A Performance Comparison of Convolutional Neural Networks and Vision Transformers for Malware Detection

A Survey on Deep Learning Approaches for Malware Detection and Classification

Malware is a serious threat in the cybersecurity area because of its dynamic nature, the variety of malware families, stealth, propagation and the capability of evading traditional security products. Therefore, proper malware detection and classification are crucial for detecting malicious software and for securing computer systems from unauthorized access and data stealing, and for disrupting systems. This study covers all the bases when it comes to deep learning approaches for malware detection and classification. It covers the principles, different forms of malware, how to detect deep learning malware, how to represent data, obtaining features, and applications. The traditional detection methods are described with their drawbacks, namely based on signature, behavioral and heuristic methods. The report also delves into the methodologies used by deep learning to classify malware, namely CNNs and Bidirectional Long Short-Term Memory (BiLSTM) networks. BiLSTM models excel at learning sequential features from code-or behavior-related data, whereas CNN-based representation learning approaches excel at learning spatial features from malware representations. Moreover, the various detection techniques (static, dynamic and hybrid) are discussed so that their role in malware analysis can be understood. The survey identifies the current challenges and gaps in research and emphasizes the need for strong, scalable and adaptive deep-learning models to combat new malware threats and enhance cybersecurity protection.

RES2NET-MAXOUT: Image-Based Multi-Class Malware Classification with Deep Learning Models

DEVELOPMENT OF A HYBRID NN–CNN DEEP LEARNING FRAMEWORK FOR INTELLIGENT MALWARE DETECTION, FAMILY CLASSIFICATION, AND VARIANT IDENTIFICATION

A Hybrid Neural Network–Convolutional Neural Network (NN–CNN) Deep Learning Framework for malware detection, malware-family classification, and malware-variant identification and considers two important issues in practical malware detection: model explainability and generalization to previously unseen malware.

Lightweight CNN with Multi-Head Attention for Image-Based Malware Classification

This paper introduces a compact convolutional neural network (CNN) architecture integrated with a multi-head attention mechanism to enhance feature discrimination in malware family classification. The novelty lies in combining attention-based refinement within a lightweight framework that achieves comparable accuracy to larger model while maintaining computational efficiency. The integrated multi-head attention module emphasizes small yet highly discriminative regions, which often correspond to obfuscated or subtly modified code segments that traditional models overlook. In contrast to reverse engineering or handcrafted feature methods, the framework is fully automated and computationally efficient, requiring only 2.03 M parameters approximately one-fifth of the baseline CNN while reducing training time by 42% and inference latency by 37% on the same hardware configuration. Experiments were conducted on the widely used Malimg dataset, which comprises 9,342 grayscale images across 25 malware families, under multiple train–test splits (50/50 to 90/10). The results consistently demonstrate superior performance relative to the baseline CNN, the model achieving an average accuracy of 98.7 ± 0.3% across five randomized train–test splits, with a peak performance of 99% on the 80/20 partition. Data partitions were strictly disjoint to prevent leakage between training and test sets. Furthermore, the proposed model attains high weighted Precision, Recall, and F1 scores (≈0.99) and enhanced macro-averaged performance (up to 0.97), particularly enhancing classification for minority families that the baseline misclassified or failed to detect. Confusion matrix analysis further highlights that residual misclassifications occur primarily in families with limited samples or high morphological similarity. Comparative evaluation against recent studies confirms the superiority of the proposed approach in terms of both accuracy and computational efficiency. Despite these strengths, limitations remain, including dependence on labeled datasets, restricted interpretability, and the need for validation on more diverse, real-world malware corpora.

Hybrid Convolutional-Hopfield Neural Networks for Image-Based Malware Classification

A novel hybrid CNN-Hopfield Neural Network (CNN-HNN) framework that replaces traditional dense classification heads with continuous Modern Hopfield associative memory layers is proposed, achieving top-tier accuracy and reducing classification-head parameter counts while reducing floating-point operations (FLOPs) and accelerating inference latency to under 2 ms per sample.

Federated Learning for Malware Image Classification under Data Heterogeneity

: Malware image classification (MIC), in which binary files are converted into visual representations and deep neural networks are trained to identify malware families, has recently emerged as an effective approach for malware detection. Federated learning (FL) enables malware image classifiers to be trained collaboratively by multiple clients without sharing raw data. However, a fundamental challenge in FL is data heterogeneity (non-IID), which is particularly relevant but understudied in the malware context. In this paper, we address this gap via three contributions. First, we present an empirical study of federated MIC under varying degrees of data heterogeneity across three popular malware image datasets (MalImg, Virus-MNIST, and MalNet). We show that while FL achieves strong accuracy under IID conditions, both accuracy and training stability degrade as data becomes increasingly non-IID. Second, we introduce a set of round-level statistics that characterize the data contributed by participating clients in each FL round, and demonstrate that class entropy (diversity of class labels present in a given round) exhibits strong positive correlation with global model accuracy. Third, leveraging this insight, we propose an entropy-aware client selection strategy that filters candidate client sub-sets based on class entropy, and show that our strategy outperforms standard random selection. Our results highlight the role of client composition in federated MIC and underscore the importance of distribution-aware classifier training under data heterogeneity.