Open Access

ARTICLE

Negative-One-Day Malware Detection with Generative AI: A Stable Diffusion-Based Proactive Defense Framework

Sohail Khan^1,*, Toqeer Ali Syed², Mohammad Nauman¹, Salman Jan³, It Ee Lee⁴, Qamar Wali⁴

1 Department of Computer Science, Effat College of Engineering, Effat University, Jeddah, Saudi Arabia
2 Faculty of Computer and Information System, Islamic University of Madinah, Madinah, Saudi Arabia
3 Faculty of Computer Studies, Arab Open University, A’Ali, Bahrain
4 Faculty of Artificial Intelligence and Engineering, Multimedia University, Cyberjaya, Malaysia

* Corresponding Author: Sohail Khan. Email:

(This article belongs to the Special Issue: Artificial Intelligence Methods and Techniques to Cybersecurity)

Computers, Materials & Continua 2026, 88(1), 63 https://doi.org/10.32604/cmc.2026.075265

Received 28 October 2025; Accepted 31 March 2026; Issue published 08 May 2026

Abstract

The detection of zero-day malware represents one of the most significant challenges in contemporary cybersecurity. In this paper, we introduce a novel concept called “Negative-One-Day Malware Detection”, which aims to identify potentially malicious software before it is actually created by threat actors. Our approach leverages recent advancements in generative AI, specifically diffusion-based generative models, to generate and analyze potential future malware variants. By doing so, we can train detection systems to recognize these variants before they emerge in the wild, thereby closing the critical protection gap that currently exists between malware creation and detection. We demonstrate the effectiveness of our approach through extensive experimentation, showing that our framework can generate executable malware samples that combine characteristics from different families while exhibiting novel behaviors. These synthetically generated samples significantly improve the detection capabilities of security systems when incorporated into training data, providing a proactive rather than reactive approach to cybersecurity.

---

Keywords

---