Rank fusion improves malware detection in three longitudinal benchmarks, with threshold drift limiting gains

A study reported in Scientific Reports found that combining the rankings of a tuned group-token transformer with LightGBM improved detection of evasive and previously unseen malware on three longitudinal benchmarks, although the benefit depended on the false-positive threshold and how that threshold was calibrated. The results are summarized from the article abstract; the supplied evidence does not include the full study. On EMBER2024, rank fusion raised Win32 challenge-set detection from 63.2% to 68.8% at a 1% false-positive rate, with a 95% confidence interval for the gain of +4.7 to +6.6 percentage points. It also increased novel-family detection from 89.1% to 91.8% and overall test true-positive rate from 96.8% to 97.3%. Significant challenge-set gains were reported for .NET files, at +1.6 points, and APK files, at +3.9 points.

The researchers evaluated three datasets: EMBER2024, containing 3.2 million Windows, .NET, APK, ELF and PDF files with 52 training weeks, 12 test weeks and 6,315 files that had initially evaded every antivirus engine; LAMDA, containing 1.0 million Android applications from 2013–2025 and using in-distribution, near-future and far-future drift conditions; and BODMAS, containing 134,000 PE files from 2019–2020 with monthly evaluation. The proposed protocol assessed true-positive and false-positive rates, challenge-set and novel-family detection, singleton and low-consensus cases, weekly and annual drift, thresholds calibrated on time-aware validation data, and paired-bootstrap confidence intervals. The modeling work included GT-Former, a transformer operating over groups of semantic features; FR-MoE, a format-routed mixture of experts; and ProtoCon-Net, a prototype classifier trained with family-aware supervised-contrastive loss. Three training objectives based on antivirus consensus and family labels were also tested with ablations.

LightGBM remained the strongest individual model at strict operating points on EMBER2024. At a 0.1% false-positive rate on Win32, it achieved a 90.0% true-positive rate, compared with 88.1 ± 0.4% for tuned GT-Former across five seeds. On BODMAS, the GT-Former/LightGBM fusion matched LightGBM’s 99.85% detection at a 1% false-positive rate. At 0.1%, fusion increased detection from 98.9% to 99.5% and novel-family detection from 94.7% to 97.1%. The metadata-driven objectives did not improve the plain model independently on LAMDA. With five seeds per variant, their combination reduced near-future true-positive rate at a 0.1% false-positive rate from 10.1 ± 2.3% to 4.4 ± 3.7%, indicating that these objectives did not justify their added complexity in that setting.

On LAMDA, rank averaging an MLP with LightGBM increased far-future detection for 2018–2025 from 40.5% to 54.4% at a 1% false-positive rate, with the gain’s 95% confidence interval running from +13.7 to +14.0 points. Singleton-family detection rose from 34.6% to 53.3% when the threshold was calibrated on benign files in the test region. Under a different deployment condition—a threshold fixed on validation data and applied unchanged—the authors reported that both models performed far below their nominal budgets after 12 years of drift and the fusion advantage fell to 0.1 points. The authors therefore treated the unchanged-threshold result as the more conservative deployment estimate. SHAP analysis and CLS attention were used to examine model evidence; the abstract reports that the benchmark’s strongest signals included suspicious section flags and missing signatures, which may be absent from evasive malware.

The findings are limited to the supplied benchmarks, formats, models and evaluation conditions, and the substantial variation across random seeds made single-seed ablations unreliable. The LAMDA threshold results also show that improvements under test-region calibration should not be interpreted as equivalent to gains under an unchanged operational threshold. The abstract reports that code, de-duplication masks, models and score files are released, which may permit independent evaluation, but it provides no evidence of performance outside the studied datasets.

Subject of Research: Evaluation of rank-fused transformer and gradient-boosting models for static malware detection across longitudinal file datasets

Article Title: Hybrid rank fusion of a group-token transformer with gradient boosting improves detection of evasive and novel-family malware

Article References: Tawfik, M., Al-sellami, B., Heshmat, M., Fathi, I. S., & Shaban, W. M. (2026). Hybrid rank fusion of a group-token transformer with gradient boosting improves detection of evasive and novel-family malware. Scientific Reports. https://doi.org/10.1038/s41598-026-75034-w

Image Credits: AI Generated

DOI: 10.1038/s41598-026-75034-w

Keywords: malware detection, machine learning, rank fusion, GT-Former, LightGBM, concept drift, longitudinal benchmarks, novel malware families, false-positive rate, explainability, Hybrid, rank