Malware Detection Using Cuckoo Sandbox Report Features as Human Readable Description and the BERT Model

The ever-evolving nature of malware renders conventional detection techniques increasingly ineffective against adaptive threats. This work proposes a behavior-driven detection framework that converts dynamic sandbox reports into human-readable narratives and learns semantic patterns with a fine-tuned BERT model. The narrative transformation captures higher-order relations among system activities (e.g., process creation, registry persistence, and network communication), enabling contextual representation beyond handcrafted features. Validation was conducted on both a controlled Cuckoo-based benchmark (binary) and the large-scale public Avast–CTU CAPEv2 dataset (ten malware families). On CAPEv2, the method achieved 96.2% accuracy and 95.8% macro-F1 under chronological partitioning, and strong performance under 5-fold cross-validation, outperforming TF–IDF +SVM baselines. Robustness studies with textual perturbations (token masking and synonym substitution at 5–20%) and time-aware evaluation indicate resilience to obfuscation and temporal drift. An ablation analysis shows that narrative-based modeling improves accuracy by ≈12 percentage points over raw feature baselines and by ≈5 points over TF–IDF representations, highlighting the contribution of semantic abstraction. Besides accuracy, the approach can provide practical interpretability: the predictions can be traced back to behavioral descriptive indicators, allowing analyst auditability and forensic use. These results show that behavioral data contextualized language modeling is a scalable, explainable, and generalizable next-generation basis for malware detection.