PMV-NET: Adaptive Prototype-Guided Multi-View Metric Learning for Malware Variant Identification

Abstract

: Malware analysis requires effective representation learning to characterize similarities among malware samples, especially when samples from the same family exhibit variations caused by packing, obfuscation, and code modifications. However, existing studies mainly focus on malware detection or family classification, while learning discriminative family-level representations for similarity analysis remains challenging when relying on limited feature views. This paper presents PMV-Net (Prototype-guided Multi-View Network), an adaptive prototype-guided multi-view metric learning framework for malware family analysis, including family-level classification and similarity retrieval. PMV-Net integrates three complementary views extracted from Windows Portable Executable files, including raw byte content, PE structural information, and API/import features. These heterogeneous representations are projected into a shared embedding space, where adaptive family prototypes capture family characteristics and prototype-guided metric learning promotes compact intra-family distributions and improved inter-family separability. Experiments on the BIG 2015 malware dataset evaluate PMV-Net through family-level classification, similarity retrieval, clustering, and embedding visualization. PMV-Net achieves an Accuracy of 98.76% and an F1-score of 98.45% for family-level classification, outperforming all baseline methods. For family-level similarity retrieval, the proposed framework obtains a Recall@1 of 97.12% and a mean Average Precision (mAP) of 97.46%. The learned embeddings achieve an NMI of 97.18% and an ARI of 96.43%, demonstrating strong family-level clustering consistency. Ablation studies further validate the contribution of multi-view fusion, adaptive prototype learning, and metric learning. The results demonstrate that PMV-Net provides an effective and practical solution for malware family representation and similarity analysis.