Paper deep dive
A Hybrid Approach to Malware Detection: Integrating Few-Shot Model-Agnostic Meta-Learning with Autoencoders
Emmanuela Andam, Yasir Abbas Zaidi, Abdelali Hadir, Emmanuel Grant, Naima Kaabouch
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 10/4/2026, 2:09:48 AM
Summary
This paper proposes a hybrid deep learning framework for few-shot malware detection, integrating an Autoencoder Feature Extractor (AFE) with a Model-Agnostic Meta-Learning (MAML) classifier. The AFE reduces dimensionality and noise by generating compact latent features, while MAML enables rapid adaptation to new malware variants using limited labeled data. Experiments on the Ransomware Dataset 2024 demonstrate high accuracy and robustness across 1 to 50-shot settings, outperforming traditional methods in scenarios with scarce data.
Entities (8)
Relation Signals (7)
AFE-MAML â evaluatedon â Ransomware Dataset 2024
confidence 98% ¡ Experiments conducted on the Ransomware Dataset 2024 demonstrate the effectiveness of the framework
AFE-MAML â usescomponent â Model-agnostic meta-learning
confidence 95% ¡ The proposed hybrid model... integrates an Autoencoder Feature Extractor with a Model-Agnostic Meta-Learning (MAML) classifier
AFE-MAML â usescomponent â Autoencoder Feature Extractor
confidence 95% ¡ The proposed hybrid model... integrates an Autoencoder Feature Extractor with a Model-Agnostic Meta-Learning (MAML) classifier
AFE-MAML â achieveshighperformancein â Few-shot Learning
confidence 92% ¡ The proposed model consistently achieves high accuracy... maintaining reliable classification even under extreme scarcity.
Ransomware Dataset 2024 â contains â Cerber
confidence 90% ¡ It includes 11 well-known ransomware variants: Cerber...
Ransomware Dataset 2024 â contains â WannaCry
confidence 90% ¡ It includes 11 well-known ransomware variants: ... and WannaCry.
Autoencoder Feature Extractor â performsfunction â dimensionality_reduction
confidence 90% ¡ The AFE generates compact latent features that reduce noise and dimensionality
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Ransomware has emerged as a major cybersecurity threat, with incidents increasing in frequency and impact across critical sectors. These attacks are typically launched through phishing emails, malicious downloads, or exploitation of software vulnerabilities to gain system access. Once inside, the malware encrypts files and demands a ransom, often in cryptocurrency, for the decryption key. Conventional detection methods often struggle with novel or scarce samples, leaving systems vulnerable. To address these challenges, this paper proposes a hybrid deep learning framework that combines an Autoencoder Feature Extractor (AFE) with a Model Agnostic Meta Learning (MAML) classifier for few shot malware detection. The AFE generates compact latent features that reduce noise and dimensionality, while the MAML classifier rapidly adapts to new threats using limited labeled data. Experiments conducted on the Ransomware Dataset 2024 demonstrate the effectiveness of the framework in binary classification tasks. Across one to fifty shot settings, the proposed model consistently achieves high accuracy, F1 score, and Matthews Correlation Coefficient values, maintaining reliable classification even under extreme scarcity. These results highlight the model's robustness and effectiveness in adapting to limited data scenarios, demonstrating the potential of combining feature extraction with meta learning to enhance resilience against malware, particularly in sectors such as healthcare, manufacturing, and public infrastructure, where cyberattacks can cause significant operational and financial disruption.
Tags
Links
- Source: https://arxiv.org/abs/2610.01949v1
- Canonical: https://arxiv.org/abs/2610.01949v1
Trouble viewing inline? Open PDF directly â
Full Text
31,686 characters extracted from source content.
