<p>The malware classification task involves systematically categorizing malware based on its distinctive characteristics, behavior patterns, and functional attributes. Existing classification methods typically rely on machine learning techniques based on single features or unimodal image classification techniques, which are insufficient to address the current complex and diverse malware threats, making it difficult to fully capture and integrate the multidimensional characteristics exhibited by malware at different levels and their potential interrelationships. To this end, we propose a malware classification method based on multi-modal feature interaction, namely the Multi-modal Interaction Transformer with Cross-Attention (MIT-CA). This model leverages both BYTES files, which represent malware in hexadecimal format, and ASM files obtained from disassembly, converting them into comprehensible textual languages and grayscale images, respectively. By employing multi-modal learning, it aggregates information from multiple data sources, enabling the model to learn more comprehensive representations. During the multi-modal interaction, a transformer encoding structure based on Cross-Attention is used to facilitate information exchange between different modal features. This trick guides the model to learn malware features more comprehensively and allows for independent training of each modal feature. Extensive experiments conducted on malware classification datasets verify the effectiveness of the proposed model, and experimental results demonstrate the outstanding performance of our model in the malware classification task.</p>

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

MIT-CA: Multi-modal interaction transformer with cross-attention for malware classification

  • Meng Zhao,
  • Peng Yin,
  • Hu Wang,
  • Fangyuan Hou,
  • Xuesong Wang,
  • Yurong Song,
  • Chunyu Yao

摘要

The malware classification task involves systematically categorizing malware based on its distinctive characteristics, behavior patterns, and functional attributes. Existing classification methods typically rely on machine learning techniques based on single features or unimodal image classification techniques, which are insufficient to address the current complex and diverse malware threats, making it difficult to fully capture and integrate the multidimensional characteristics exhibited by malware at different levels and their potential interrelationships. To this end, we propose a malware classification method based on multi-modal feature interaction, namely the Multi-modal Interaction Transformer with Cross-Attention (MIT-CA). This model leverages both BYTES files, which represent malware in hexadecimal format, and ASM files obtained from disassembly, converting them into comprehensible textual languages and grayscale images, respectively. By employing multi-modal learning, it aggregates information from multiple data sources, enabling the model to learn more comprehensive representations. During the multi-modal interaction, a transformer encoding structure based on Cross-Attention is used to facilitate information exchange between different modal features. This trick guides the model to learn malware features more comprehensively and allows for independent training of each modal feature. Extensive experiments conducted on malware classification datasets verify the effectiveness of the proposed model, and experimental results demonstrate the outstanding performance of our model in the malware classification task.