen malware behaviors. Two dominant approaches include clustering algorithms and anomaly detection models [15]. Clustering techniques, such as k-means, DBSCAN, and hierarchical clustering, group similar behavioral patterns, enabling identification of outliers potentially representing malicious activity. For instance, processes with high CPU utilization, low entropy, and rapid file I/O access may form outlier clusters, triggering alerts even in the absence of explicit signatures [16]. In distributed environments, these models are trained using telemetry from system logs, network flows, or access logs across nodes. Dimensionality reduction techniques like PCA or t-SNE are often used to visualize clusters and reduce feature sparsity for computational efficiency. These clusters can then be mapped to behavior templates to assist analysts in triaging threats [17]. Anomaly detection models, including statistical models and autoencoders, learn baseline system or user behavior and flag deviations beyond defined thresholds. An example includes detecting a normally low-privileged user suddenly accessing sensitive system directories or exfiltrating data at unusual times. These patterns are often missed by rulebased systems [18]. Unsupervised models enhance generalizability and reduce dependency on continuously updated malware datasets, addressing challenges posed by polymorphic and fileless malware, especially in resource-constrained nodes. 3.3. Deep Learning: CNN, RNN, LSTM, Transformer Architectures Deep learning architectures offer significant advancements in malware detection due to their ability to capture hierarchical and temporal dependencies in complex data. Models such as Convolutional Neural Networks (CNNs), Recurrent Neural Networks (RNNs), Long Short-Term Memory (LSTM) networks, and Transformers have demonstrated strong performance in behavior modeling across distributed environments [19]. World Journal of Advanced Research and Reviews, 2025, 26(03), 2378-2398 2384 CNNs, originally designed for image processing, have been adapted to malware detection by converting binaries into grayscale images or feature matrices. These visualizations allow CNNs to detect spatial patterns, code packing anomalies, or obfuscation techniques not visible through traditional inspection. They are also efficient for execution on edge nodes with GPU support [20]. RNNs and LSTMs are ideal for capturing temporal sequences, such as API call order, authentication logs, or system event chains. For example, an LSTM model trained on sequences of system commands can distinguish between benign automation and malicious script execution. Their ability to preserve historical context is key to identifying multi-stage attacks [21]. Transformer models, using self-attention mechanisms, overcome the limitations of RNNs by capturing long-range dependencies more effectively. Pre-trained transformer architectures like BERT and GPT variants have been adapted to cybersecurity applications by fine-tuning them on malware behavior logs and user access patterns. These models excel in handling non-linear, multi-domain data such as hybrid telemetry from cloud and endpoint systems [22]. Despite their accuracy, deep learning models pose interpretability challenges. Tools like LIME or SHAP are often integrated to improve transparency and explainability. Moreover, deployment in distributed environments requires edge-friendly variants like TinyML models, or federated learning techniques to maintain privacy while training on decentralized data [23]. As illustrated in Figure 2, deep models generally outperform traditional methods in complex environments but require substantial compute and tuning to operate efficiently and reliably. 3.4. Ensemble Learning and Hybrid Models To overcome the limitations of individual algorithms, ensemble and hybrid models combine the strengths of multiple learning paradigms to improve detection robustness. Ensemble methods such as stacking, bagging, and boosting integrate predictions from diverse base learners—often blending decision trees, SVMs, and deep models—to capture both linear and non-linear data relationships [24]. For instance, an ensemble model might use a Random Forest to perform rapid, low-cost classification, then invoke an LSTM model for deeper behavioral analysis if uncertainty remains. These layered decision structures are especially effective in environments with imbalanced datasets or noisy telemetry, where a single model may exhibit high variance or bias [25]. Hybrid models go further