Expand or collapse full text
A Hybrid Approach to Malware Detection: Integrating Few-Shot Model-Agnostic Meta-Learning with Autoencoders Emmanuela Andam 1,2 , Yasir Abbas Zaidi 1,2 , Abdelali Hadir 3 , Emmanuel Grant 2 , and Naima Kaabouch 1,2 1 Artificial Intelligence Research (AIR) Center, University of North Dakota, Grand Forks, ND, USA 2 School of Electrical Engineering and Computer Science, University of North Dakota, Grand Forks, ND, USA 3 National School of Commerce and Management, Hassan I University, Casablanca, Morocco Š 2025 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. AbstractâRansomware has emerged as a major cybersecurity threat, with incidents increasing in frequency and impact across critical sectors. These attacks are typically launched through phishing emails, malicious downloads, or exploitation of software vulnerabilities to gain system access. Once inside, the malware encrypts files and demands a ransom, often in cryptocurrency, for the decryption key. Conventional detection methods often struggle with novel or scarce samples, leaving systems vulnerable. To address these challenges, this paper proposes a hybrid deep learning framework that combines an Autoencoder Feature Extractor (AFE) with a Model Agnostic Meta Learning (MAML) classifier for few shot malware detection. The AFE generates compact latent features that reduce noise and dimensionality, while the MAML classifier rapidly adapts to new threats using limited labeled data. Experiments conducted on the Ransomware Dataset 2024 demonstrate the effectiveness of the framework in binary classification tasks. Across one to fifty shot settings, the proposed model consistently achieves high accuracy, F1 score, and Matthews Correlation Coefficient values, maintaining reliable classification even under extreme scarcity. These results highlight the modelâs robustness and effectiveness in adapting to limited data scenarios, demonstrating the potential of combining feature extraction with meta learning to enhance resilience against malware, particularly in sectors such as healthcare, manufacturing, and public infrastructure, where cyberattacks can cause significant operational and financial disruption. Index Termsâmalwaredetection,model-agnosticmeta- learning (MAML), autoencoder, few-shot learning, feature ex- traction. I. INTRODUCTION The proliferation of connected devices in the Internet of Things (IoT) era has fundamentally reshaped interactions between individuals and digital systems. However, this rapid expansion has also intensified the risk of cyberattacks, with malware representing one of the most prevalent threats. Mal- ware, or malicious software, encompasses any program in- tentionally developed to disrupt, damage, or exploit computer systems and networks. Numerous documented incidents under- score the significant risks and consequences associated with such attacks. For instance, the May 2024 Ascension Health ransomware attack, initiated by a successful phishing attack where an employee downloaded a malicious file, shut down electronic health record systems across multiple states, costing the health system approximately $13 billion and contributing to a $1.8 billion operating loss for fiscal year 2024 [1]. Like- wise, in January 2025, the LOSTKEYS malware campaign targeted NGOs and institutions in developed nations using a phishing lure disguised as a CAPTCHA page, enabling credential theft and the exfiltration of sensitive documents [2]. These cases demonstrate the escalating costs and complexity of cyberattacks, reinforcing the need for robust and adaptive malware detection systems. The escalating financial toll of cybercrime is reflected in the sharp rise in reported losses, which increased from $4.1 billion in 2020 to more than $16.6 billion in 2024, a 33% increase over the previous year. This financial burden is accompanied by a growing number of incidents targeting critical infrastruc- ture [3]. Fig. 1 presents the number of reported ransomware attacks and data breaches across critical infrastructure sectors in 2024 [3]. The Healthcare and Public Health sector recorded the highest number of reported cyber incidents in 2024, including 238 ransomware attacks and 206 data breaches, while the Critical Manufacturing sector reported the greatest number of ransomware cases, totaling 258 [3]. Numerous techniques have been proposed to detect mal- ware attacks. Traditional methods like signature-based and heuristic