A real-time malware detection system using hybrid meta-learning on system calls

Abstract

The present invention is related to a real-time malware detection system using hybrid meta-learning on system calls. A real-time malware detection system that monitors kernel system call events using eBPF, and detects malicious processes by combining a lightweight Random Forest classifier on statistical syscall features with a convolutional-LSTM model on hashed n-gram sequential embeddings. A meta-learning fusion module adaptively weights branch predictions using entropy and confidence measures to produce robust final decisions. The system provides explainability via SHAP and attention scores, supports sliding-window stream processing for bounded latency, and is extensible to federated learning for privacy-preserving collaborative model improvement.