by combining supervised, unsupervised, and deep learning techniques within a single detection pipeline. Anomaly scores from unsupervised models may be used as features for supervised classifiers, or sequence embeddings from LSTMs may inform clustering algorithms. Such architectures enable adaptive learning, where insights from anomaly detection feedback into retraining of classification models. This flexibility allows security systems to evolve in response to novel attack patterns without relying entirely on human-labeled data or fixed rules. Ensemble strategies thus form a core component of resilient malware detection systems, particularly in dynamic and distributed cybersecurity environments. 4. Data acquisition, feature engineering, and preprocessing 4.1. Sources of Malware Data: Network Logs, Binaries, Sandboxes Effective machine learning models for malware detection rely heavily on the quality and diversity of training data. In cybersecurity environments, malware-related data is typically collected from three primary sources: network traffic logs, malicious binaries, and sandboxed execution environments [15]. Network traffic logs capture metadata such as source/destination IPs, port usage, session durations, and protocol types. These logs are instrumental in detecting malware behaviors like command-and-control communications, data exfiltration attempts, and scanning activities. DNS tunneling, domain generation algorithms (DGAs), and encrypted payloads often leave distinct signatures at the traffic level, enabling identification through flow pattern analysis [16]. World Journal of Advanced Research and Reviews, 2025, 26(03), 2378-2398 2385 Malicious binaries, whether obtained from honeypots, malware repositories (e.g., VirusShare, VirusTotal), or endpoint detections, provide a rich corpus for static feature extraction. Analysts often use disassemblers and decompilers to extract opcode sequences, strings, API calls, and import/export tables. These features can inform signature-based and feature-driven detection models [17]. Sandboxes, such as Cuckoo or Any.Run, simulate execution of malware in controlled environments, logging behavioral traits like file system modifications, registry changes, process injections, and system calls. Sandboxed execution offers deep insight into runtime characteristics of evasive malware that may not manifest through static analysis alone [18]. Hybrid data collection strategies often yield the best results, integrating telemetry from multiple layers. The combination of real-world network logs and sandbox-generated behavioral trails provides a balanced dataset that enhances both detection sensitivity and robustness against false positives in distributed systems. 4.2. Feature Engineering: Static, Dynamic, and Behavioral Features Feature engineering translates raw data into actionable inputs for machine learning models, shaping detection performance and computational efficiency. In malware classification, features are typically drawn from three categories: static, dynamic, and behavioral [19]. Static features are derived from malware binaries without execution. Common examples include opcode frequency histograms, byte entropy, string constants, and metadata from Portable Executable (PE) headers. For instance, unusually high entropy may indicate encryption or packing, while specific DLL imports may suggest API hooking attempts. Static features are computationally efficient but vulnerable to obfuscation and polymorphism [20]. Dynamic features are extracted from observed behavior during malware execution in sandboxes or monitored environments. These include system calls (e.g., NtCreateFile, RegSetValueEx), memory allocations, process spawning, and network connections. Sequences of system calls or the temporal order of registry access can be encoded using ngrams, TF-IDF, or embedded into vectors via word2vec-style models [21]. Behavioral features abstract higher-level insights from multiple data sources. They include time-based anomalies (e.g., nighttime logins), frequency deviations (e.g., rapid I/O), and interaction graphs (e.g., file-process-service relationships). Behavioral modeling helps detect sophisticated malware that dynamically adjusts its execution path based on environment checks or time delays [22]. Successful models often combine all three feature types. For example, static features serve as fast pre-filters, dynamic features confirm malicious patterns, and behavioral metrics identify stealthy threats. Feature selection techniques