A benchmark dataset for powershell fileless malware detection: methodology, validation, and n-Gram feature extraction
Abstract
PowerShell is now an integral part of the Windows operating system and includes robust system management, automation, and configuration capabilities. Yet the PowerShell-based malware detection is a challenge as its malicious functionalities can be covered with obfuscation and get executed without any conventional executable artifacts. Many existing detection approaches are limits with proper justification on validation and labeling. Also many of them focus on the detection of PowerShell based malicious script without give emphasis on the preprocessing and feature extraction process. This study proposed a benchmark-oriented detection framework considering the advanced multi-phase deobfuscation, script normalization, VirusTotal based label validation, n-gram feature extraction and Functional Link Artificial Neural Network based classification. The proposed framework is measured using multiple n-gram configurations and standard classification metrics with a regulated train-test protocol. The Trigonometric Functional Link Artificial Neural Network (TFLANN) model achieve an accuracy of 98.61% and 0.9930 ROC-AUC using 5-gram feature sets under the reported 70:30 evaluation setting. Repeated seed trails and paired statistical tests validated the model’s rank among the four functional expansions and conventional linear and ensemble classifiers were used to put the reported accuracy into perspective. The result represent that the efficient preprocessing and lexical representation support accurate detection of malicious PowerShell script to a grate extent.
Related
- Comparative Analysis of Traditional and Modern Extraction Techniques for Phenolic Compounds From Leontopodium and Optimization of Extraction Process Using Response Surface Methodology.
- Microwave-assisted extraction and optimization of pectin from Aegle marmelos using response surface methodology and metaheuristic algorithms
- Scaling methodology for supercritical CO2 extraction process: applicability of the solvent-to-feed mass ratio criterion under different flow directions and extraction basket geometries
- DICD-IE: an expert-annotated benchmark for evaluating pretrained biomedical language models in dental implant literature and clinical knowledge extraction
- Ultrasound-Assisted Extraction of Bioactive Compounds from Acmella oleracea L. Leaves: Optimization by Response Surface Methodology and Comparison with Percolation
BibTeX
@article{meher2026benchmark,
title = {{A benchmark dataset for powershell fileless malware detection: methodology, validation, and n-Gram feature extraction}},
author = {Manish Kumar Meher and Adyasha Rath and Prabodh Kumar Sahoo and Aswini Kumar Samantaray and Ganapati Panda},
journal = {Scientific Reports},
year = {2026},
month = oct,
doi = {10.1038/s41598-026-74828-2},
url = {https://www.nature.com/articles/s41598-026-74828-2},
note = {CC BY 4.0},
}
RIS
TY - JOUR
TI - A benchmark dataset for powershell fileless malware detection: methodology, validation, and n-Gram feature extraction
AU - Manish Kumar Meher
AU - Adyasha Rath
AU - Prabodh Kumar Sahoo
AU - Aswini Kumar Samantaray
AU - Ganapati Panda
PY - 2026
DA - 2026/10/08
JO - Scientific Reports
DO - 10.1038/s41598-026-74828-2
UR - https://www.nature.com/articles/s41598-026-74828-2
AB - PowerShell is now an integral part of the Windows operating system and includes robust system management, automation, and configuration capabilities. Yet the PowerShell-based malware detection is a challenge as its malicious functionalities can be covered with obfuscation and get executed without any conventional executable artifacts. Many existing detection approaches are limits with proper justification on validation and labeling. Also many of them focus on the detection of PowerShell based malicious script without give emphasis on the preprocessing and feature extraction process. This study proposed a benchmark-oriented detection framework considering the advanced multi-phase deobfuscation, script normalization, VirusTotal based label validation, n-gram feature extraction and Functional Link Artificial Neural Network based classification. The proposed framework is measured using multiple n-gram configurations and standard classification metrics with a regulated train-test protocol. The Trigonometric Functional Link Artificial Neural Network (TFLANN) model achieve an accuracy of 98.61% and 0.9930 ROC-AUC using 5-gram feature sets under the reported 70:30 evaluation setting. Repeated seed trails and paired statistical tests validated the model’s rank among the four functional expansions and conventional linear and ensemble classifiers were used to put the reported accuracy into perspective. The result represent that the efficient preprocessing and lexical representation support accurate detection of malicious PowerShell script to a grate extent.
SN - 2045-2322
ER -