Feature fusion-based squeeze and excitation (FFSE)–bidirectional temporal convolutional network (BiTCN): A hybrid malware detection model

Abstract

Cybersecurity threats continue to escalate with the rapid advancement of internet technology, with malicious code posing a particularly daunting challenge. Traditional detection methods based on feature code matching struggle to keep pace with evolving anti-detection techniques and the proliferation of malicious code variants. Current malware detection often relies on extracting opcode sequences or converting binary files into grayscale maps for analysis based on deep learning. However, text-based methods for malware detection face decompilation errors due to obfuscation, which compromise feature extraction accuracy, and the limitation of n-gram in capturing global behavior patterns beyond local opcode sequences. Image-based methods, on the other hand, risk losing code structure and semantics during image conversion, and the need for fixed-size inputs in convolutional neural networks can lead to feature information loss during resizing or cropping. To address these challenges, this paper proposes feature fusion-based squeeze and excitation (FFSE)–bidirectional temporal convolutional network (BiTCN), a novel hybrid malware detection model that integrates the advantages of FFSE and BiTCN. The FFSE is utilized to extract multi-scale features and fuse global and local features with a channel attention mechanism, while the BiTCN is adopted to capture temporal evolution of malware behavior and integrate features of different levels with a pooling fusion mechanism. Experimental results on the BIG2015 and DataCon datasets demonstrate that the proposed model outperforms existing malware detection methods in terms of $\text{Accuracy}$ , $\text{Recall}$ , and $\text{F1-score}$ . It proves the robustness and generalization of the proposed model and contributes significantly to the field of malware detection.