like mutual information, recursive elimination, or PCA are applied to reduce dimensionality and enhance model generalization. Automated pipelines using Spark, Kafka, or ELK stacks streamline this process in real-time detection systems. However, feature drift—where malware evolves to bypass known signals—remains a challenge, requiring continuous feature retraining. Table 2 Benchmark Datasets and Preprocessing Strategies in Malware Classification Dataset Name Source Type Key Features Preprocessing Strategy Common Use Case CIC-MalMem-2022 Memory dump, PCAP API calls, memory usage, thread behavior Feature extraction, label normalization Malware behavior analysis in memory EMBER Windows PE files Header info, byte entropy, imported libraries Static feature extraction, balanced resampling Static malware classification Malimg Grayscale images of binaries Visual byte pattern representation Image scaling, grayscale normalization CNN-based malware image classification World Journal of Advanced Research and Reviews, 2025, 26(03), 2378-2398 2386 VirusShare Raw binaries Mixed malware families, unlabeled samples Manual labeling, feature engineering Binary-level feature mining CIC-IDS 2017 Network traffic Flow-based attributes, connection statistics Normalization, label encoding Intrusion and anomaly detection Microsoft Malware Classification (BIG 2015) Disassembly, bytecode Opcode sequences, section headers Opcode extraction, ngram modeling Family-level classification with ML/DL TESSERACT IoT traffic and firmware Behavior logs, command sequences Tokenization, timeseries transformation IoT malware pattern detection Table 2 presents leading public datasets (e.g., EMBER, CIC-MalMem, Drebin) along with their feature structures, preprocessing methods, and applicability to static, dynamic, and behavioral modeling. 4.3. Dataset Preprocessing and Labeling Challenges Preprocessing malware datasets is critical to ensure integrity, consistency, and usability of input data. Common tasks include noise reduction, feature normalization, deduplication, and balancing class distributions—particularly important in malware detection where malicious samples are vastly outnumbered by benign ones [23]. Normalization and encoding convert raw indicators (e.g., strings, opcodes, syscalls) into machine-readable formats. Categorical features are often one-hot encoded, while sequences may require vectorization or embedding for deep learning models. Inconsistent formats—such as varying file sizes or registry key structures—must be harmonized to allow batch processing without bias [24]. Class imbalance poses a significant obstacle in supervised learning. Legitimate processes dominate real-world logs, making malware events rare but impactful. Techniques like SMOTE (Synthetic Minority Over-sampling Technique), random under-sampling, or cost-sensitive learning help mitigate skewed data distributions. However, over-sampling risks amplifying noise and synthetic artifacts if not carefully managed [25]. Another core issue is labeling accuracy. Labels are typically inherited from antivirus engines, manual analyst reviews, or honeynet annotations. Yet, even antivirus engines show inconsistency—what one engine flags as “Trojan.Generic” another may classify as “PUA” or miss entirely. Ensemble labeling, using a consensus across AV vendors or sandbox outputs, improves reliability but increases preprocessing overhead [26]. Temporal validity also matters. Malware behaviors evolve, making older datasets partially obsolete. Regular dataset versioning, timestamp alignment, and longitudinal validation help assess model drift and robustness. Moreover, sandbox-evasive malware may behave differently on newer OS versions, necessitating frequent updates to behavioral datasets [27]. Table 2 outlines which datasets offer labeled, balanced, and up-to-date samples suitable for training robust models in distributed detection systems. Dataset curation, balancing, and dynamic updates represent a hidden but essential layer of model integrity. Without rigorous preprocessing, even advanced algorithms underperform or misclassify benign anomalies as threats, compromising system reliability. As such, ongoing dataset maintenance is foundational to sustainable malware intelligence frameworks. 