Submit

Login Login

Register Register

Home / Journals / CMC / Online First / doi:10.32604/cmc.2026.086163
Journal Menu
Special Issues
Table of Content

All issues

Online First

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Open Access

ARTICLE

ASTBertX: Multilingual Sequence–Structure Fusion for Exploit Type Identification in Malware Detection

Xinglong Cao, Cong Wang*, Jie Yan, Songcan Yu, Mingze He
Police Integration Computing Key Laboratory of Sichuan Province, Sichuan Police College, Chengdu, China
* Corresponding Author: Cong Wang. Email: email
(This article belongs to the Special Issue: Recent Advances in Malware Detection)

Computers, Materials & Continua https://doi.org/10.32604/cmc.2026.086163

Received 25 May 2026; Accepted 13 July 2026; Published online 10 August 2026

Abstract

There is currently a lack of systematic research on the fine-grained detection of multi-language and multi-type exploit scripts. To address this gap, this study proposes a model named ASTBertX (AST + BERT + XGBoost) for identifying the specific exploit types of malicious scripts; the model organically integrates code sequence semantics with structural semantics. First, the model utilizes the pre-trained model GraphCodeBERT to extract contextual semantic representations of the scripts; simultaneously, it introduces semantic enhancement nodes into the Abstract Syntax Tree (AST) and employs GATv2 to learn the AST’s structural representation. These two representations are mapped into intermediate vectors of uniform dimensionality via multi-layer perceptrons, followed by feature alignment training through a projection layer containing a temporary proxy classifier; finally, the aligned features are fed into an XGBoost classifier to output predictions regarding the exploit type. Upon completion of training, the proxy classifier is discarded, retaining only the parameters of the projection layer. Experimental results demonstrate that the method achieves an accuracy of 95% in five-class classification tasks and 99% in binary classification tasks (malicious vs. benign). The model not only matches baseline methods in binary detection performance but also effectively identifies specific exploit types.

Keywords

Exploit type; cross language; malware detection; malicious code

  • 56

    View

  • 9

    Download

  • 1

    Like

Related articles
Copyright© 2026 Tech Science Press
© 1997-2026 TSP (Henderson, USA) unless otherwise stated

Share Link