Dragonfly: A Lightweight Offline Antivirus System for Executable Malware Detection Using Machine Learning

Abstract

Antivirus products are often depend on signature-based and heuristic-based methods, which are often unable to manage the ever-increasing malware variants. Dragonfly is a Windows-focused, fully offline antivirus system designed for practical end-users without network connectivity. The detection models are implemented in Python and operate with an em-bedded inference pipeline for deploying the models with an Electron-based inference and a file watcher for real-time scan-ning on end-user machines, it also utilizes a custom static feature engineering and vectorization pipeline based on raw Porta-ble Executable (PE) measurements. The representation includes byte-level distributions, entropy structure, string semantics, PE structural features, and hashed API interaction patterns. The detection models are trained on the EMBER 2027 benchmark and evaluated on the EMBER 2028 dataset, which allows generalization under concept drift. We evaluate Logistic Regres-sion, Support Vector Machines, Random Forests, xgboost, and lightgbm using cross-validation and temporal testing. While Gradient boosting methods achieve the strongest overall detection performance, scalability and deployment constraints at the EMBER scale motivate the selection of lightgbm as a balanced trade-off between accuracy, inference latency, and resource usage, with an accuracy of 89.93% and an f1-score of 89.48%. Inference cost, memory consumption, and confusion matrix analysis also support this selection. Model inference is integrated through an embedded Python managed by a native C++ helper, enabling low-latency inter-process communication with the user interface .Experimental results show that Dragonfly delivers a reliable static malware antivirus that can achieve practical throughput through careful feature engineering, prin-cipled evaluation, and modular system desig