approaches struggle to keep pace with malware detection [4]. Signature-based techniques rely on predefined patterns of known malware stored in databases [5]. Although effective against known threats, they are unable to detect newly modified or unseen malware variants [6], [7]. Heuristic methods, which analyze code characteristics and execution patterns [8], often produce high false positives in malware detection. Machine learning (ML) models such as Decision Trees (DT) and Support Vector Machines (SVM) are effective in improving the accuracy of detection while reducing false positives [8]. Though these techniques are effective, they are not efficient in detecting new malware attacks and require retraining on massive datasets. One promising approach to handle these shortcomings is the combination of meta-learning and autoencoders. This hybrid approach combines the strengths of both techniques arXiv:2610.01949v1 [cs.CR] 1 Oct 2026 to adaptability, generalization, and anomaly detection. Meta- Fig. 1. Reported Cyber Threats to Critical Infrastructure by Type and Sector, based on data from the FBIâs 2024 Internet Crime Report learning (learning to learn) creates an environment where a model quickly adapts to new tasks by using prior knowledge, so it can detect new, unseen malware variants [9]. An autoen- coder is an unsupervised neural network designed to learn compact representations of input data. It excels at modeling normal network behavior and flagging deviations indicating malicious activity. In this paper, we propose the integration of both architectures, Autoencoder Feature Extractor (AFE) with a Model-Agnostic Meta-Learning (MAML) classifier. This hybrid architecture employs the unsupervised feature learning capability of the autoencoder to create a compact, low-dimensional representation of the data. This compact representation is then used by the MAML classifier, which is optimized to quickly adapt to new few-shot tasks, enabling it to adapt dynamically to evolving malware patterns with minimal training data, thereby addressing the limitations of conventional ML-based models. The remaining of this paper is structured as follows: Section I describes the methodology employed in this study, including the dataset and its preprocessing, model framework, and evalu- ation metrics used to compare the performance of the proposed model with that of others. Section I describes the findings, their significance, and limitations. Section IV concludes the study and discusses broader implications. I. METHODOLOGY In this section, the dataset and data-preprocessing, the proposed hybrid model, and evaluation metrics are discussed as follows: A. Dataset Collection and Preprocessing This study used the Ransom Dataset 2024 from Zenodo.org [10]. This dataset comprises 21,752 samples, equally divided into 10,876 malicious and 10,876 benign samples, providing a balanced distribution suitable for machine learning tasks. It in- cludes 11 well-known ransomware variants: Cerber, DarkSide, Dharma, GandCrab, LockBit, Maze, Phobos, REvil, Ragnar Locker, Ryuk, Shade, and WannaCry. These variants have been responsible for significant cyberattacks in recent years. The dataset captures 72 features describing processes, file activities, registry operations, network behavior, and API/DLL classifications, offering a comprehensive representation of malware behavior essential for effective detection. To prepare the dataset for modeling, preprocessing addresses the het- erogeneity of numerical and categorical features. Categorical features, such as malware family labels, are transformed using label encoding, assigning unique integers to each category to enable numerical processing without introducing ordinal bias. Numerical features are scaled to the range [0, 1] via Min-Max normalization, defined as: x norm = xâ x min x max â x min (1) where x min and x max are the minimum and maximum values of each feature across the dataset.This normalization prevents high-magnitude features (e.g., API call frequencies) from dominating the learning process and accelerates model convergence. To overcome the challenge of detecting new ran- somware variants with limited labeled data, this study employs a few-shot learning paradigm. This approach, a component of meta-learning, trains a model to generalize to unseen classes by learning an effective adaptation strategy from a small number of examples. The methodology is structured around the standard