5. Real-time detection framework design 5.1. System Architecture for Distributed ML-Based Detection A robust malware detection system tailored for modern distributed environments must incorporate architectural resilience, real-time data flow, and scalable machine learning components. The architecture typically integrates endpoint agents, edge nodes, centralized analytics engines, and cloud-based orchestration frameworks [19]. World Journal of Advanced Research and Reviews, 2025, 26(03), 2378-2398 2393 Figure 5 End-to-End Flow of Intelligent Malware Detection Lifecycle 8.2. Model Drift, Scalability, and Adaptability As malware detection systems operate over time, they are subject to model drift, where the relationship between features and outcomes changes due to evolving attacker behaviors. Static models, even those that originally performed well, begin to underperform as they fail to recognize emerging evasion strategies or altered execution patterns [50]. A particularly insidious challenge is covariate shift, where input data distributions change but the underlying functional relationships remain. For example, if malware increasingly adopts cloud-native features or obfuscates using AIgenerated code, models trained on prior file-based threats may exhibit degraded recall without warning [51]. To counteract this, modern pipelines implement drift detectors that monitor distribution changes and trigger model retraining when drift is significant. Approaches such as online learning and incremental learning allow the model to adapt continuously, ingesting and learning from new data in real time without full retraining from scratch [52]. Scalability is another consideration. As environments become more complex—with edge devices, containerized services, and multicloud architectures—the volume of telemetry data grows exponentially. ML infrastructure must scale horizontally, balancing inference latency with detection accuracy. Distributed computing frameworks like Apache Spark, coupled with optimized data sharding and federated learning techniques, help manage this growth [53]. Model adaptability also extends to hardware heterogeneity. Lightweight models optimized through pruning or quantization are necessary for edge deployments where GPU or TPU availability is limited. Conversely, centralized systems can deploy deep ensemble architectures for higher accuracy [54]. Ultimately, resilience to drift, capacity to scale across hybrid ecosystems, and flexible deployment are non-negotiable for sustainable ML-based cybersecurity systems [55]. 8.3. Ethics, Explainability, and Regulatory Constraints Beyond technical robustness, intelligent malware detection systems must also grapple with ethical considerations, explainability requirements, and regulatory obligations—especially when deployed in sensitive domains such as healthcare, critical infrastructure, or government systems [56]. A major ethical concern involves automated false positives leading to unwarranted access restrictions, reputational harm, or operational disruptions. In public sector environments, a misclassified benign file flagged as malware could World Journal of Advanced Research and Reviews, 2025, 26(03), 2378-2398 2394 interrupt citizen services or emergency protocols. Hence, maintaining human-in-the-loop oversight and escalation channels is essential [57]. Explainability has gained traction as a prerequisite for operational trust and regulatory compliance. Many ML models, particularly deep learning architectures, are perceived as black boxes. Techniques like SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-Agnostic Explanations) are being integrated to reveal why a model flagged a specific file or process, aiding forensic analysis and user confidence [58]. These needs are even more pronounced under data protection regulations like the GDPR, HIPAA, and national cybersecurity frameworks. Automated decision-making that affects individuals—such as blocking their access to data or systems—must be explainable, reversible, and subject to appeal. This is not merely a best practice but a legal requirement in many jurisdictions [59]. In addition, some adversarial ML practices used for hardening models (e.g., generating evasive malware samples for training) may raise concerns under dual-use technology restrictions. Organizations must implement governance frameworks to ensure these capabilities are not misused or exposed [60]. As Figure 5 illustrates, these ethical and compliance checks are embedded across the ML lifecycle, from data curation through model validation and operational deployment, forming a continuous accountability loop. 9. Conclusion 9.1. Summary of Contributions and Insights This study has explored the full spectrum of intelligent malware detection across distributed