Enterprise AI Analysis

Framework Architecture & Feature Selection

To overcome current challenges in malware detection, this paper introduces a hybrid framework that integrates the Harris Hawks Optimization (HHO) and Bat Algorithm (BA) for efficient malware detection. The proposed hybrid framework uses customized Extra Trees (ET) and XGBoost classifiers for URL-based malware classification. Key objectives include union-based feature selection (HHO∪BA) to combine diverse, informative features, achieving a 35.4% dimensionality reduction while boosting accuracy. Intersection-based feature selection (HHO∩BA) focuses on common features for lightweight, latency-sensitive environments, achieving an 82.3% dimensionality reduction. An ensemble classification model using ET and XGBoost leverages the strengths of bagging and boosting for robust detection. Hyperparameter optimization through Grid Search (GS) ensures optimal learning configurations, and robust K-fold cross-validation is used for performance evaluation.

The proposed malware detection framework details data preprocessing steps, a feature selection approach based on HHO and BA bio-inspired algorithms, and a classification process using selected ML models. This methodology ensures a clean, scaled, and optimized input space, which enhances predictive performance and interpretability of the final trained model.

This study proposes two complementary hybrid feature selection strategies: union-based and intersection-based approaches. The union strategy merges selected features from HHO and BA, leveraging strengths for a broader, more diverse set of informative attributes. This reduces bias and improves the exploration-exploitation balance. In contrast, the intersection strategy retains only common features from both algorithms, promoting consensus for highly relevant and stable features. This is advantageous in time-critical or resource-constrained environments where aggressive feature space reduction is needed to improve model speed and efficiency, enhancing robustness and reducing noise.

Performance Metrics & Strategic Trade-offs

The HHOUBA method consistently demonstrated superior performance across all evaluated metrics using both XGBoost and ET classifiers. It achieved the highest accuracies (99.52% and 99.50% respectively), recalls (99.53% and 99.50%), precisions (99.52% and 99.51%), and F1-scores (99.52% and 99.50%). This highlights HHOUBA's ability to capture a richer and more discriminative set of features, resulting in minimal classification error and robust discrimination between malicious and benign URLs. The high recall indicates effective detection of threats, while high precision minimizes incorrect labeling of legitimate URLs, ensuring accurate malware detection without excessive false alarms.

The HHOUBA method demonstrated the best trade-off between computational cost and detection performance. Compared to the NoFs configuration, HHOUBA reduced training time by up to 13.7% (XGBoost) and 0.8% (ET), and inference time by 27.6% (XGBoost) and 0.01% (ET), while achieving higher accuracy (99.52% vs. 99.48%). While HHO∩BA yielded the lowest computation times, it came at the cost of 0.27% and 0.17% drop in accuracy compared to HHOUBA, demonstrating a clear trade-off between speed and detection performance.

Trade-offs: HHO∪BA vs. HHO∩BA for Real-time Malware Detection

Enterprise Deployment & Real-world Impact

The experimental results confirm the effectiveness of the HHOUBA hybrid feature selection method in enhancing malware detection. Among all tested configurations, HHOUBA consistently achieved the highest accuracy (99.52%), outperforming all other methods (NoFs, BA, HHO, HHO∩BA) and referenced deep learning models evaluated on different datasets. Notably, even the lowest-performing variant, HHO∩BA, outperformed all referenced methods, demonstrating the strength of the bio-inspired optimization strategies.

These results demonstrate the deployment readiness of the proposed methods across a range of real-world scenarios. HHOUBA is particularly suitable for real-time malware detection in cloud-based IDS, enterprise-level endpoint protection, and network traffic monitoring systems, where both accuracy and response speed are critical. In contrast, HHO∩BA is better suited for latency-sensitive or resource-constrained environments, such as IoT security gateways, mobile antivirus applications, or edge computing nodes, where fast inference is prioritized over peak accuracy. The ability to tailor feature selection to the requirements of specific applications reflects the versatility and adaptability of the proposed framework in modern cybersecurity systems.