No Time to Evade: Context-Aware Conditional Entropy Partitioning and Model Fusion for Robust Multiprocess Malware Detection

This research addresses a security challenge where malware (malicious software) uses polymorphic evasion tactics, splitting its behavior across multiple processes (concurrent program instances) to evade detection systems. The authors propose a defense framework that uses entropy-based partitioning (dividing system activity logs by information density) and model fusion (combining multiple AI models trained differently) to better detect such multi-process malware, showing improved detection accuracy even when malware attempts advanced evasion techniques.