environments, bridging both conceptual and applied dimensions. Beginning with an examination of the evolving cyber threat landscape, the work emphasized how traditional detection systems—rooted in signature-based and rule-centric logic—fall short when confronted with polymorphic, stealthy, and rapidly evolving threats in decentralized digital infrastructures. We articulated the taxonomy of malware behaviors, matched it against attack vectors specific to IoT, enterprise, and industrial systems, and highlighted the inadequacies of static defenses in such dynamic contexts. By integrating supervised, unsupervised, and deep learning models—including ensemble and hybrid architectures—the article illustrated how machine learning offers adaptive, behavior-based classification suited to modern cyberattack techniques. Crucially, the study emphasized the significance of real-time detection, federated learning, and feature engineering across heterogeneous datasets. The role of system architecture, scalable model deployment, and context-specific use cases—particularly in smart homes, enterprise networks, and industrial control systems—demonstrated the operational feasibility of AI-enhanced cybersecurity. Challenges like data quality, drift, ethical constraints, and explainability were not treated as peripheral, but as structural concerns to be addressed in future-proof malware detection. Visualization through figures and tables helped distill insights on performance, system integration, and lifecycle flow. Ultimately, this investigation contributes a multilayered understanding of the evolving intersection between cybersecurity and intelligent machine learning, mapping both current best practices and forward-looking innovations essential for safeguarding digital ecosystems. 9.2. Strategic Role of ML in Future Cybersecurity Ecosystems Looking ahead, machine learning is poised to become not just a tool but a strategic enabler in the transformation of cybersecurity ecosystems. As digital infrastructures grow more distributed—extending from cloud environments to edge and embedded devices—the capacity to autonomously detect, analyze, and respond to threats in real time will define operational resilience. Future ML-driven systems must be context-aware, self-learning, and dynamically scalable. They will need to adapt to new code obfuscation techniques, evade sophisticated adversarial attacks, and accommodate regulatory and ethical demands around transparency. In this sense, machine learning is evolving toward an ecosystem-level utility, orchestrating threat intelligence across jurisdictions, devices, and layers of the digital stack. World Journal of Advanced Research and Reviews, 2025, 26(03), 2378-2398 2395 Federated learning will emerge as a privacy-preserving model for securing medical, financial, and industrial systems where data centralization is either infeasible or noncompliant. Real-time streaming analytics powered by continual learning algorithms will allow early detection of zero-day threats, while hybrid models will bridge the gap between local resource constraints and cloud-enabled computational power. Furthermore, the integration of ML with other technologies—such as blockchain for traceability, GIS for threat mapping, and digital twins for simulation—will unlock more granular and predictive defense capabilities. These systems will form the backbone of proactive cyber governance across both private and public sectors. In summary, the strategic application of machine learning in cybersecurity is not a matter of technological novelty, but one of critical infrastructure protection. Its successful deployment will shape the resilience, privacy, and trustworthiness of digital societies in the years to come. Compliance with ethical standards Disclosure of conflict of interest No conflict of interest to be disclosed. References [1] Dey S, Sarma W, Tiwari S. Deep learning applications for real-time cybersecurity threat analysis in distributed cloud systems. World Journal of Advanced Research and Reviews. 2023;17(3):1044-58. [2] Joseph Chukwunweike, Andrew Nii Anang, Adewale Abayomi Adeniran and Jude Dike. Enhancing manufacturing efficiency and quality through automation and deep learning: addressing redundancy, defects, vibration analysis, and material strength optimization Vol. 23, World Journal of Advanced Research and Reviews. GSC Online Press; 2024. Available from: https://dx.doi.org/10.30574/wjarr.2024.23.3.2800 [3] Kumar M. Scalable malware detection system using big data and distributed machine learning approach. Soft Computing. 