MIT-CA: Multi-modal interaction transformer with cross-attention for malware classification
摘要
The malware classification task involves systematically categorizing malware based on its distinctive characteristics, behavior patterns, and functional attributes. Existing classification methods typically rely on machine learning techniques based on single features or unimodal image classification techniques, which are insufficient to address the current complex and diverse malware threats, making it difficult to fully capture and integrate the multidimensional characteristics exhibited by malware at different levels and their potential interrelationships. To this end, we propose a malware classification method based on multi-modal feature interaction, namely the Multi-modal Interaction Transformer with Cross-Attention (MIT-CA). This model leverages both BYTES files, which represent malware in hexadecimal format, and ASM files obtained from disassembly, converting them into comprehensible textual languages and grayscale images, respectively. By employing multi-modal learning, it aggregates information from multiple data sources, enabling the model to learn more comprehensive representations. During the multi-modal interaction, a transformer encoding structure based on Cross-Attention is used to facilitate information exchange between different modal features. This trick guides the model to learn malware features more comprehensively and allows for independent training of each modal feature. Extensive experiments conducted on malware classification datasets verify the effectiveness of the proposed model, and experimental results demonstrate the outstanding performance of our model in the malware classification task.