Malware Classification

Follow this topic Ask about this topic

Malware classification studies how to distinguish malicious software from benign software and, when possible, identify its family, type, or source. Methods analyze static evidence such as bytes, strings, API imports, and call graphs, or dynamic evidence from execution; common approaches include tree and neural models, graph and sequence learning, ensembles, and language models. These systems support security screening and analyst triage across settings such as Windows binaries, Android apps, and software packages. A central challenge is maintaining reliable results as malware and datasets change: temporal drift, evasion and poisoned labels, and reliance on incidental artifacts can undermine performance beyond familiar benchmarks such as EMBER and time-separated Android evaluations.

Latest papers

44 papers3 papers in the last four weeks, against 1 the four weeks before. 0.0% of all new papers.

Federated Learning for Malware Image Classification under Data Heterogeneity
Oct 18, 2026Victor Taiwo, Cemal Nisan, Muhammad Athallah +2Non-IID Federated Learning Federated Learning
Department of Computer Engineering, Koç University, Istanbul, Türkiye · Informatics Institute, Istanbul Technical University, Istanbul, Türkiye
MARS: Malware Analysis with Rule-Based Scoring of LLM Claims
Oct 7, 2026Hyeongjun ChoiMalware Classification LLMs for Cybersecurity
78ResearchLab, 8, Yangpyeong-ro 25-gil, Yeongdeungpo-gu, Seoul, 07207, Republic of Korea
A Structured State Space Sequence Model for Multi-Class Classification of Malware
Oct 1, 2026Emmanuela Andam, Rana Shaaban, Emanuel Grant +1Cybersecurity Malware Classification
Artificial Intelligence Research (AIR) Center · School of Electrical Engineering and Computer Science, College of Engineering & Mines University of North Dakota, Grand Forks, ND 58201, USA
Cost-Aware Hierarchical Multi-Agent Ransomware Detection and Family Attribution under Analysis Budgets
Sep 4, 2026Mubashar Iqbal, Asifullah Khan, Hifsa Asif +3Malware Detection Malware Analysis
Pattern Recognition Lab, DCIS, Pakistan Institute of Engineering and Applied Sciences (PIEAS), Nilore, Islamabad, Pakistan · Deep Learning Lab, Center for Mathematical Sciences, PIEAS, Nilore, Islamabad, Pakistan · Interdisciplinary Research Center for Smart Mobility and Logistics, King Fahd University of Petroleum & Minerals, Dhahran 31261, Saudi Arabia +2
Classifier-Dependent Benefits of Pseudo-Labeling for Semi-Supervised Android Malware Attribution
Aug 26, 2026Md Rafid Islam, Zahid Hasan, Hafiz Abdur RahmanPseudo-Labeling Malware Classification
Department of Electrical and Computer Engineering North South University Dhaka, Bangladesh
Adapter-Based Few-Shot Continual Learning for Malicious Packet Recognition
Aug 24, 2026Kyle Stein, Guillermo Francia, III Eman El-Sheikh +1Class-Incremental Learning Malware Classification
Department of Intelligent Systems and Robotics, University of West Florida, Pensacola, FL, USA · Center for Cybersecurity, University of West Florida, Pensacola, FL, USA · Florida Institute For Human and Machine Cognition (IHMC), Pensacola, FL, USA
Enhancing Multiclass Malware Classification in Resource-Constrained Environments
Aug 23, 2026Abdul Khalek Alve, Alif Rahman, Saadman Zaman +2Malware Classification Malware Detection
Department of Computer Science and Engineering BRAC University, Dhaka, Bangladesh
Concept Drift Detection and Adaptive Retraining of Malware Classification Models
Aug 13, 2026Christofer Washington Berruz Chungata, Martin Jurecek, Katerina Potika +2Concept Drift Malware Classification
Department of Computer Science, San Jose State University · Faculty of Information Technology, Czech Technical University in Prague
ShielDroid: A Hybrid Approach Integrating Machine and Deep Learning for Android Malware Detection
Aug 4, 2026Md Faisal Ahmed, Zarin Tasnim Biash, Abu Raihan Shakil +4Android Malware Detection Malware Classification
Department of Computer Science and Engineering Brac University Dhaka, Bangladesh
Latent Stability Analysis of Malware Representations Under Feature-Space Perturbations
Jul 27, 2026Bamidele Ajayi, Ken McGarryMalware Classification Adversarial Perturbations
School of Computer Science and Engineering, University of Sunderland, Sunderland, UK
Agentic SABRE: An Uncertainty-Aware Neuro-Symbolic Multi-Agent Framework for Adaptive Ransomware Detection
Jul 5, 2026Henry Kabuye, Biju Issac, Jeyamohan NeeraMalware Classification Neuro-Symbolic AI
School of Computer Science, Northumbria University, Newcastle Upon Tyne, UK
ThreatVisionAI: A Hybrid CNN-ViT Framework for Image-Based Malware Classification
Jul 4, 2026Allyson Taylor, Prashanth BusiReddyGariHybrid CNN-Transformer Architectures Malware Classification
Department of Mathematics & Computer Science University of North Carolina Pembroke
Hamm-Grams: An Algorithm for Mining Regular Expressions of Bytes
Jul 1, 2026Derek Everett, Edward Raff, James HoltMalware Classification Malware Analysis
Amazon, Baltimore, USA · CrowdStrike, Austin, USA
A Multi-task Mixture of Experts Framework for Malware Classification, Packing Detection, and Family Attribution
Jun 29, 2026Jithin S., Roshin Sleeba C., Anvin Mariya P. B. +4Multi-Task Learning Malware Classification
