Open this publication in new window or tab >>Show others...
2026 (English)In: IEEE Transactions on Dependable and Secure Computing, ISSN 1545-5971, E-ISSN 1941-0018, Vol. 23, no 3, p. 5589-5603Article in journal (Refereed) Published
Abstract [en]
As malware continues to evolve in complexity and diversity, traditional single-modal detection approaches demonstrate limited discriminative capacity and struggle to generalize to variants. Although existing approaches attempt to capture program semantics and logic, current designs still struggle to exploit complementary information across heterogeneous modalities. Mechanisms for quantifying inter-modal conflicts, modeling uncertainty, and moving beyond perturbation-prone surface features remain underdeveloped. To address these limitations, we propose DSMalConv, a multi-modal malware detector that fuses byte-level Grayscale Images with Attributed Control Flow Graphs (ACFGs). Convolutional Neural Network (CNN) modules extract visual patterns, while Graph Neural Network (GNN) modules model execution flow dependencies, yielding complementary representations. We further integrate Dempster-Shafer (DS) evidence theory to identify uncertain samples, incorporate uncertainty into the training loss function, and provide test-time feedback to facilitate safer automated decisions. Experimental evaluations on cross-architecture datasets demonstrate that DSMalConv achieves an average accuracy of 99.76% and F1 of 99.75%, outperforming strong baselines. Analysis reveals that shallow features and multi-modal methods achieve only 94.21% to 97.65% accuracy due to insufficient representations and unresolved inter-modal conflicts, leading to misclassifications. DSMalConv overcomes these limitations through dual-modal fusion and an uncertainty-aware decision mechanism, achieving robust detection under high-conflict conditions. Robustness evaluations against adversarial attacks targeting both visual and structural representations demonstrate that DSMalConv exhibits superior resistance through credible fusion of multi-modal features. The ablation studies further validate the effectiveness of the multi-modal fusion strategy.
Place, publisher, year, edition, pages
Institute of Electrical and Electronics Engineers Inc., 2026
Keywords
Attributed Control Flow Graph, Dempster-Shafer Evidence Theory, Grayscale Image, Malware Detection, Multi-modal
National Category
Computer Sciences
Identifiers
urn:nbn:se:mau:diva-82612 (URN)10.1109/TDSC.2026.3656958 (DOI)001765029300010 ()2-s2.0-105028639789 (Scopus ID)
2026-02-102026-02-102026-08-24Bibliographically approved