Hybrid Convolutional-Hopfield Neural Networks for Image-Based Malware Classification
TL;DR
A novel hybrid CNN-Hopfield Neural Network (CNN-HNN) framework that replaces traditional dense classification heads with continuous Modern Hopfield associative memory layers is proposed, achieving top-tier accuracy and reducing classification-head parameter counts while reducing floating-point operations (FLOPs) and accelerating inference latency to under 2 ms per sample.
Abstract
Static malware analysis increasingly relies on visual binary representations to bypass signature evasion techniques, yet standard Convolutional Neural Network (CNN) classifiers depend on parameterized Fully Connected (FC) layers that introduce parameter bloat, high latency, and vulnerability to class imbalance. To address these structural limits, this paper proposes a novel hybrid CNN-Hopfield Neural Network (CNN-HNN) framework that replaces traditional dense classification heads with continuous Modern Hopfield associative memory layers. In this architecture, raw malware executables are transformed into 2D grayscale image matrices, from which a CNN backbone extracts abstract latent feature representations. The continuous Hopfield layer then acts as a pattern retrieval engine, evaluating the extracted query vector against stored class archetype prototypes using log-sum-exp energy minimization. Benchmark evaluations on the MalImg and Microsoft Malware Classification Challenge datasets demonstrate that the hybrid model achieves top-tier accuracy (99.58% and 99.62%, respectively) while reducing classification-head parameter counts by up to 78%, lowering floating-point operations (FLOPs) by over 65%, and accelerating inference latency to under 2 ms per sample. Furthermore, the associative energy landscape isolates minority threat categories within distinct basins of attraction, achieving an F1-score improvement of over 20% on severely imbalanced classes compared to standard CNNs.