Abstract

Malware detection has become an increasingly difficult learning problem because modern malicious software is intentionally shaped to evade fixed signatures, conceal structural indicators, and delay harmful behavior until favorable operating conditions are observed. This article presents a hybrid static-behavioral framework that integrates two complementary evidential views: structural properties obtained without running an executable, and behavior-level observations collected inside a controlled analysis environment. The structural branch uses an XGBoost classifier, whereas the behavioral branch uses a Random Forest classifier optimized for heterogeneous system-event evidence. A class-balance correction strategy is applied only within the development subset, and a transparent stacked decision layer combines the calibrated confidence scores of the two branches. The available behavioral corpus contains 43,876 labeled records with 108 attributes and an imbalance ratio of approximately 39.66:1 in favor of malicious records. Evaluation is reported through accuracy, balanced accuracy, precision, recall, F1-score and Matthew’s correlation coefficient. The proposed hybrid decision achieves a balanced accuracy of 0.95 and an MCC of 0.90, outperforming single-view alternatives in the most distribution-sensitive measures.