| 摘要: |
| 恶意代码家族分类是威胁溯源、变种分析和自动化安全响应的重要基础，但加壳、混淆、反汇编不稳定以及函数调用图缺失等问题会削弱单模态特征的判别能力。针对模态质量波动和图结构不可用条件下分类鲁棒性不足的问题，本文提出一种缺失感知三模态跨模态注意力融合模型 TMCAN-AD。该方法从恶意代码样本中构建字节图像、Mel 频谱图和函数调用图三类异构表示，并分别通过 DenseNet121 视觉分支、轻量级频谱卷积分支和图同构网络结构分支映射到统一的 512 维隐空间。与直接删除图构建失败样本的方法不同，TMCAN-AD 在预处理阶段保留图模态不可用样本，并通过可用性编码、缺失 token 和占位图结构显式描述模态缺失状态。在融合阶段，模型在跨模态 Transformer 中引入可用性偏置矩阵，对不可用模态施加硬屏蔽，以减少无效跨模态交互；同时结合调度式模态随机丢弃、注意力均衡约束、决策级辅助融合和多辅助监督，缓解视觉模态主导问题并增强弱模态学习能力。BIG2015 数据集实验表明，TMCAN-AD 取得 98.99% 的 Accuracy、97.58% 的 Macro-F1 和 98.63% 的 Balanced Accuracy，在类别均衡性能上优于单模态基线和传统晚期融合方法；在真实图结构缺失子集上仍保持 88.46% 的 Accuracy，说明模型能够适应实际图缺失场景。进一步的模态缺失实验、多随机种子稳定性分析、辅助损失消融、带随机基线的中心核对齐分析以及基于 Grad-CAM 的可解释性评估表明，该方法能够有效利用不同模态间的共享信息与互补信息，并保持较稳定的判别行为。外部 MOTIF-38 补充实验显示，在小样本多类别和图质量退化条件下，TMCAN-AD 相比晚期融合仍能获得温和增益，但图分支贡献受到自动图构建质量限制。总体而言，本文方法提升了不完整和噪声多模态输入条件下恶意代码家族分类的鲁棒性、均衡识别能力和可解释性。 |
| 关键词: 恶意代码家族分类 多模态融合 跨模态注意力 函数调用图 模态缺失鲁棒性 缺失感知编码 注意力均衡 |
| DOI： |
| 投稿时间：2026-05-15修订日期：2026-07-21 |
| 基金项目:黑龙江省重点研发计划项目 项目编号：2022ZX01A30 |
|
| Malware Family Classification Based on Missing-Aware Cross-Modal Attention Fusion |
|
lili, yuhaiyang, lisu, wuhao
|
| (Northeast Forestry University) |
| Abstract: |
| Malware family classification plays an important role in threat attribution, variant tracing, and automated security response, but its reliability is often weakened by packing, obfuscation, unstable reverse engineering, and unavailable function call graphs. To address these problems, this paper proposes a missing-aware tri-modal cross-modal attention model for malware family classification, named TMCAN-AD. The proposed method constructs three heterogeneous malware representations, including byte images, Mel spectrograms, and function call graphs, and maps them into a unified 512-dimensional latent space through a DenseNet121-based visual branch, a lightweight spectral convolution branch, and a Graph Isomorphism Network (GIN)-based structural branch. Unlike methods that simply discard samples with failed graph construction, TMCAN-AD preserves graph-unavailable samples during preprocessing and explicitly represents their states by using availability embeddings, missing tokens, and placeholder graphs. In the fusion stage, an availability-aware attention bias is introduced into the cross-modal Transformer to mask unavailable modalities and reduce invalid interactions. Moreover, scheduled modality dropout, attention balance regularization, decision-level auxiliary fusion, and multi-auxiliary supervision are incorporated to alleviate visual dominance and strengthen weak-modal learning. Experiments on the BIG2015 dataset show that TMCAN-AD achieves 98.99% Accuracy, 97.58% Macro-F1, and 98.63% Balanced Accuracy, outperforming single-modal baselines and conventional late fusion in terms of class-balanced performance. On the real graph-missing subset, the proposed model retains 88.46% Accuracy, indicating its ability to adapt to realistic incomplete-modality conditions. Further analyses, including missing-modality evaluation, multi-seed stability testing, auxiliary-loss ablation, Centered Kernel Alignment (CKA) with shuffled baselines, and Gradient-weighted Class Activation Mapping (Grad-CAM)-based interpretability evaluation, demonstrate that the model can exploit both shared and complementary information among modalities while maintaining stable decision behavior. Additional experiments on the external MOTIF-38 subset show that TMCAN-AD still obtains moderate gains over late fusion under small-sample multi-class conditions, although graph quality degradation limits the contribution of the graph branch. Overall, the results indicate that the proposed missing-aware cross-modal fusion strategy improves the robustness, balanced classification ability, and interpretability of malware family classification under incomplete and noisy multimodal inputs. |
| Key words: malware family classification multimodal fusion cross-modal attention function call graph missing-modality robustness missing-aware encoding attention balance |
