Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces Malformer, a quadrimodal malware detection model that integrates text, image, graph, and audio representations of Windows executables to enhance malware identification. By employing multimodal transformer fusion, Malformer significantly outperforms traditional unimodal and bimodal detectors, achieving an accuracy of 98.3% and an F1 score of 0.9833 on a dataset of 201,549 binary samples. The findings underscore the importance of leveraging diverse data modalities to improve detection capabilities against evolving malware threats.
Malformer achieves a remarkable 98.3% accuracy by fusing four distinct data modalities, setting a new standard for malware detection.
Traditional malware detection systems that rely on a single representation of malware often fail to identify novel threats. These representations of malware binaries, also known as modalities, do not provide the models with sufficient information to discriminate among all samples. Additionally, individual representations introduce new failure modes, with some modality extraction being dependent upon the success of disassembling. Past works have integrated either additional modalities or more discriminative representations for classification. In this work, we present Malformer, a quadrimodal malware detection model that incorporates text, image, graph, and audio representations of Windows executables. We demonstrate that multimodal transformer fusion can enhance the performance of Windows malware detectors over that of unimodal and bimodal detectors. Malformer employs a combination of two RoBERTa encoders paired with a modified Vision Transformer for image data, WavLM for audio data, and an adaptive loss-weighting scheme to fuse modality-specific representations. Evaluated on a dataset of 201,549 binary samples, Malformer achieved 98.3% accuracy and an F1 score of 0.9833, outperforming both unimodal baselines and bimodal detectors by 4.6-17.6 percentage points. Malformer demonstrates that multimodal fusion provides a promising foundation for countering the growing scale of malware threats, equipping defenders with generalized and resilient detection capabilities.