N-way K-shot framework, where a new task is created in each training and evaluation episode. In our work, each task is a binary classification problem designed to differentiate between malware families and benign samples. Therefore, our model is configured for a 2-way K-shot task. This setup is a step toward evaluating the modelâs ability to handle novel threats, which is a requirement in a dynamic cybersecurity environment. For each episode, the dataset is divided into a support set and a query set as shown in Fig. 2. This procedure ensures that the modelâs training and eval- uation accurately reflect the scarcity of labeled data for new threats. To mitigate potential biases from imbalanced classes in sampling, we employ stratified selection, ensuring equal Fig. 2. Few-shot sampling workflow showing dataset partitioning into support (K = 5 per class) and query (N = 2000 per class) sets for MAML training. representation. The specific parameters and their functions are detailed in the following sections: Support Set (X S ,y S ): The support set is a limited collection of labeled samples, referred to as K-shots. This set is used for the inner-loop adaptation phase of the MAML algorithm, directly simulating the practical challenge of having only a handful of labeled samples for a newly emerging threat. Query Set (X Q ,y Q ): The query set is composed of a larger number of samples per class, where Q > K. This set is used to evaluate the modelâs performance after it has adapted using the support set. The query set serves two primary functions: it computes the outer-loop loss during training and provides a reliable measure of the modelâs generalization capabilities during evaluation. The substantial size of the query set ensures that performance metrics are statistically robust and skewed by a small sample size. The core parameters defining the fundamental framework are presented in Table I. B. Proposed Hybrid Model The proposed hybrid model was designed to address the challenges of few-shot learning in malware detection and classification. It integrates an Autoencoder Feature Extractor with a Model-Agnostic Meta-Learning (MAML) classifier to enable effective adaptation to new, unseen malware families using limited labeled samples. The autoencoder provides unsu- pervised feature learning to generate compact 64-dimensional latent representations from raw malware and benign samples, while the MAML component allows for rapid, task-specific fine-tuning during inference. As illustrated in Fig. 3, the complete methodology pipeline begins with stratified few- shot sampling to create balanced support and query sets, fol- lowed by autoencoder-based feature extraction, and culminates in MAML-driven classification for malware detection. The TABLE I CORE FEW-SHOT LEARNING PARAMETERS ParameterValueDescription N (N-way)2Number of distinct classes per task (e.g., malware vs. benign) K (K-shot)5Number of labeled samples per class in the support set Q10,000Number of samples per class in the query set TABLE I ARCHITECTURE OF THE AUTOENCODER AND THE MAML CLASSIFIER Layer NameLayer TypeInput Dim.Output Dim.Activation Encoder Layer 1n.Linear72256ReLU Encoder Layer 2n.Linear256128ReLU Encoder Layer 3n.Linear12864ReLU Latent Space (Vector)-6464- Classifier Layer 1n.Linear64128ReLU Classifier Layer 2n.Linear12864ReLU Classifier Layer 3n.Linear642Softmax components of the modelâs architecture (e.g., encoder/decoder layers) are detailed in Table I. a) Autoencoder Feature Extraction: The AFE is an au- toencoder, a neural network designed for unsupervised learn- ing. Its architecture consists of an encoder and a decoder. The encoder maps high-dimensional input data to a compressed, latent representation, while the decoder attempts to reconstruct the original input from this representation. The AFEâs encoder acts as a robust feature learning network, capturing the most salient features of malware samples in a compressed, low- dimensional latent space. This process reduces the risk of overfitting, which is a pervasive problem when dealing with small training sets. Encoder: This component is a multi-layer feedforward neural network that maps high-dimensional input features, x âR 72 , to a lower-dimensional latent vector, z âR 64 . The encoder architecture compresses the 72-dimensional input features to a 64-dimensional latent vector. The latent space dimension was empirically selected to optimize the trade-off between dimensionality