2022 Apr;26(8):3987-4003. [4] Alawode A. Evaluating Agricultural Subsidy Reforms and their Effects on Smallholder Farmer Income and Efficiency. Vol. 2, International Journal of Advance Research Publication and Reviews. Zenodo; 2025 May p. 180– 201. [5] Jin S, Guo Z, Liu D, Yang Y. A Study on the Application of Distributed System Technology‐Guided Machine Learning in Malware Detection. Computational Intelligence and Neuroscience. 2022;2022(1):4977898. [6] Ejedegba Emmanuel Ochuko. Advancing green energy transitions with eco-friendly fertilizer solutions supporting agricultural sustainability. Int Res J Mod Eng Technol Sci. 2024 Dec;6(12):1970. Available from: https://www.doi.org/10.56726/IRJMETS65313 [7] Chukwunweike J. Design and optimization of energy-efficient electric machines for industrial automation and renewable power conversion applications. Int J Comput Appl Technol Res. 2019;8(12):548–560. doi: 10.7753/IJCATR0812.1011. [8] Shamili AS, Bauckhage C, Alpcan T. Malware detection on mobile devices using distributed machine learning. In2010 20th International Conference on Pattern Recognition 2010 Aug 23 (pp. 4348-4351). IEEE. [9] Odeniran OM. Exploring the Potential of Bambara Groundnut Flour as an Alternative for Diabetic and Obese Patients in the USA: A Comprehensive Review. Cureus. 2025 Jan 30;17(1). [10] Kozik R, Choraś M, Ficco M, Palmieri F. A scalable distributed machine learning approach for attack detection in edge computing environments. Journal of Parallel and Distributed Computing. 2018 Sep 1;119:18-26. [11] Ogundu Precious Ginika. The strategic implications of financial derivatives in hedging corporate exposure to global economic volatility. World J Adv Res Rev. 2025;25(2):1218–34. Available from: https://doi.org/10.30574/wjarr.2025.25.2.0482 [12] Ajayi R. Integrating IoT and cloud computing for continuous process optimization in real-time systems. Int J Res Publ Rev. 2025 Jan;6(1):2540–2558. doi:10.55248/gengpi.6.0125.0441. World Journal of Advanced Research and Reviews, 2025, 26(03), 2378-2398 2396 [13] Ejedegba Emmanuel Ochuko. Synergizing fertilizer innovation and renewable energy for improved food security and climate resilience. Int J Res Publ Rev. 2024 Dec;5(12):3073–88. Available from: https://doi.org/10.55248/gengpi.5.1224.3554 [14] Chukwunweike Joseph, Salaudeen Habeeb Dolapo. Advanced Computational Methods for Optimizing Mechanical Systems in Modern Engineering Management Practices. International Journal of Research Publication and Reviews. 2025 Mar;6(3):8533-8548. Available from: https://ijrpr.com/uploads/V6ISSUE3/IJRPR40901.pdf [15] Chaganti R, Ravi V, Pham TD. Deep learning based cross architecture internet of things malware detection and classification. Computers and Security. 2022 Sep 1;120:102779. [16] Chibogwu Igwe-Nmaju. Organizational communication in the age of APIs: integrating data streams across departments for unified messaging and decision-making. International Journal of Research Publication and Reviews. 2024 Dec;5(12):2792–2809. Available from: https://ijrpr.com/uploads/V5ISSUE12/IJRPR36937.pdf [17] Aslan Ö, Yilmaz AA. A new malware classification framework based on deep learning algorithms. Ieee Access. 2021 Jun 15;9:87936-51. [18] Aidoo EM. Community based healthcare interventions and their role in reducing maternal and infant mortality among minorities. International Journal of Research Publication and Reviews. 2024 Aug;5(8):4620–36. Available from: https://doi.org/10.55248/gengpi.6.0325.1177 [19] Nath HV, Mehtre BM. Static malware analysis using machine learning methods. InInternational Conference on Security in Computer Networks and Distributed Systems 2014 Mar 13 (pp. 440-450). Berlin, Heidelberg: Springer Berlin Heidelberg. [20] Adedapo Alawode, Obunadike ThankGod Chiamaka. Linking structured commodity markets with formal agricultural finance to improve value chain transparency and inclusion. International Journal of Advance Research Publication and Reviews. 2024 Dec;1(4):87–109. Available from: https://ijarpr.com/uploads/V1ISSUE4/IJARPR0207.pdf [21] Sayadi H, Patel N, Sasan A, Rafatirad S, Homayoun H. Ensemble learning for effective run-time hardware-based malware detection: A comprehensive analysis and classification. InProceedings of the 55th Annual Design Automation Conference 2018 Jun 24 (pp. 1-6). [22] Emmanuel Ochuko Ejedegba. INTEGRATED STRATEGIES FOR ENHANCING GLOBAL FOOD SECURITY AMID SHIFTING ENERGY TRANSITION CHALLENGES. International Journal of Engineering Technology Research and Management (ijetrm). 