HYBRID STATIC-DYNAMIC ANALYSIS FRAMEWORK FOR ZERO-DAY MALWARE DETECTION

Abstract

The proliferation of polymorphic, metamorphic, and heavily obfuscated malicious software necessitates an evolution in cybersecurity paradigms. Traditional signature-based systems and isolated heuristic approaches repeatedly fail to capture zero-day exploits—novel threats exploiting unpatched vulnerabilities. This comprehensive research proposes a highly optimized hybrid static-dynamic analysis architecture explicitly designed to detect zero-day malware. By systematically fusing structural features extracted via static disassembly (e.g., opcodes, API imports, PE headers) with behavioral artifacts harvested during hypervisor-based dynamic execution (e.g., system calls, network telemetry, memory fluctuations), our framework achieves superior detection efficacy. Furthermore, we address the computational bottlenecks traditionally associated with hybrid systems by introducing an early-triage mechanism and a lightweight ensemble Deep Neural Network (DNN) fused with a sequence-aware Transformer model. Extensive evaluations demonstrate that the proposed architecture achieves a 96% zero-day detection rate while reducing standard dynamic analysis overhead by 62%.