Selecting appropriate machine learning (ML) configurations for malware detection is a complex, multi-criteria problem. Model choice, feature engineering, and update mechanisms must jointly satisfy operational constraints that vary across deployment contexts. This paper proposes the Framework for Decision-making (FDM) to build ML-based malware detection systems. The FDM formalises this selection process using the Weighted Configuration Compatibility Score (WCCS), a multi-criteria scoring function mapping five operational parameters (platform constraint, resource budget, response latency, update frequency, and detection sensitivity) to ranked recommendations across nine configuration dimensions. To validate the framework, four experiments were conducted on three datasets (a private Windows API dataset, the public Malimg image benchmark, and an Android static API dataset). Key results include: (i) XGBoost achieved the best accuracy-to-resource ratio in binary classification (97.46 % test accuracy, <70 MB RAM), outperforming LSTM/BiLSTM which consumed up to 2.8 GB; (ii) in multi-class classification, classical models (XGBoost 79.03 %) outperformed recurrent deep models (BiLSTM 72.27 %), reversing the binary ranking; (iii) class-incremental learning with EfficientNetB0 maintained 99.13 % accuracy with only 0.65 pp degradation across 11 incremental steps; (iv) transfer learning reduced training time by 2.14 times on average for image-based malware data without significant accuracy cost; and (v) autoencoder pre-processing yielded a 14 times training speedup at a cost of only 0.86 pp accuracy. These findings confirm that the optimal ML configuration is context-dependent, validating the FDM's core premise and demonstrating its practical utility for cybersecurity practitioners.

翻译：为恶意软件检测选择合适的机器学习配置是一个复杂的多准则问题。模型选择、特征工程与更新机制必须共同满足随部署环境变化的操作约束。本文提出基于决策的框架（FDM），用于构建基于机器学习的恶意软件检测系统。FDM采用加权配置兼容性评分（WCCS）形式化该选择过程，该多准则评分函数将五个操作参数（平台约束、资源预算、响应延迟、更新频率与检测灵敏度）映射至九个配置维度的排序推荐。为验证该框架，我们在三个数据集（私有Windows API数据集、公开Malimg图像基准与Android静态API数据集）上进行了四项实验。关键结果包括：（i）XGBoost在二分类中取得最佳精度-资源比（测试准确率97.46%，内存<70MB），优于消耗高达2.8GB内存的LSTM/BiLSTM；（ii）在多分类中，经典模型（XGBoost 79.03%）超越循环深度模型（BiLSTM 72.27%），逆转了二分类排名；（iii）采用EfficientNetB0的类增量学习在11个增量步骤中保持99.13%的准确率，退化幅度仅0.65个百分点；（iv）迁移学习使基于图像的恶意软件数据训练时间平均减少2.14倍，且准确率无显著损失；（v）自编码器预处理实现14倍训练加速，准确率仅损失0.86个百分点。这些发现证实最优ML配置具有上下文依赖性，验证了FDM的核心假设，并展示了其对网络安全从业者的实际效用。