# Systematic Review: Malware Detection and Classification in Cybersecurity
## 2 Methodology
### Selection and Filtering Process
#### 2.2.2 Exclusion Criteria  
The exclusion criteria (EC) were established to eliminate studies that do not meet the minimum requirements for relevance, empirical validity, accessibility, or applicability. These criteria ensure the rigor and coherence of the systematic review by narrowing the focus to studies of demonstrated scientific value and relevance to the scope of the investigation. * EC1: Studies unrelated to malware detection and classification:Excluding irrelevant research avoids diluting the focus and relevance of the review, ensuring that it concentrates on the specific topic of interest. * EC2: Absence of empirical results: Excluding studies that do not present empirical results guarantees the reliability and validity of the data included in the review, avoiding speculation or subjective interpretation. * EC3: Limited availability of publications: Excluding studies that are not available in full ensures that all the necessary information is accessible for thorough and rigorous evaluation. * EC4: Irrelevance or duplication of studies: Eliminating irrelevant or duplicate studies optimizes resource use and ensures the inclusion of new and meaningful information in the review. * EC5: Lack of practical applicability: Excluding studies focused solely on theoretical aspects without practical applications ensures that the review concentrates on research with direct relevance to the practice of malware detection and classification. In Figure 2, a flowchart of the PRISMA method is presented, illustrating key information such as the number of publications screened, excluded, and included, along with other relevant details. After an initial screening, further filtering was conducted based on inclusion/exclusion criteria, summarized in Table 2.  
Figure 2: PRISMA flowchart. To prioritize well-referenced works, duplicates and documents with fewer than 10 citations were excluded. Following this filtering step, 241 documents remained. To facilitate the selection process, a Python 3.13.3 algorithm, shown in Algorithm 1, was used to merge and rank the articles by number of citations. This process guaranteed that the most widely referenced and impactful studies were prioritized for analysis. 1. import pandas as pd  
2. from google.colab import drive  
3. drive.mount('/content/drive')  
4. file-path = '/content/drive/My Drive/total-papers.csv'  
5. df = pd.read\({}_{\text{csv}}\)(file\({}_{\text{path}}\))  
6. _df_[_Title_] _= df_[_Title_]_.str.normalize('NFKD').str.encode('ascii', errors='ignore').str.decode('uff-8')  
7. _df_[_Title_] _= df_[_Title_]_.str.upper()  
8. _df.info()_  
9. _df_-_influidal_\({}_{\text{d}}\)_-_influidal_\({}_{\text{d}  
In the 2000s, the use of techniques such as polymorphism and the emergence of ransomware and Trojans (e.g., Zeus, Torpig) increased the sophistication of attacks. Furthermore, the implementation of rootkits, such as SONY BMG, revealed critical risks in the system boot process. Since 2010, malware variants have adopted advanced techniques such as metamorphism, encryption, and vulnerability exploitation. Ransomware evolved toward the encryption of critical data, exemplified by NotPetya, Ryuk, and WannaCry. This was followed by large-scale attacks, such as those targeting Colonial Pipeline and JBS. Despite a decline in 2022, new threats such as triple extortion and BlackCat, written in Rust, persist. Finally, APT-style attacks (e.g., Hydraq, Aurora, Carbonak, APT29/SolarWinds) and the takedown of the Snake malware in 2023 by Operation Perseus reaffirm the continued evolution of these threats and the need for more sophisticated defense strategies. Since 2020, there has been a growing body of scientific research addressing malware detection and mitigation from a technical and academic perspective. This work includes a Systematic Literature Review (SLR) on malware between 2020 and 2024, which analyzed studies focused on new attack and defense strategies, such as the use of artificial intelligence, deep learning, fileless malware detection, and adversarial attacks.