reduction and information preserva- tion. Decoder: This component mirrors the encoderâs architec- ture, attempting to reconstruct the original input (Ëx) from the latent vector (z). The decoder reconstructs the 72-dimensional input from the 64-dimensional latent vector with similar hid- den layers as the encoder. The encoding and decoding process can be defined as z = f enc (x;θ enc ), Ëx = f dec (z;θ dec )(2) where θ enc and θ dec represent the learnable parameters (weights and biases) of the encoder and decoder neural networks, Fig. 3. Pipeline for few-shot malware detection. The process begins with stratified sampling to create support and query sets, followed by an autoencoder for feature extraction, and finally a classifier for malware detection. Fig. 4. Model-Agnostic Meta-Learning training process, showing (a) the inner-loop task adaptation where model parameters are updated based on a taskâs loss, and (b) the outer-loop meta-optimization where the original parameters are updated to improve future adaptation. respectively. These parameters are optimized during training via backpropagation to minimize reconstruction error. The autoencoder is trained to minimize the reconstruction loss, which is the Mean Squared Error (MSE) between the input and the decoderâs output: L AE = 1 N N X i=1 âĽx i â Ëx i ⼠2 (3) Minimizing this loss forces the encoder to capture the most salient features of the data, reducing noise and dimensionality, and improving its generalization capability. After the autoen- coder training, the support and query sets are transformed as follows: Z S = f enc (X S ), Z Q = f enc (X Q )(4) b) Model-Agnostic Meta-Learning Classifier: The latent features extracted from the autoencoder (central panel of Fig. 3) serve as inputs to the MAML classifier, which performs the final malware detection step (right panel of Fig. 3). To enable few-shot adaptation, the MAML algorithm employs a nested optimization loop. As illustrated in Fig. 4), this nested loop includes: Inner Loop (Task Adaptation): For each few-shot task Ď i sampled from p(Ď), a small number of gradient descent steps are taken on the support set. This process updates the modelâs parameters, θ, to task-specific parameters, θ Ⲡi , using the loss on the support set L S : θ Ⲡi = θâ Îąâ θ L S (θ)(5) where Îą is the inner-loop learning rate. Outer Loop (Meta-Optimization): The performance of these adapted parameters, θ Ⲡi , is then evaluated on the query set. The original parameters, θ, are updated based on the performance of the adapted parameters to improve future adaptation. The outer-loop update is: θ â θâ βâ θ X i L Q (θ Ⲡi )(6) where β is the meta-learning rate. TABLE I SUMMARY OF EVALUATION METRICS MetricFormulaPurpose Accuracy T P + T N T P + T N + F P + F N Proportion of correct predic- tions out of all predictions. Precision T P T P + F P Accuracy of positive predic- tions. Recall T P T P + F N Ability to detect all positive samples. F1-Score 2¡ Precision¡ Recall Precision + Recall Balance between precision and recall. MCC T P¡ T Nâ F P¡ F N r (T P + F P)¡ (T P + F N) ¡(T N + F P)¡ (T N + F N) Robust score even with im- balanced data. This meta-gradient update learns an initialization that is sensitive to task-specific changes, allowing the model to adapt rapidly and generalize effectively to unseen malware categories c) Evaluation Metrics: In this work, we evaluated and compared the performance of the proposed model with those of other techniques in terms of metrics derived from the con- fusion matrix (comprising true positives (TP), true negatives (TN), false positives (FP), and false negatives (FN)). The metrics, along with their formulas and purposes, are detailed in Table I. I. RESULTS AND DISCUSSION The experiments were conducted across various few-shot settings to simulate real-world conditions where labeled mal- ware samples are limited and the model must adapt quickly to evolving threats or new malware variants. The performance is assessed using the metrics presented in Table I. All experiments were carried out on a computer with a 12th Gen TABLE IV FEW-SHOT LEARNING PARAMETERS USED IN OUR EXPERIMENTS K-shot125102050 nquery200020002000200020002000 Intel(R) Core(TM) i7-12700 processor (2.10 GHz) and 32 GB of RAM, using the PyTorch framework. The modelâs key hyperparameters were set as follows: an inner-loop learning rate (Îą) of 0.01, a meta-learning rate (β) of 0.001, and five inner-loop gradient steps. To thoroughly