Malformer: A Multi-Modal Malware Detector Using Transformers

• URL: http://arxiv.org/abs/2608.19052v1
• Date: Wed, 19 Aug 2026 15:46:28 GMT
• Title: Malformer: A Multi-Modal Malware Detector Using Transformers
• Abstract summary: We present Malformer, a quadrimodal malware detection model that incorporates text, image, graph, and audio representations of Windows executables.<n>Malformer achieved 98.3% accuracy and an F1 score of 0.9833, outperforming both unimodal baselines and bimodal detectors by 4.6-17.6 percentage points.
• Score: 2.8093059118703345
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Traditional malware detection systems that rely on a single representation of malware often fail to identify novel threats. These representations of malware binaries, also known as modalities, do not provide the models with sufficient information to discriminate among all samples. Additionally, individual representations introduce new failure modes, with some modality extraction being dependent upon the success of disassembling. Past works have integrated either additional modalities or more discriminative representations for classification. In this work, we present Malformer, a quadrimodal malware detection model that incorporates text, image, graph, and audio representations of Windows executables. We demonstrate that multimodal transformer fusion can enhance the performance of Windows malware detectors over that of unimodal and bimodal detectors. Malformer employs a combination of two RoBERTa encoders paired with a modified Vision Transformer for image data, WavLM for audio data, and an adaptive loss-weighting scheme to fuse modality-specific representations. Evaluated on a dataset of 201,549 binary samples, Malformer achieved 98.3% accuracy and an F1 score of 0.9833, outperforming both unimodal baselines and bimodal detectors by 4.6-17.6 percentage points. Malformer demonstrates that multimodal fusion provides a promising foundation for countering the growing scale of malware threats, equipping defenders with generalized and resilient detection capabilities.

Related papers

• A Multi-task Mixture of Experts Framework for Malware Classification, Packing Detection, and Family Attribution [2.008200933045584]
  We propose a unified multi-task malware analysis framework based on Mixture of Experts (MoE) architectures.<n>It simultaneously performs three critical tasks: malware family classification, packed versus unpacked detection, and malware versus benign identification.<n>We investigate multiple architectural variants, including Homogeneous MoE, Heterogeneous MoE, and Multi-Gate MoE.
  arXiv  Detail & Related papers  (2026-06-29T17:15:25Z)
• $\bf{D^3}$QE: Learning Discrete Distribution Discrepancy-aware Quantization Error for Autoregressive-Generated Image Detection [85.9202830503973]
  Visual autoregressive (AR) models generate images through discrete token prediction.<n>We propose to leverage Discrete Distribution Discrepancy-aware Quantization Error (D$3$QE) for autoregressive-generated image detection.
  arXiv  Detail & Related papers  (2025-10-07T13:02:27Z)
• Every Step Counts: Decoding Trajectories as Authorship Fingerprints of dLLMs [63.82840470917859]
  We show that the decoding mechanism of dLLMs can be used as a powerful tool for model attribution.<n>We propose a novel information extraction scheme called the Directed Decoding Map (DDM), which captures structural relationships between decoding steps and better reveals model-specific behaviors.
  arXiv  Detail & Related papers  (2025-10-02T06:25:10Z)
• A Visualized Malware Detection Framework with CNN and Conditional GAN [5.4505834541978615]
  We propose an integrated framework for addressing common problems experienced by Machine Learning utilizers. Namely, a pictorial presentation system with extensions is designed to preserve the identities of benign/malign samples. A conditional Generative Adversarial Network based model is adopted to produce synthetic images.
  arXiv  Detail & Related papers  (2024-09-22T13:29:10Z)
• Deep Learning Fusion For Effective Malware Detection: Leveraging Visual Features [12.431734971186673]
  We investigate the power of fusing Convolutional Neural Network models trained on different modalities of a malware executable. We are proposing a novel multimodal fusion algorithm, leveraging three different visual malware features. The proposed strategy has a detection rate of 1.00 (on a scale of 0-1) in identifying malware in the given dataset.
  arXiv  Detail & Related papers  (2024-05-23T08:32:40Z)
• Small Effect Sizes in Malware Detection? Make Harder Train/Test Splits! [51.668411293817464]
  Industry practitioners care about small improvements in malware detection accuracy because their models are deployed to hundreds of millions of machines. Academic research is often restrained to public datasets on the order of ten thousand samples. We devise an approach to generate a benchmark of difficulty from a pool of available samples.
  arXiv  Detail & Related papers  (2023-12-25T21:25:55Z)
• Towards General Visual-Linguistic Face Forgery Detection [95.73987327101143]
  Deepfakes are realistic face manipulations that can pose serious threats to security, privacy, and trust. Existing methods mostly treat this task as binary classification, which uses digital labels or mask signals to train the detection model. We propose a novel paradigm named Visual-Linguistic Face Forgery Detection(VLFFD), which uses fine-grained sentence-level prompts as the annotation.
  arXiv  Detail & Related papers  (2023-07-31T10:22:33Z)
• MDENet: Multi-modal Dual-embedding Networks for Malware Open-set Recognition [17.027132477210092]
  We propose the Multi-modal Dual-Embedding Networks, dubbed MDENet, to take advantage of comprehensive malware features. We also enrich our previously proposed large-scaled malware dataset MAL-100 with multi-modal characteristics.
  arXiv  Detail & Related papers  (2023-05-02T08:09:51Z)
• Multimodal Industrial Anomaly Detection via Hybrid Fusion [59.16333340582885]
  We propose a novel multimodal anomaly detection method with hybrid fusion scheme. Our model outperforms the state-of-the-art (SOTA) methods on both detection and segmentation precision on MVTecD-3 AD dataset.
  arXiv  Detail & Related papers  (2023-03-01T15:48:27Z)
• OMD: Orthogonal Malware Detection Using Audio, Image, and Static Features [18.698383412150296]
  "orthogonal" cyber defense approaches are complementary to existing methods. Audio descriptors, image similarity descriptors and other static/statistical features are used.
  arXiv  Detail & Related papers  (2021-11-08T18:42:30Z)
• A Hierarchical Transformation-Discriminating Generative Model for Few Shot Anomaly Detection [93.38607559281601]
  We devise a hierarchical generative model that captures the multi-scale patch distribution of each training image. The anomaly score is obtained by aggregating the patch-based votes of the correct transformation across scales and image regions.
  arXiv  Detail & Related papers  (2021-04-29T17:49:48Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.