A Dual-Branch CNN-LSTM Residual Network for Enhanced Windows Malware Detection

The persistent evolution of Windows malware presents a significant challenge to static‐analysis techniques, which often rely on handcrafted features and single‐modality models that struggle to generalize across diverse and obfuscated samples. This study proposes a novel Dual‐Branch CNN‐LSTM Residual Network that concurrently processes a uniform static feature vector as both a pseudo‐image and a sequential input, thereby capturing complementary spatial and temporal patterns without necessitating multiple preprocessing pipelines. The architecture incorporates residual connections in each branch to preserve gradient flow and facilitate deep learning. Experiments conducted on the EMBER dataset demonstrate that the proposed method attains an accuracy of 97.1 %, alongside a precision of 96.9 %, a recall of 97.1 %, and an F1-score of 97.0 %, surpassing existing single‐branch and traditional baseline models. These results underscore the capacity of dual‐branch residual fusion to improve detection performance while maintaining computational efficiency and robustness to feature obfuscation. The unified preprocessing scheme further simplifies cross‐dataset evaluation, paving the way for scalable deployment in real‐world Windows environments