evaluate the model under varying data scarcity conditions, we experimented with a range of values for the key few-shot parameters, as summarized in Table IV. Specifically, we varied the number of shots (K-shot) from 1 to 50, while maintaining a fixed query size (n query ) of 1000 samples per class to construct balanced evaluation sets totaling 2000 samples (1000 benign and 1000 malware). This setup allows for consistent comparisons across shot levels, focusing on how additional support samples enhance the modelâs rapid adaptation capabilities in scenarios that mimic zero-day threats or newly emerging malware families. Fig. 5 shows the confusion matrices which illustrate the modelâs ability to distinguish malware from benign samples under varying levels of data scarcity ranging from 1-shot to 50-shot settings. In the 1-shot scenario , the model correctly identified 945 benign samples and 806 malware samples, but exhibited 55 false positives (benign misclassified as malware) and 194 false negatives (missed malware detections), reflecting challenges for extreme data size limitation where the model has minimal examples to learn from. As the number of shots increases, such as in the 2-shot setting with 950 true nega- tives and 857 true positives, the number of errors decreased, showing improved discrimination. This trend continues in higher shots; for instance, the 5-shot matrix achieved 912 true negatives and 935 true positives with only 88 false positives and 65 false negatives, while the 50-shot reached 934 true negatives and 939 true positives, minimizing errors to 66 false positives and 61 false negatives. Despite some persistent false negatives in lower-shot settings, potentially due to subtle variations in malware features, the high true positive rates across all matrices highlight the modelâs robust generalization, confirming the value of the MAML-based approach for evolv- ing malware threats. These matrices underscore the practical use in cybersecurity where minimizing missed detections is important to prevent breaches. Building on these per-instance insights from the confusion matrices, the overall performance across all few-shot sce- narios is summarized in Table V,which aggregates key metrics (accuracy, F1 score, precision, recall, and MCC) for each configuration. These results demonstrate consistent, high TABLE V PERFORMANCE ACROSS DIFFERENT FEW-SHOT SETTINGS Experimental SettingAccuracyF1 ScorePrecisionRecallMCC 1-shot0.87550.86620.93610.80600.7584 2-shot0.90350.89880.94490.85700.8105 5-shot0.92350.92440.91400.93500.8472 10-shot0.92700.92840.91140.94600.8546 20-shot0.93300.93250.94000.92500.8661 50-shot0.93650.93670.93430.93900.8730 Fig. 5. Confusion matrices illustrating the modelâs classification performance in distinguishing benign from malware samples across few-shot settings: (a) 1-shot, (b) 2-shot, (c) 5-shot, (d) 10-shot, (e) 20-shot, and (f) 50-shot, each with a fixed query size of 1000 samples per class. performance, with the proposed model excelling in low-data regimes and showing progressive improvements as shot counts rise. For example, in the 1-shot setting, the model achieved an accuracy of 0.8755 and MCC of 0.7584, which, while solid for such limited data, improved markedly to 0.9365 accuracy and 0.8730 MCC in the 50-shot configuration. These aggregated metrics show that increased shots lead to better balance between precision (e.g., reducing false positives) and recall (e.g., detecting more true malware). These results show that as the number the shots increases, the performance of the proposed model increases. For exam- ple, the 1-shot setting yielded an accuracy of 0.8755 and F1 of 0.8662 while the for the 50-shot setting the model provided an accuracy of 0.9365, an F1 of 0.9367, and an MCC of 0.8730. Fig. 6. Line chart depicting the modelâs performance metrics (accuracy, F1 score, precision, recall, and MCC) across varying few-shot settings from 1- shot to 50-shot, with a fixed query size of 1000 samples per class. The upward trend in metrics highlights improved generalization and resilience to class imbalance with increasing support samples. Fig. 7. F1 score of AFE-MAML and baseline models across 1 to 50-shot settings. Fig. 8. Matthews Correlation Coefficient of AFE-MAML and baseline models across 1 to 50-shot settings. The high F1-score and MCC values are particularly notewor- thy as they confirm the modelâs resilience to the inherent class imbalance in malware