Department of Computer Applications, Cochin University of Science and Technology, India · Department of Electrical, Computer and Biomedical Engineering, University of Pavia, Italy
DroidBreaker: Practical and Functional Problem-Space Attacks on Machine-Learning Android Malware Detectors
Jun 25, 2026Christian Scano, Diego Soi, Angelo Sotgiu +5Adversarial Attacks Android Malware Detection
University of Cagliari · Sapienza University of Rome · CINI +1
Multi-View Decompilation for LLM-Based Malware Classification
Jun 18, 2026Bercan Turkmen, Vyas RainaSoftware Reverse Engineering LLM Prompting
Independent Researcher · SPARK
ViPER: Vision-based Packing-Aware Encoder for Robust Malware Detection
Jun 11, 2026Fatima Qaiser, Bisma Tahir, Muhammad Abid Mughal +1Malware Classification Malware Analysis
Department of Computer & Information Sciences, Pakistan Institute of Engineering & Applied Sciences (PIEAS), Islamabad, Pakistan
MOLOT System Card: Malicious Operational Logic Observation Transformer
Jun 5, 2026Daniil Lopatkin, Maksim Mitrofanov, Stanislav Rakovsky +1Static Code Analysis Malware Classification
Data Science & ML Dept. Positive Technologies False Positive Community
AMD-FCG: An Enhanced Function Call Graph Dataset with Integrated Topological Features for Malware Detection and Classification
Jun 5, 2026Parthajit Borah, Sakshi Singh, D. K. Bhattacharyya +1Malware Classification Malware Analysis
School of Cyber Security and Digital Forensics, National Forensic Sciences University,Guwahati. · Department of Computer Science and Engineering, Tezpur University, Tezpur, 784028, Assam, India. · Computer Science, College of Engineering and Applied Science, University of Colorado,Colorado Springs, CO 80933-7150, Colorado, USA.
High-Precision APT Malware Attribution with Out-of-Scope Resilience
Jun 2, 2026Peter Williams, Adam Sobey, Erisa KarafiliSelective Prediction Malware Classification
University of Southampton, Southampton, UK · The Alan Turing Institute, London, UK
A Hybrid Approach For Malware Classification Using Secondary Features Fusion
Jun 2, 2026Raja Khurram Shahzad, Muhammad Mustaqeem, Haroon ElahiMalware Classification Malware Analysis
Department of Computer and System Science, Mid Sweden University, Östersund Campus, Jämtland, Sweden. · Department of Engineering, Arbisoft (Pvt.) Ltd., Lahore, Punjab, Pakistan. · Department of Computing Science and Engineering, Chalmers University of Technology, Gothenburg, Västerbotten, Sweden.
Large Byte Model: Teaching Language Models About Compiled Code
Jun 1, 2026Florian Störtz, Catalin-Andrei Stan, Alexandru Dinu +4Malware Classification Byte-Level Language Model
CrowdStrike · CrowdStrike U.K. · CrowdStrike Romania +1
Building an Adversarial Malware Dataset by Family and Type: Generation, Evasion, and Poisoning Evaluation
May 25, 2026David Košťál, Martin JurečekAdversarial Attacks Malware Classification
Department of Information Security, Faculty of Information Technology, Czech Technical University in Prague
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
May 24, 2026Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram murthy Chebiyam +2Concept Drift Continual Learning
Indian Institute of Technology Ropar, India · Indian Institute of Technology Hyderabad, India
Learning to Look Benign: Targeted Evasion of Malware Detectors via API Import Injection
May 18, 2026Juozas Dautartas, Olga Kurasova, Juozapas Rokas Čypas +1Adversarial Attacks Malware Classification
Institute of Data Science and Digital Technologies, Faculty of Mathematics and Informatics, Vilnius University, LT-08412 Vilnius, Lithuania
Attacking the First-Principle: A Black-Box, Query-Free Targeted Mimicry Attack on Binary Function Classifiers
May 18, 2026Gabriel Sauger, Jean-Yves Marion, Sazzadur Rahaman +3Adversarial Attacks Malware Classification
UL, CNRS, LORIA, Inria · ∗Universit´e de Lorraine, CNRS, LORIA, F-54000 Nancy, France · CNRS, UL, LORIA, Inria +2
FreeMOCA: Memory-Free Continual Learning for Malicious Code Analysis
May 10, 2026Zahra Asadi, Haeseung Jeon, Sohyun Han +3Class-Incremental Learning Mode Connectivity
Division of Artificial Intelligence & Software Ewha Womans University · Department of Computer Science University of Texas at El Paso
Beyond the Wrapper: Identifying Artifact Reliance in Static Malware Classifiers using TRUSTEE
May 7, 2026Riyazuddin Mohammed, Lan ZhangMalware Classification Malware Analysis
School of Informatics, Computing, and Cyber Systems
McNdroid: A Longitudinal Multimodal Benchmark for Robust Drift Detection in Android Malware
May 7, 2026Md Mahmuduzzaman Kamol, Jesus Lopez, Saeefa Rubaiyet Nowmi +5Concept Drift Android Malware Detection
Department of Computer Science, University of Texas at El Paso · CrowdStrike
TUANDROMD-X: Advanced Entropy and Visual Analytics Dataset for Enhanced Malware Detection and Classification
May 7, 2026Parthajit Borah, Upasana Sarmah, D. K. Bhattacharyya +1Malware Classification Malware Analysis
Department of Computer Science and Engineering, Tezpur University, Tezpur, 784028, Assam, India. · Computer Science, College of Engineering and Applied Science, University of Colorado,Colorado Springs, CO 80933-7150, Colorado, USA.

