Communication Dans Un Congrès Année : 2026

The Role of Domain-Specific Features in Malware Detection: A macOS Case Study

Biagio Montaruli
Andrea Oliveri
  • Fonction : Auteur
  • PersonId : 1645860
Savino Dambra
  • Fonction : Auteur
  • PersonId : 1645861
Davide Balzarotti

Résumé

Despite the growing popularity of macOS among end users and enterprise systems, malware research has primarily focused on Windows and Android operating systems, leaving the problem of macOS malware detection relatively unexplored. Indeed, the specificity of the operating system and the unique characteristics of the Mach-O file format can play a fundamental role in the classification of unknown samples, drastically increasing the detection rate.

In this work, for the first time in the literature, we employ new domain-specific features, i.e., static features specific to macOS binaries, such as embedded certificates, entitlements, persistence techniques and key system APIs, to train a machine learning malware detector. We perform a comprehensive experimental evaluation on a novel dataset of 41,129 samples, comprising 11,413 benign and 29,716 malicious executables, and demonstrate that our solution achieves state-of-the-art detection performance (98.50%), outperforming all existing approaches, with an average improvement of 16% in terms of detection rate. We also provide an in-depth analysis of the importance of the individual features, showing that our detector effectively leverages the new domain-specific features. Then, in order to evaluate the generalization capabilities of our detector over time, we perform a real-world evaluation on a new dataset of 9,000 fresh macOS executables. The results show that (i) our detector maintains a very high detection rate (99.50%), (ii) outperforms the state-of-the-art by 50%, and (iii) the domain-specific features are crucial for generalizing to novel malware samples, as their removal leads to a 15.92% drop in detection performance.

Finally, in the spirit of open science, we release our dataset to the research community.

CCS Concepts

• Security and privacy → Malware and its mitigation; • Computing methodologies → Machine learning.

Fichier principal
Vignette du fichier
publi-8523_1.pdf (1.33 Mo) Télécharger le fichier
Origine Fichiers éditeurs autorisés sur une archive ouverte
licence

Dates et versions

hal-05507286 , version 1 (12-02-2026)

Licence

Identifiants

Citer

Biagio Montaruli, Andrea Oliveri, Savino Dambra, Davide Balzarotti. The Role of Domain-Specific Features in Malware Detection: A macOS Case Study. ASIACCS 2026, 21st ACM ASIA Conference on Computer and Communications Security, ACM, Jun 2026, Bangalore, India. ⟨10.1145/3779208.3785392⟩. ⟨hal-05507286⟩
327 Consultations
249 Téléchargements

Altmetric

Partager

  • More