datasets, where benign samples often exceed the number of malicious ones in real-world datasets. From a practical cybersecurity perspective, this is critical; a low F1-score could lead to a high rate of false negatives (missed malware detections), potentially allowing threats to propagate, while a low MCC could result in an unacceptable level of false positives (benign files flagged as malicious), leading to alert fatigue for security analysts and operational inefficiencies. The scores observed in lower-shot settings, such as the 5-shot F1 of 0.9244, are especially promising, demonstrating that for rapid, small-scale deployments, such as responding to novel ransomware or trojan variants, the model can achieve reliable detection without extensive retraining. Fig. 6 shows the values of 5 metrics (accuracy, F1-score, precision, recall, and MCC) as a function of the number of shots for the proposed model. As expected, most of these metrics increase with the number of shots. For instance, comparing the 5-shot (accuracy 0.9235) and 10-shot (0.9270) configurations, the performance with 10 shots is consistently higher across metrics (e.g., recall improves from 0.9350 to 0.9460), demonstrating that providing even a modestly larger support set within the few-shot paradigm allows the model to learn a more robust and generalizable adaptation. Notably, precision shows a slight drop from 5-shot (0.9140) to 10-shot (0.9114) before recovering to 0.9400 at 20-shot; this temporary dip may arise as the model incorporates more diverse support samples, leading to minor over-adaptation and increased false positives in the intermediate range, before the decision boundaries stabilize with further data to balance precision and recall. This aligns with the confusion matrix Fig. 9. Accuracy of AFE-MAML and baseline models across 1 to 50-shot settings. observations, where higher shots correlate with reduced false negatives, enhancing recall without sacrificing precision. The strong performance in lower-shot regimes validates the effi- cacy of our few-shot learning approach, as it is designed for situations with extreme data scarcity, such as emerging threats in enterprise networks or mobile ecosystems where labeling new samples is costly and time-intensive. Figs. 9, 7 and 8 present the performance of the proposed MAML hybrid compared with baseline models (CNN, LSTM, MLP, and Random Forest) across different N-shot settings, in terms of the accuracy, F1 score, and the MCC to provide a comprehensive assessment of classification performance and robustness to class imbalance. All models were implemented under identical conditions to ensure a fair and accurate com- parison. Fig. 9 illustrates the accuracy of each model across N-shot settings. The MAML hybrid achieves consistently high accuracy, ranging from 0.876 at 1-shot to 0.933 at 50-shot, demonstrating its ability to adapt effectively in low-data sce- narios. Random Forest shows steady improvement from 0.697 to 0.950, eventually surpassing the other three models in high- shot regimes. MLP and LSTM achieve moderate performance, ranging from 0.587 to 0.770 and 0.578 to 0.716, respectively, while CNN remains the weakest performer with a performance increasing from 0.500 to 0.698 across the N-shot spectrum. Fig. 7 shows the F1 scores, which emphasize the balance between precision and recall. MAML maintains superior per- formance, with scores of 0.866 at one-shot and 0.933 at fifty- shot, indicating reliable classification even under data scarcity. Random Forest follows a similar trend, improving from 0.673 to 0.950 with more shots. MLP and LSTM show moderate gains, from 0.583 to 0.770 and 0.577 to 0.703, respectively. Whereas CNN exhibits the lowest scores, starting at 0.333 and reaching 0.685. Fig. 8 presents the Matthews Correlation Coefficient, which is particularly sensitive to class imbalance. MAML demon- strates strong correlation values ranging from 0.758 at one- shot to 0.866 at fifty-shot, with the peak at ten-shot (0.873) highlighting its classification quality. Random Forest shows improvement from 0.470 to 0.900, outperforming the other baseline models in high-shot conditions. MLP and LSTM exhibit moderate performance, increasing from 0.176 to 0.540 and 0.155 to 0.474, respectively, while CNN remains the lowest at 0.000 to 0.432. Overall, the proposed MAML hybrid is the best performer, consistently outperforming the baseline models in few-shot settings (1- to 20-shot) that