Open Access

ARTICLE

A Multi-Modal Deep Learning Framework for Robust Polymorphic Malware Detection

Phil Steadman^*, Paul Jenkins, Rajkumar Singh Rathore^*, Chaminda Hewage

Cardiff School of Technologies, Cardiff Metropolitan University, Cardiff, UK

* Corresponding Authors: Phil Steadman. Email: ; Rajkumar Singh Rathore. Email:

Computers, Materials & Continua 2026, 88(3), 86 https://doi.org/10.32604/cmc.2026.083998

Received 14 April 2026; Accepted 04 June 2026; Issue published 23 July 2026

Abstract

Modern malware is increasingly employing polymorphism, packing, and metamorphism to evade traditional signature-based detection. Because of this, there is an urgency to have more reliable classification systems. Visual malware analysis, where binaries are converted into grayscale images, has demonstrated potential in revealing structural patterns of malware family classification. However, recent methods mostly rely on single-stream, lightweight Convolutional Neural Networks (CNNs). These models have a major blind spot. The visual representation textures can be heavily obscured without changing the underlying malicious code, causing severe performance drops on newer or even rare malware classes. This paper presents a Hybrid Multi-Modal Deep Learning framework to fix this vulnerability. The proposed dual-stream architecture uses image recognition via EfficientNetB0 alongside metadata analysis using 1D-convolutional byte embeddings. This paper evaluated the framework on the modern MalwareVision-2025 dataset (approximately 125,000 samples) and the legacy Malimg dataset (9339 samples). On MalwareVision-2025, the model reached a weighted accuracy of 88.44% and achieved 100% benign recall on the evaluated split. The testing across both datasets shows that combining visual and structural features reduces modality collapse. This creates a much stronger system compared to using either input type on its own. In particular, the hybrid approach improves detection performance on deeply hidden contemporary threats, including the AveMariaRAT and CobaltStrike families.

---

Keywords

---