MultiMal: Multimodal Fusion Combining Graph and Entropy Features for Malware Detection

As software becomes widespread, malware poses a significant threat to information system security. Graph neural networks (GNNs) used in existing machine learning-based methods for malware detection ignore deeper semantic information in code graphs. These methods also lack feature extraction of global data information, resulting in incomplete feature for detection. To address these limitations, we propose a multi-modal fusion architecture, MultiMal, that combines function call graphs, control flow graphs, and entropy features to detect Portable Executable (PE) malware. MultiMal proposes a multi-head softmax module to effectively capture graph features in multiple representation spaces. It also constructs an entropy-based learning module to extract binary features related to data randomness and obfuscation, which are then fused with the graph encoding to better detect malware code pattern. For accurate evaluation, we also introduce a new PE malware dataset with evenly distributed samples over the years and detailed family and category labels. Experiments demonstrate that MultiMal outperforms three existing baselines in terms of effectiveness. At an FPR threshold of 0.1 %, the TPR and bACC exceed the best results of the baselines by 11.83 % and 5.54 %, respectively.