Revisiting Opcode Representations for Malware Family Classification: Learned Embeddings Versus Frequency Baselines

Opcode representations provide numerical features for malware-family classification, but their value must be assessed against simple distributional controls under a shared evaluation protocol. We compare globally trained Word2Vec, GloVe, and fastText embeddings with normalized opcode frequencies on 1,045 files from nine malware families. Ten stratified repeated holdouts use identical file assignments across representations. Embedding epochs are selected using an inner validation partition, followed by a fresh fit on the outer training files. A fixed Random Forest evaluates original-only training and conventional oversampling on the same held-out files. Mean original-only accuracies for opcode frequency, Word2Vec, GloVe, and fastText were 1.0000, 0.9995, 0.9981, 0.9976, respectively. The frequency baseline matched or exceeded the learned representations’ mean accuracy. SMOTE increased macro F1 in 4 of 40 representation–split pairs (none for frequency, which was already at the ceiling). All four representations achieved near-ceiling accuracy on this selected closed-set benchmark.