Automated sandbox-based analysis systems are dominantly focused on sequences of API calls, which are widely acknowledged as discriminative and easily extracted features. In this paper, we argue that an extension of the feature set beyond API calls may improve the malware detection performance. For this purpose, we apply the Cuckoo open-source sandbox system, carefully configured for the production of a novel dataset for dynamic malware analysis containing 22,200 annotated samples (11,735 benign and 10,465 malware). Each sample represents a full-featured report generated by the Cuckoo sandbox when a corresponding binary file is submitted for analysis. To support our position that the discriminative power of the full-featured sandbox reports is greater than the discriminative power of just API call sequences, we consider samples obtained from binary files whose execution induced API calls. In addition, we derive an additional dataset from samples in the full-featured dataset, whose samples contain only information on API calls. In a three-way factorial design experiment (considering the feature set, the feature representation technique, and the random forest model hyperparameter settings), we trained and tested a set of random forest models in a two-class classification task. The obtained results demonstrate that resorting to full-featured sandbox reports improves malware detection performance. The accuracy of 95.56 percent obtained for API call sequences was increased to 99.74 percent when full-featured sandbox reports were considered.

Introduction/purpose: This paper reports on a pilot comparative analysis of the Cuckoo and Drakvuf sandboxes. These sandboxes are selected as the subjects of the analysis because of their popularity in the professional community and their complementary approaches to analyzing malware behavior. Methods: Both sandboxes were set up with basic configurations and confronted with the same set of malware samples. The evaluation was primarily conducted with respect to the question of to what extent a sandbox is helpful to the human analyst in malware analysis. Thus, only the information available in Web console reports was considered. Results: Drakvuf is expected to perform better when confronted with evasive malware and so-called "file-less" malware. Although still not mature in terms of integration, customization and tools, this sandbox is considered a second generation sandbox because of its agentless design. On the other hand, the Cuckoo sandbox creates a better overall experience: it is supported through good documentation and strong professional community, better integrated with various tools, support more virtualization, operating system and sample types, and generates more informative reports. Even with a smaller capacity to prevent evasive malware, its Python 2 agent script makes it more powerful than Drakvuf. Conclusion: To achieve the optimal open-source sandbox-based protection, it is recommended to apply both the Cuckoo and Drakvuf sandboxes. In circumstances of limited resources, applying the Cuckoo sandbox is preferable, especially if exposure to malware deploying evading techniques is not frequently expected.

Docker systems are gaining widespread use due to their consistency, scalability, and ease of application portability, which addresses specific security challenges. Traditional monitoring and intrusion detection systems based on predefined rules often struggle with advanced attack patterns due to a lack of the capability to correlate incoming log messages. This paper proposes a correlation-aware log analysis approach based on a Mixture-of-Experts (MoE) large language models, enabling detection of malicious activity by analyzing both individual log entries and their contextual relationships within sequences of logs. The system processes each log in the context of 50 preceding messages, allowing identification of attack patterns that are not observable from isolated logs. To evaluate the approach, we generated a comprehensive dataset based on OWASP Top 10 attack scenarios, enriched with zero-day attacks such as Log4j and React2Shell, deployed in a distributed Docker Swarm environment. Multiple LLMs were evaluated under identical hardware conditions to ensure fair comparison. Experimental results demonstrate that while most models achieve comparable performance on single-log detection, significant differences emerge in contextual analysis. The proposed MoE-based approach demonstrates superior effectiveness, achieving an F1 score from 0.993 to 0.998 for contextual-log analysis. The contribution of this research is the novel use of MoE LLMs for log analysis, the distinct novel attack log dataset, and the unique framework based on offline technology that conserves hardware resources and data privacy.

Information is the primary driver of progress in today’s world, especially given the vast amounts of data available for extracting meaningful knowledge. The motivation for addressing the problem of forensic analysis—specifically the validity of decision making in multi-criteria contexts—stems from its limited coverage in the existing literature. Methodologically, machine learning and ensemble models represent key trends in this domain. Datasets used for such purposes can be either real or synthetic, with synthetic data becoming particularly valuable when real data is unavailable, in line with the growing use of publicly available Internet data. The integration of these two premises forms the central challenge addressed in this paper. The proposed solution is a three-layer ensemble model: the first layer employs multi-criteria decision-making methods; the second layer implements multiple machine learning algorithms through an optimized asymmetric procedure; and the third layer applies a voting mechanism for final decision making. The model is applied and evaluated through a case study analyzing the U.S. Army’s decision to replace the Colt 1911 pistol with the Beretta 92. The results demonstrate superior performance compared to state-of-the-art models, offering a promising approach to forensic decision analysis, especially in data-scarce environments.

The research in the area of malware analysis is very popular, with an accent on machine learning algorithms that help automate this subject. One of the leading portals that help researchers with dataset problems is VirusTotal, providing free academic accounts with hundreds of thousands of malware samples with metadata. This work contributes with the analysis of 429,058 malware samples from VirusTotal in terms of overcoming the problem of inconsistent labeling of the antivirus scan results from different vendors. Two methods were used, LSA and LDA, both with automatic calibration of parameters, with the purpose of finding the optimal number of clusters - both resulting in 5. The graphical representation of the clusters was done by k-means clustering in two-dimensional space. Additional research on the most informative words in each cluster showed that 4 similar clusters could be reported as a result from both methods and one cluster per method (LSA and LDA) that was not related to the cluster in the opposite method. The showed results prove that the clustering approach to malware data analysis with automatic calibration of the parameters is a good method when dealing with inconsistent labels in the dataset.

Despite rapid progress in evaluating large language models, the Lost in the Middle phenomenon - a persistent weakness of Transformer-based models whereby information near the middle of the context window exerts less influence on generation - remains unresolved. This paper examines the phenomenon in Serbian, among the first such studies outside English, evaluating three recent open-weight small language models on a filtered multi-document QA dataset. Each query contains a question and ten documents, only one of which holds the answer; its position is shifted from first to tenth place to measure the resulting change in accuracy. A dedicated evaluation procedure was developed to account for the morphological complexity of Serbian, combining string-based matching with a final LLM-based judgment stage (Claude Haiku) for cases obscured by grammatical case variation. Within this dataset and context length, a Cochran's Q test revealed no statistically significant accuracy degradation for any of the three models as the gold document approached the middle of the context. Larger differences were instead observed between the models: Gemma-4-26B-A4B (92.9%) and Qwen3.6-35B-A3B (91.9%) could not be distinguished statistically (p = 0.151), while GPT-OSS-20B (87.3%) was reliably weaker than both (p < 0.0001), suggesting that model choice may play a more important role than gold-document position.