Xinglong Cao, Cong Wang^*, Jie Yan, Songcan Yu, Mingze He

CMC-Computers, Materials & Continua, Vol.89, No.2, 2026, DOI:10.32604/cmc.2026.086163 - 15 September 2026

Abstract There is currently a lack of systematic research on the fine-grained detection of multi-language and multi-type exploit scripts. To address this gap, this study proposes a model named ASTBertX (AST + BERT + XGBoost) for identifying the specific exploit types of malicious scripts; the model organically integrates code sequence semantics with structural semantics. First, the model utilizes the pre-trained model GraphCodeBERT to extract contextual semantic representations of the scripts; simultaneously, it introduces semantic enhancement nodes into the Abstract Syntax Tree (AST) and employs GATv2 to learn the AST’s structural representation. These two representations are mapped… More >

Tuan Nguyen Kim^1,*, Son Doan Trung¹, Nguyen Minh Nhut Pham²

CMC-Computers, Materials & Continua, Vol.89, No.1, 2026, DOI:10.32604/cmc.2026.084268 - 13 August 2026

Abstract Static Windows Portable Executable (PE) malware detection remains a significant challenge due to the growing use of packing, obfuscation, and code reuse techniques, which gradually reduce the effectiveness of signature-based and manually engineered feature approaches. Recent deep learning models that operate directly on binary code or static features have achieved encouraging results; however, most still rely on global file-level representations. Such approaches are susceptible to noise introduced by padding or obfuscation and may overlook localized malicious regions. Moreover, many multi-view methods process different feature sources independently, lacking mechanisms to enforce semantic consistency across views. This… More >

Phil Steadman^*, Paul Jenkins, Rajkumar Singh Rathore^*, Chaminda Hewage

CMC-Computers, Materials & Continua, Vol.88, No.3, 2026, DOI:10.32604/cmc.2026.083998 - 23 July 2026

Abstract Modern malware is increasingly employing polymorphism, packing, and metamorphism to evade traditional signature-based detection. Because of this, there is an urgency to have more reliable classification systems. Visual malware analysis, where binaries are converted into grayscale images, has demonstrated potential in revealing structural patterns of malware family classification. However, recent methods mostly rely on single-stream, lightweight Convolutional Neural Networks (CNNs). These models have a major blind spot. The visual representation textures can be heavily obscured without changing the underlying malicious code, causing severe performance drops on newer or even rare malware classes. This paper presents… More >

Anis Elgarduh¹, Anazida Zainal¹, Fuad A. Ghaleb², Sultan Noman Qasem^3,*, Abdullah M. Albarrak³, Faisal Saeed²

CMES-Computer Modeling in Engineering & Sciences, Vol.147, No.3, 2026, DOI:10.32604/cmes.2026.080862 - 30 June 2026

Abstract The rapid growth and increasing sophistication of malware pose significant challenges to traditional detection methods. Convolutional neural network (CNN)-based malware image classification methods have emerged as a promising approach by transforming binary files into visual representations and enabling automated feature extraction. To enhance discriminative learning, recent studies have incorporated attention mechanisms originally developed for natural image and natural language processing tasks. However, these mechanisms embed inductive biases that assume spatial coherence and visually salient semantics, assumptions that do not necessarily hold in malware image representations, where informative patterns may be subtle, structurally encoded, and globally… More > Graphic Abstract

Ammar Odeh^*, Osama Alhaj Hassan, Anas Abu Taleb

CMC-Computers, Materials & Continua, Vol.88, No.2, 2026, DOI:10.32604/cmc.2026.080940 - 15 June 2026

Abstract The rapid growth of sophisticated malware and the increasing diversity of computing environments have exposed critical limitations in traditional centralized malware detection systems, particularly in data privacy, scalability, and adaptability. This study proposes a privacy-preserving, collaborative malware-detection framework that leverages federated learning to improve detection accuracy while keeping sensitive data local to participating devices. The objective is to address emerging malware threats by combining behavioral and memory-based analysis within a decentralized learning paradigm. The proposed framework employs federated learning to train a global malware detection model without transferring raw data. Each client locally extracts discriminative… More >

