POLYMORPHIC MALWARE IN DIGITAL FORENSICS: A SYSTEMATIC SCOPING REVIEW OF DETECTION TECHNIQUES, TOOLS, AND FORENSIC APPLICABILITY

Polymorphic malware constitutes one of the foremost challenges in forensic cybercrime investigations due to its capacity to alter its code structure while preserving malicious functionality. Conventional signature-based detection tools are unable to reliably identify such continuously evolving threats. This scoping review examines forensically relevant techniques, tools, datasets, and machine-learning approaches for detecting polymorphic malware, with an explicit focus on forensic applicability. Literature published between 2018 and 2025 was systematically retrieved from IEEE Xplore, Scopus, Springer, ACM Digital Library, ScienceDirect, arXiv, and ResearchGate. Following PRISMA-ScR screening criteria, 33 peer-reviewed studies were included. The review synthesises static, dynamic, hybrid, and machine-learning-based detection methodologies, enumerates relevant tools (Ghidra, Radare2, Cuckoo Sandbox, ANY.RUN) and ML frameworks (TensorFlow, PyTorch, Scikit-learn), and compares detection performance, dataset characteristics, forensic limitations, and future research directions. Hybrid and ML-driven detection approaches demonstrate promising accuracy; however, persistent challenges include dataset bias, limited cross-environment generalisation, computational overhead, and forensic admissibility concerns. Future research priorities include standardised polymorphic datasets, explainable AI integration, cross-dataset validation, and forensic-workflow-integrated detection pipelines.