Oct 18, 2026J/K move · Enter open · S save

Federated Learning for Malware Image Classification under Data Heterogeneity

Victor Taiwo, Cemal Nisan, Muhammad Athallah, M. Emre Gursoy+1

Department of Computer Engineering, Koç University, Istanbul, Türkiye · Informatics Institute, Istanbul Technical University, Istanbul, Türkiye

Non-IID Federated Learning Federated Learning Malware Classification Client Selection in Federated Learning

Open paper AskPDF arXiv

Malware image classification (MIC), in which binary files are converted into visual representations and deep neural networks are trained to identify malware families, has recently emerged as an effective approach for malware detection. Federated learning (FL) enables malware image classifiers to be trained collaboratively by multiple clients without sharing raw data. However, a fundamental challenge in FL is data heterogeneity (non-IID), which is particularly relevant but understudied in the malware context. In this paper, we address this gap via three contributions. First, we present an empirical study of federated MIC under varying degrees of data heterogeneity across three popular malware image datasets (MalImg, Virus-MNIST, and MalNet). We show that while FL achieves strong accuracy under IID conditions, both accuracy and training stability degrade as data becomes increasingly non-IID. Second, we introduce a set of round-level statistics that characterize the data contributed by participating clients in each FL round, and demonstrate that class entropy (diversity of class labels present in a given round) exhibits strong positive correlation with global model accuracy. Third, leveraging this insight, we propose an entropy-aware client selection strategy that filters candidate client subsets based on class entropy, and show that our strategy outperforms standard random selection. Our results highlight the role of client composition in federated MIC and underscore the importance of distribution-aware classifier training under data heterogeneity.