2024Dec16;08(12). [23] Vinayakumar R, Alazab M, Soman KP, Poornachandran P, Venkatraman S. Robust intelligent malware detection using deep learning. IEEE access. 2019 Apr 3;7:46717-38. [24] Alawode Adedapo. The role of agricultural value chains in enhancing food security and economic development. Int Res J Mod Eng Technol Sci. 2025 May;7(5):1930. Available from: https://www.doi.org/10.56726/IRJMETS75996 [25] Ugwueze VU, Chukwunweike JN. Continuous integration and deployment strategies for streamlined DevOps in software engineering and application delivery. Int J Comput Appl Technol Res. 2024;14(1):1–24. doi:10.7753/IJCATR1401.1001. [26] Aslan Ö, Ozkan-Okay M, Gupta D. Intelligent behavior-based malware detection system on cloud computing environment. IEEE Access. 2021 Jun 7;9:83252-71. [27] Dorgbefu EA. Leveraging predictive analytics for real estate marketing to enhance investor decision-making and housing affordability outcomes. Int J Eng Technol Res Manag. 2018;2(12):135. Available from: https://doi.org/10.5281/zenodo.15708955. [28] Gaurav A, Gupta BB, Panigrahi PK. A comprehensive survey on machine learning approaches for malware detection in IoT-based enterprise information system. Enterprise Information Systems. 2023 Mar 4;17(3):2023764. [29] Ejedegba Emmanuel Ochuko. Innovative solutions for food security and energy transition through sustainable fertilizer production techniques. World J Adv Res Rev. 2024;24(3):1679–95. Available from: https://doi.org/10.30574/wjarr.2024.24.3.3877 [30] Tayyab UE, Khan FB, Durad MH, Khan A, Lee YS. A survey of the recent trends in deep learning based malware detection. Journal of Cybersecurity and Privacy. 2022 Sep 28;2(4):800-29. World Journal of Advanced Research and Reviews, 2025, 26(03), 2378-2398 2397 [31] Chibogwu Igwe-Nmaju. AI and automation in organizational messaging: ethical challenges and human-machine interaction in corporate communication. International Journal of Engineering Technology Research and Management. 2021 Dec;5(12):256. Available from: doi: https://doi.org/10.5281/zenodo.15562214 [32] Junejo KN, Goh J. Behaviour-based attack detection and classification in cyber physical systems using machine learning. InProceedings of the 2nd ACM international workshop on cyber-physical system security 2016 May 30 (pp. 34-43). [33] Alawode Adedapo. Assessing climate change impacts on agricultural productivity and rural livelihoods in SubSaharan Africa. Int J Res Publ Rev. 2025 May;6(5):4508-4523. Available from: https://doi.org/10.55248/gengpi.6.0525.1734 [34] Baptista I, Shiaeles S, Kolokotronis N. A novel malware detection system based on machine learning and binary visualization. In2019 IEEE international conference on communications workshops (ICC workshops) 2019 May 20 (pp. 1-6). IEEE. [35] Dorgbefu EA. Driving equity in affordable housing with strategic communication and AI-based real estate investment intelligence. International Journal of Computer Applications Technology and Research. 2019;8(12):561–74. Available from: https://doi.org/10.7753/IJCATR0812.1012 [36] Ajayi R, Adedeji BS. Neural network-based face detection for emotion recognition in mental health monitoring. Int J Res Publ Rev. 2024 Dec;5(12):4945–4963. [37] Ndubuisi Amarachi F. Cybersecurity incident response and crisis management in the United States. Int J Comput Appl Technol Res. 2025;14(1):79-92. Available from: https://doi.org/10.7753/IJCATR1401.1006 [38] Chen S, Xue M, Fan L, Hao S, Xu L, Zhu H, Li B. Automated poisoning attacks and defenses in malware detection systems: An adversarial machine learning approach. computers and security. 2018 Mar 1;73:326-44. [39] Senaya GM. Financial literacy and its role in promoting sustainable investment. World Journal of Advanced Research and Reviews. 2024;24(01):212–232. doi: https://doi.org/10.30574/wjarr.2024.24.1.2986. [40] Aslam M, Ye D, Tariq A, Asad M, Hanif M, Ndzi D, Chelloug SA, Elaziz MA, Al-Qaness MA, Jilani SF. Adaptive machine learning based distributed denial-of-services attacks detection and mitigation system for SDN-enabled IoT. Sensors. 2022 Mar 31;22(7):2697. [41] Dorgbefu EA. Using business analytics to tailor real estate messaging for inclusive housing solutions and investment impact. Int J Eng Technol Res Manag. 2020;4(12):156. Available from: https://doi.org/10.5281/zenodo.15708955. [42] Aljuhani A. Machine learning approaches for combating distributed denial of service attacks in modern networking environments. IEEE Access. 