align with the paperâs emphasis on rapid adaptation to new threats with limited data. Addi- tionally, our model outperforms other models proposed in the literature [11-13]. For instance, it surpasses the MI-MAML model, which yielded only 1 to 5% accuracy improvements through data augmentation and adaptive learning rates [11]. Similarly, it exceeds the Relation-aware Siamese Denoising Autoencoder, which provided an accuracy between 83 and 97% in 5-way 5-shot tasks and 90.3% in obfuscated scenarios [12]. Furthermore, our model outperforms IoT attack detection frameworks, which achieved F1-scores of 0.75â0.90 in 5- shot cases [13]. The autoencoderâs compact feature repre- sentations combined with MAMLâs rapid adaptability enable this enhanced generalization, laying the foundation for future obfuscation-resilient designs. IV. CONCLUSION In this paper, we introduced a hybrid architecture that combines an Autoencoder Feature Extractor with a Model- Agnostic Meta-Learning classifier to address the problem of few-shot malware detection for emerging ransomware variants. This approach takes advantage of the autoencoderâs ability to create compact and informative feature representations which enable the MAML classifier to rapidly adapt to new, unseen threats with minimal labeled data. The results show that the proposed model outperformed four traditional models in low-shot scenarios, achieving high accuracy, F1 score, and Matthews Correlation Coefficient values that reflect reliable classification even under class imbalance. While Random Forest becomes competitive in high-shot settings, the AFE- MAML hybrid maintains a clear advantage when labeled data are scarce, highlighting its suitability for rapid, small-scale deployment. The results indicate that this proposed framework provides a robust foundation for future research, including multi-class malware detection and obfuscation-resilient de- signs, contributing to the development of adaptive malware detection systems that are both accurate and flexible. REFERENCES [1] âUpdated Managementâs Discussion and Analysis of Financial Condition and Results of Operations - Q4 FY24 - Google Docs,âAccessed:Sep.07,2025.[Online].Available: https://about.ascension.org/-/media/project/ascension/about/section- about/financials/2024/ascension-management-discussion-and-analysis- q4-fy24.pdf? [2] âCOLDRIVER Using New Malware To Steal Documents From West- ern Targets and NGOs,â Google Cloud Blog. Accessed: Sep. 07, 2025. [Online]. Available: https://cloud.google.com/blog/topics/threat- intelligence/coldriver-steal-documents-western-targets-ngos [3] â2024 IC3Report.pdf,â Accessed: Sep. 07, 2025. [Online]. Available: https://w.ic3.gov/AnnualReport/Reports/2024IC3Report.pdf [4] Z. Bazrafshan, H. Hashemi, S. M. H. Fard, and A. Hamzeh, âA survey on heuristic malware detection techniques,â in The 5th Conference on Information and Knowledge Technology, May 2013, p. 113â120. [5] E. Praveen Kumar and S. Priyanka, âA comprehensive survey on hardware-assisted malware analysis and primitive techniques,â Comput. Netw., vol. 235, p. 109967, Nov. 2023. [6] M. S. Akhtar and T. Feng, âEvaluation of Machine Learning Algorithms for Malware Detection,â Sensors, vol. 23, no. 2, Art. no. 2, Jan. 2023. [7] H. Zhou, X. Yang, H. Pan, and W. Guo, âAn Android Malware Detection Approach Based on SIMGRU,â IEEE Access, vol. 8, p. 148404â 148410, 2020. [8] K. Goeschel, âReducing false positives in intrusion detection systems using data-mining techniques utilizing support vector machines, decision trees, and naive Bayes for off-line analysis,â in SoutheastCon 2016, Mar. 2016, p. 1â6. [9] âWhat Is Meta Learning? â IBM,â Accessed: Feb. 16, 2025. [Online]. Available: https://w.ibm.com/think/topics/meta-learning [10] A. H. Amjad Hussain, âRansomware Dataset 2024,â Zenodo, Oct. 04, 2024. Accessed: Sep. 01, 2025. [Online]. Available: https://zenodo.org/records/13890887 [11] Y. Ji, K. Zou, and B. Zou, âMi-maml: classifying few-shot advanced malware using multi-improved model-agnostic meta-learning,â Cyber- security, vol. 7, no. 1, p. 72, Nov. 2024. [12] âRelation-aware based Siamese Denoising Autoencoder for Malware Few-shot Classification,â Accessed: Sep. 07, 2025. [Online]. Available: https://arxiv.org/html/2411.14029v1 [13] G. Bovenzi, D. Di Monda, A. Montieri, V. Persico, and A. Pescap ` e, âClassifying attack traffic in IoT environments via few-shot learning,â J. Inf. Secur. Appl., vol. 83, p. 103762, Jun. 2024.