AMN: Attention-based Multimodal Network for Android Malware Classification

With the rapid evolution of malware, android malware classification has become increasingly important and remains an active area of research. Traditional machine learning methods rely heavily on hand-crafted features based on expert domain knowledge, making the feature engineering process time-consuming. In recent years, deep learning-based Android malware classification has attracted considerable attention, inspired by the remarkable success of deep learning techniques in the fields of vision and natural language processing. Deep learning methods replace the manual process of feature engineering with a framework capable of simultaneous feature extraction and classification directly from raw data. However, existing approaches do not fully exploit hybrid and multimodal features, which limits their ability to consider multiple disparate sources of information during classification. In this paper, we present attention-based multimodal network(AMN), a multimodal approach to malware classification based on the attention mechanism. AMN combines two modalities of data: 1) grayscale images generated by malware binary files, and 2) network traffic feature sequences. The model employs a cross-modal attention mechanism that combines the features of both modalities by compensating for their limitations. Furthermore, a transfer learning method is proposed to improve the generalization performance of the model, especially in scenarios with limited sample size. The proposed solution surpasses the state-of-the-art precision, achieving 97.73%, along with a recall of 96.51%, as demonstrated through experiments conducted on the CICInvesAndMal2017 dataset. Additionally, to show the effectiveness of our model, ablation experiments were conducted.