2026· International journal of research and scientific innovation· 0 citations
TL;DR
A novel hybrid CNN-Hopfield Neural Network (CNN-HNN) framework that replaces traditional dense classification heads with continuous Modern Hopfield associative memory layers is proposed, achieving top-tier accuracy and reducing classification-head parameter counts while reducing floating-point operations (FLOPs) and accelerating inference latency to under 2 ms per sample.
Abstract
Static malware analysis increasingly relies on visual binary representations to bypass signature evasion techniques, yet standard Convolutional Neural Network (CNN) classifiers depend on parameterized Fully Connected (FC) layers that introduce parameter bloat, high latency, and vulnerability to class imbalance. To address these structural limits, this paper proposes a novel hybrid CNN-Hopfield Neural Network (CNN-HNN) framework that replaces traditional dense classification heads with continuous Modern Hopfield associative memory layers. In this architecture, raw malware executables are transformed into 2D grayscale image matrices, from which a CNN backbone extracts abstract latent feature representations. The continuous Hopfield layer then acts as a pattern retrieval engine, evaluating the extracted query vector against stored class archetype prototypes using log-sum-exp energy minimization. Benchmark evaluations on the MalImg and Microsoft Malware Classification Challenge datasets demonstrate that the hybrid model achieves top-tier accuracy (99.58% and 99.62%, respectively) while reducing classification-head parameter counts by up to 78%, lowering floating-point operations (FLOPs) by over 65%, and accelerating inference latency to under 2 ms per sample. Furthermore, the associative energy landscape isolates minority threat categories within distinct basins of attraction, achieving an F1-score improvement of over 20% on severely imbalanced classes compared to standard CNNs.
The findings indicate that combining deep representation learning with ensemble classification can improve dynamic malware detection and reduce dependence on static signatures.
Karthick Ganapathy· Journal of Computer and Fore...· 0 citations
A Hybrid Multi-Modal Deep Learning framework that combines visual and structural features reduces modality collapse and creates a much stronger system compared to using either input type on its own, improves detection performance on deeply hidden contemporary threats, including the AveMariaRAT and CobaltStrike families.
Phil Steadman, Paul Jenkins, Rajkumar Singh Rathore et al.· Computers, Materials & C...· 0 citations
Evaluation using metrics such as accuracy, precision, F1 score, and false positive rate indicates that CNN-GBM outperforms existing deep learning models, and enhancements stem from the effective integration of CNN feature extraction with GBM’s boosting capabilities.
C. Chimeleze, Norziana Jamil, Z. M. Zain et al.· Scientific Reports· 0 citations
A Hybrid Neural Network–Convolutional Neural Network (NN–CNN) Deep Learning Framework for malware detection, malware-family classification, and malware-variant identification and considers two important issues in practical malware detection: model explainability and generalization to previously unseen malware.
Chioma Grace Nwankwo, B. C. Amanze, Ikechukwu Amaefule· World Journal of Advanced Re...· 0 citations
The detection of malware is a great challenge in cybersecurity because the threat environment keeps on changing. Convolutional Neural Networks (CNNs) are frequently applied to conduct image-based malware detection. On the other hand, Vision Transformers (ViTs) that leverage self-attention mechanisms have emerged as a new deep learning paradigm for image-based malware detection. Thus, it raises the question of which architectural paradigm would perform this task more effectively. The research presented in this paper provides an empirical comparison of ViTs and CNNs for malware family classification. In this paper, six CNNs (namely VGG-16, ResNet-50, DenseNet-121, EfficientNet-B0, RegNetY, ConvNeXt) and six ViTs (namely ViT, DeiT, Swin Transformer V1, Swin Transformer V2, PVT-V2, MaxViT) are adopted for empirical evaluation across two malware datasets, which are the Malware Images (MalImg) and the dataset of Virus-Modified National Institute of Standards and Technology (VirusMNIST). The model performances are assessed using the Macro F1-Score and Accuracy metrics. All twelve models are trained in very strict and fair conditions of the experiment. A statistical test is conducted to compare the classification performances of the ViT and CNN groups, and results are analyzed and discussed. The statistical studies show that ViTs achieve a significantly higher Macro F1-Score than the CNNs on the larger dataset (i.e., Virus-MNIST) while requiring a comparable training duration.
Zhi-Siang Lim, Shing-Chiang Tan· International Conference on...· 0 citations
The proliferation of polymorphic and metamorphic malware has largely rendered traditional cryptographic signature-based detection ineffective, driving the adoption of similarity-based approaches. This survey systematically examines the evolution of binary similarity detection, tracing the trajectory from classical fuzzy hashing techniques—including ssdeep, sdhash, and TLSH—to contemporary deep representation learning architectures. We analyze state-of-the-art deep hashing methodologies, covering image-based representations via Convolutional Neural Networks (CNNs), structural control-flow graph modeling via Graph Neural Networks (GNNs), and assembly-level semantic analysis using Transformer architectures such as MalBERT and KEENHash. Furthermore, we critically assess the adversarial robustness of these embedding spaces across feature-space and problem-space threat models. By synthesizing recent theoretical developments and empirical benchmarks, this paper provides a unified taxonomy and outlines key challenges for resilient malware lineage tracking and zero-day threat detection.
Uma Kannan, Rajendran Swamidurai· International journal of res...· 0 citations