<p>Malware classification using visual representations has emerged as a promising approach for cybersecurity applications, yet existing deep learning methods often suffer from high computational complexity and limited deployment feasibility on resource-constrained devices. This paper introduces HFDNet (Harmonic Feature Decomposition Network), a novel lightweight architecture that leverages mathematically-grounded harmonic decomposition for efficient malware image classification. Unlike conventional spatial-only architectures and attention mechanisms that demand substantial computational resources, HFDNet employs learnable trigonometric functions with adaptive frequency, amplitude, and phase parameters to extract discriminative spectral patterns from malware binary visualizations. Comprehensive evaluation on the MalImg dataset comprising 9,339 samples across 25 malware families, conducted over five independent experimental runs with stratified splitting, demonstrates that HFDNet achieves 96.28% mean accuracy with an F1-weighted score of 0.957 using only 104.3K parameters and 15.55MFLOPs. Compared to ResNet18, which achieves marginally higher accuracy (96.70%), HFDNet requires 107× fewer parameters and 9.55× fewer FLOPs, while DenseNet121 achieves comparable accuracy (96.24%) at the cost of 67× more parameters and 15× greater computational overhead. Against established CBAM attention mechanisms, HFDNet achieves comparable classification performance(96.28% vs. 96.32%) while achieving 46.5% FLOP reduction and 11.7% parameter reduction, confirming that harmonic decomposition captures frequency-domain discriminative features more efficiently than conventional channel-spatial attention. Ablation analysis validates that harmonic decomposition is the most impactful component, with its removal causing 0.77 percentage points accuracy degradation, while depthwise separable convolutions reduce parameters by 76.6% compared to standard convolutions with negligible accuracy compromise. HFDNet’s 0.405 MB footprint and 15.55M FLOPs enable deployment across four of six evaluated edge platforms, including Raspberry Pi 4B, NVIDIA Jetson Nano, Google Coral Dev Board, and Arduino Portenta H7, while remaining infeasible only on the most severely constrained microcontrollers such as ESP32-S3. The proposed architecture establishes harmonic feature decomposition as an effective paradigm for developing mathematically-principled, resource-efficient deep learning models that bridge the gap between high-performance malware detection and the stringent deployment constraints of real-world embedded cybersecurity applications.</p>

HFDNet: harmonic feature decomposition for lightweight visual malware classification

期刊论文
发表日期：

2026年6月29日

查看全文

Mahmoud Farfoura

摘要

Malware classification using visual representations has emerged as a promising approach for cybersecurity applications, yet existing deep learning methods often suffer from high computational complexity and limited deployment feasibility on resource-constrained devices. This paper introduces HFDNet (Harmonic Feature Decomposition Network), a novel lightweight architecture that leverages mathematically-grounded harmonic decomposition for efficient malware image classification. Unlike conventional spatial-only architectures and attention mechanisms that demand substantial computational resources, HFDNet employs learnable trigonometric functions with adaptive frequency, amplitude, and phase parameters to extract discriminative spectral patterns from malware binary visualizations. Comprehensive evaluation on the MalImg dataset comprising 9,339 samples across 25 malware families, conducted over five independent experimental runs with stratified splitting, demonstrates that HFDNet achieves 96.28% mean accuracy with an F1-weighted score of 0.957 using only 104.3K parameters and 15.55MFLOPs. Compared to ResNet18, which achieves marginally higher accuracy (96.70%), HFDNet requires 107× fewer parameters and 9.55× fewer FLOPs, while DenseNet121 achieves comparable accuracy (96.24%) at the cost of 67× more parameters and 15× greater computational overhead. Against established CBAM attention mechanisms, HFDNet achieves comparable classification performance(96.28% vs. 96.32%) while achieving 46.5% FLOP reduction and 11.7% parameter reduction, confirming that harmonic decomposition captures frequency-domain discriminative features more efficiently than conventional channel-spatial attention. Ablation analysis validates that harmonic decomposition is the most impactful component, with its removal causing 0.77 percentage points accuracy degradation, while depthwise separable convolutions reduce parameters by 76.6% compared to standard convolutions with negligible accuracy compromise. HFDNet’s 0.405 MB footprint and 15.55M FLOPs enable deployment across four of six evaluated edge platforms, including Raspberry Pi 4B, NVIDIA Jetson Nano, Google Coral Dev Board, and Arduino Portenta H7, while remaining infeasible only on the most severely constrained microcontrollers such as ESP32-S3. The proposed architecture establishes harmonic feature decomposition as an effective paradigm for developing mathematically-principled, resource-efficient deep learning models that bridge the gap between high-performance malware detection and the stringent deployment constraints of real-world embedded cybersecurity applications.