Multi-view based network for malware classification

Malware poses grave threats to cyberspace security, necessitating prompt and precise classification. However, existing static analysis methods often overlook the alignment sensitivity inherent in mapping one-dimensional (1D) binary sequences to three-dimensional (3D) chromatic image data, leading to feature loss due to phase shifts. Furthermore, the effective fusion of local byte-level textures and global assembly automatic storage management (ASM) semantics remains a challenge. To address these limitations, this study proposes an innovative Multi-view based Network that redefines “multi-view” feature extraction at two complementary levels. Microscopically, we introduce a bit-shifting strategy to generate eight shifted views from each binary sequence, exhaustively capturing all local red, green, and blue (RGB) alignments to ensure feature invariance against obfuscation. Macroscopically, we integrate these raw byte-level views with the global ASM view, fusing fine-grained binary textures with high-level instruction semantics. The framework leverages a Vision Transformer (ViT) and Visual Geometry Group (VGG) via Transfer Learning, and employing a Bilinear Attention Network (BAN) to model high-order interactions between these modalities. Experimental results demonstrate the superiority of the proposed approach, which achieves a significant performance improvement over state-of-the-art baselines and thus validates the effectiveness of the dual-level multi-view strategy for decoding complex malware binary files.