2021 Mar 1;9:42236-64. [43] Adedapo Alawode. Assessing climate change impacts on agricultural productivity and rural livelihoods in SubSaharan Africa. International Journal of Research Publication and Reviews (2025). Available from: https://doi.org/10.55248/gengpi.6.0525.1734 [44] Li Y, Xiong K, Chin T, Hu C. A machine learning framework for domain generation algorithm-based malware detection. IEEE Access. 2019 Jan 31;7:32765-82. [45] Ndubuisi Amarachi F. The intersection of false projections, identity manipulation, and emerging financial cybercrime threats. Int J Res Publ Rev. 2024 Dec;5(12):5529-5546. Available from: https://doi.org/10.55248/gengpi.5.1224.0237 [46] Ajayi R, Masunda M. Integrating edge computing, data science and advanced cyber defense for autonomous threat mitigation. Int J Sci Res Arch. 2025 May;15(2):63–80. doi:10.30574/ijsra.2025.15.2.1292. [47] Awan MJ, Farooq U, Babar HM, Yasin A, Nobanee H, Hussain M, Hakeem O, Zain AM. Real-time DDoS attack detection system using big data approach. Sustainability. 2021 Jan;13(19):10743. [48] Adenuga, T., Ayobami, A.T., Mike-Olisa, U. and Okolo, F.C., 2024. Leveraging generative AI for autonomous decision-making in supply chain operations: A framework for intelligent exception handling. International Journal of Computer Sciences and Engineering, 12(5), pp.92–102. Available at: https://doi.org/10.32628/CSEIT24102138. [49] Ajayi R, Ibrahim KA, Tambuwal MM. A review on the challenges and future of energy consumption in edge computing. Int J Math Stat Comput Sci. 2023;1(3):17–32. World Journal of Advanced Research and Reviews, 2025, 26(03), 2378-2398 2398 [50] Chukwunweike J, Lawal OA, Arogundade JB, Alade B. Navigating ethical challenges of explainable AI in autonomous systems. International Journal of Science and Research Archive. 2024;13(1):1807–19. doi:10.30574/ijsra.2024.13.1.1872. Available from: https://doi.org/10.30574/ijsra.2024.13.1.1872. [51] Woźniak M, Siłka J, Wieczorek M, Alrashoud M. Recurrent neural network model for IoT and networking malware threat detection. IEEE Transactions on Industrial Informatics. 2020 Sep 4;17(8):5583-94. [52] Dorgbefu EA. Translating complex housing data into clear messaging for real estate investors through modern business communication techniques. International Journal of Computer Applications Technology and Research. 2018;07(12):485–499. Available from: https://doi.org/10.7753/IJCATR0712.1010 [53] Enuma Edmund. Implementing customer-identity management to combat SIM-card fraud: a security framework for emerging market telcos. Int J Comput Appl Technol Res. 2017;6(12):533–49. Available from: https://doi.org/10.7753/IJCATR0612.1011 [54] Senaya G. Mitigating financial risks for entrepreneurs in emerging markets through financial literacy. World Journal of Advanced Research and Reviews. 2025 Jan;25(1):602–620. doi: https://doi.org/10.30574/wjarr.2025.25.1.0059. [55] Asif M, Abbas S, Khan MA, Fatima A, Khan MA, Lee SW. MapReduce based intelligent model for intrusion detection using machine learning technique. Journal of King Saud University-Computer and Information Sciences. 2022 Nov 1;34(10):9723-31. [56] Adedapo Alawode, and Obunadike ThankGod Chiamaka. EVALUATING FINANCIAL DERIVATIVES IN AGRICULTURAL RISK MANAGEMENT: IMPLICATIONS FOR MARKET STABILITY AND PRICE TRANSMISSION. International Journal Of Engineering Technology Research and Management (IJETRM). 2023Dec21;07(12):410– 26. [57] Dong Y, Wang R, He J. Real-time network intrusion detection system based on deep learning. In2019 IEEE 10th International Conference on Software Engineering and Service Science (ICSESS) 2019 Oct 18 (pp. 1-4). IEEE. [58] Adeoluwa Abraham Olasehinde, Anthony Osi Blessing, Somadina Obiora Chukwuemeka. DEVELOPMENT OF BIOPHOTONIC FEEDBACK SYSTEMS FOR REAL-TIME PHENOTYPIC RESPONSE MONITORING IN INDOOR CROPS. International Journal of Engineering Technology Research and Management (IJETRM). 2024Dec21;08(12):486– 506. [59] Baek S, Jeon J, Jeong B, Jeong YS. Two-stage hybrid malware detection using deep learning. Human-centric Computing and Information Sciences. 2021 Jun 30;11(27):10-22967. [60] Gandotra E, Bansal D, Sofat S. Malware analysis and classification: A survey. Journal of Information Security. 2014 Feb 20;2014. [61] Odumbo OR. Explainable AI and Federated Learning in Healthcare Supply Chain Intelligence: Addressing Ethical Constraints, Bias Mitigation, and Regulatory Compliance for Global Pharmaceutical Distribution. International Journal of Computer Applications Technology and Research. 2025;14(4):16–29. doi:10.7753/IJCATR1404.100