Deep Learning Strategies For Fileless Mal Ware Detection: A Critical Review Of Detection Models, Feature Constraints, And Learning-Based Enhancements

Leveraging a combination of genuine system processes, temporary memory and advanced code injection techniques to evade common security practices, fileless malware has evolved into one of the most persistent and evasive forms of modern day cyber attacks. Researchers are leaning towards deep learning methods capable of understanding complex behavioral patterns and elements related to memory as attackers morph their tactics into using memory code execution, concealed scripts or injection techniques used in the wild. By comparing two classes of analysis features, which are due to transient memory structures and call patterns from the API, on its impact on learning-based detection success, this survey consolidates inconsistent findings across different parts of publications. All aspects of scalability, feature extensibility, clarity and robustness to adversarial attacks will be considered in our comparison among the existing detection frameworks. Injection strategies that include, among others, process hollowing, reflective DLL loading and persistence through registry are considered and their implications on the design of feature extraction systems are highlighted. This study synthesizes findings from empirical studies, datasets, and design trends to identify promising areas for future research (e.g., light neural encoders; memory-semantic based feature selection; hybrid behavior–forensics models) as well as major gaps that render the detection unreliable. The purpose of this survey is to supply researchers and practitioners with a comprehensive guide for creating more resilient, accurate, effective deep learning-based defense mechanisms against fileless malware detection and code injection attacks.