Efficient Malware Classification using HMM Log-Likelihood Vectors and Lightweight Machine Learning Models

Hidden Markov models (HMMs) have proven effective in capturing the sequential behavior of malware through opcode sequences. While prior work has combined HMMs with convolutional neural networks (CNNs) by transforming HMM outputs into images for deep learning, such methods are computationally intensive and less suited for real-time or resource-constrained environments. In this work, we propose an efficient malware classification framework that eliminates the need for image transformation by directly leveraging HMM log-likelihood vectors (HLLVs) as features. For each malware sample, we compute log-likelihoods across class-specific HMMs to form a compact, discriminative feature vector used to train lightweight classifiers. Experimental results on the CICMalDroid2022 dataset demonstrate that our proposed HLLV+SVM model achieves a classification accuracy of 95.1%, with an F1-score of 95.1%, outperforming standard SVM, MLP, and Random Forest classifiers in both accuracy and training efficiency. Compared to CNN-based hybrids, our approach reduces training time significantly, achieving a 32% faster training time than XGBoost and a 57% reduction compared to MLP, while maintaining high precision and recall. These findings highlight the practicality and scalability of using HMM log-likelihood-based representations for interpretable malware classification.