Amjad Hussain^1,*, Ayesha Saadia^2,*, Chihhsiong Shih³, Nazish Nawaz², Amir H. Gandomi^4,*, Khursheed Aurangzeb⁵

CMES-Computer Modeling in Engineering & Sciences, Vol.147, No.2, 2026, DOI:10.32604/cmes.2026.078451 - 27 May 2026

Abstract Malware has evolved from the early Creeper virus into highly sophisticated and organized cyber threats. Over time, it grew in sophistication, adopting advanced techniques, stealth tactics, and autonomous propagation. Modern malware leverages encryption, obfuscation, zero-day exploits, and AI-assisted techniques to conduct stealthy and persistent attacks. Classification of its exact family is the end goal to defend and mitigate the latest attacks. Researchers have contributed significantly and introduced many techniques to tackle malware threats. Binary detection is performed at a large scale, but very little in multi-class classification. In this research, a hybrid technique is proposed… More >

Zheng Yang¹, Hua Zhu^1,*, Zhao Li², Gang Wang³, Meng Su¹

Journal of Cyber Security, Vol.8, pp. 189-210, 2026, DOI:10.32604/jcs.2026.078232 - 18 May 2026

Abstract The rapid integration of IoT technologies in modern power systems, while enhancing operational efficiency, has introduced critical cybersecurity vulnerabilities. The proliferation of interconnected terminal devices across diverse operational domains has escalated cybersecurity risks, particularly from sophisticated malware attacks targeting critical grid infrastructure. These threats manifest through Application Programming Interface (API) call hijacking, command injection in industrial control protocols, and evasion of conventional signature-based detection systems. To address these challenges, this paper proposes a novel malware detection framework specifically designed for power IoT ecosystems. First, a malware detection model based on long short-term memory network (LSTM)… More >

Muhammad Shaheer¹, Feng Zeng^1,*, Aqsa Yasmeen², Mudasir Ahmad Wani^3,*, Kashish Ara Shakil⁴, Muhammad Asim⁵

CMC-Computers, Materials & Continua, Vol.88, No.1, 2026, DOI:10.32604/cmc.2026.079701 - 08 May 2026

Abstract Malware remains a persistent and evolving threat to digital security, highlighting the need for advanced and resilient detection frameworks capable of mitigating increasingly sophisticated and evasive cyberattacks. Although deep learning ensembles have been explored, many existing approaches fail to balance computational efficiency with the diverse feature extraction capabilities needed for complex variants. To address this gap, this study proposes a novel stacking ensemble framework, MalDetect-IoT, which specifically eliminates the requirement for manual feature engineering and domain specific preprocessing traditionally required in malware classification. By fine-tuning two pre-trained models MobileNetV3 for its lightweight efficiency and Xception… More >

Xian Wu, Liang Wan^*, Jingxia Ren, Bangfeng Zhang

CMC-Computers, Materials & Continua, Vol.88, No.1, 2026, DOI:10.32604/cmc.2026.077928 - 08 May 2026

Abstract Traditional malware detection models rely on a single feature source for detection, resulting in high false positive or false negative rates due to incomplete information. In addition, conventional models depend on manual feature engineering, which is inefficient and hard to adapt to new malware variants. To address these challenges, this paper proposes a malware detection model called WAFDect based on a self-attention mechanism with multi-source feature fusion. The model consists of two key designs. First, we construct a multi-source feature extraction model that analyzes multi-source data such as API call sequences, registry operation logs, file… More >

Sohail Khan^1,*, Toqeer Ali Syed², Mohammad Nauman¹, Salman Jan³, It Ee Lee⁴, Qamar Wali⁴

CMC-Computers, Materials & Continua, Vol.88, No.1, 2026, DOI:10.32604/cmc.2026.075265 - 08 May 2026

Abstract The detection of zero-day malware represents one of the most significant challenges in contemporary cybersecurity. In this paper, we introduce a novel concept called “Negative-One-Day Malware Detection”, which aims to identify potentially malicious software before it is actually created by threat actors. Our approach leverages recent advancements in generative AI, specifically diffusion-based generative models, to generate and analyze potential future malware variants. By doing so, we can train detection systems to recognize these variants before they emerge in the wild, thereby closing the critical protection gap that currently exists between malware creation and detection. We More >