Lightweight multi-modal malware intelligence: A unified framework for efficient graph, temporal, causal, and federated detections
*Dipesh VayaCorresponding authordipesh.vaya88@gmail.comDepartment of Computer Science & EngineeringPoornima UniversityJaipur, Rajasthan, 303905, IndiaView full profile → , Rakesh Kumar Saxenasaxenark06@gmail.comDepartment of Computer Science & EngineeringPoornima UniversityJaipur, Rajasthan, 303905, IndiaView full profile →
* Corresponding author · click or hover a name for details
- Received:
- 01 Dec 2025
- Published Online:
- 31 Aug 2026
- Article type:
- Research Article
- Language:
- EN
- Article no.:
- JIOS-2319
- Pages:
- 3007–3015
Abstract
Malware analysis increasingly requires models that evaluate various behavioral evidence without the computational cost associated with many deep learning systems. Hierarchical memory structures, variational inference, and complex meta-learning pipelines are hard to scale and susceptible to poisoned input sets. Due to these limits, simpler, discriminative, and real-world systems are needed. This study unifies lightweight, highfidelity models to ease four-angle virus detection. By substituting deep hierarchical graph modules with dual shallow GCN encoders for control-flow and system-call graphs, the Hierarchical Graph Embedding Classifier (H-GEC) generates a compact joint embedding that resists structural obfuscations. The Segmented Time-Series Malware Detector (STMD) splits behavioral logs into windows, which are evaluated by efficient GRU encoders to detect delayed Intent malware without a variational temporal decoupling process. As a pragmatic alternative to counterfactual-based causal inference, the Causal Feature Filtering (CFF) suppresses spurious correlations and improves generalization through conditional Independence-driven feature re-weighting. For few-shot detection, the Multi-Modal Alignment Network (MMAN) aligns opcode, system-call, and network-flow representations utilizing contrastive learning and lightweight CNN, GRU, and MLP encoders. Lastly, Weighted Federated Averaging (WFA) weights client contributions based on validation performance, making decentralized training more resilient to biased local updates. These methods enable scalable, multi-modal, and tamper-resilient malware security systems by improving accuracy, interpretability, and deployment efficiency.
Keywords
Subject Classifications
References
[1] N. Nedungadi, S. Sankaran, and K. Achuthan, "Towards a lightweight hybrid multimodal approach for intrusion detection in edge-enabled IoT devices," Cluster Comput., vol. 28, no. 16, Art. no. 1010 (2025), doi: 10.1007 / s10586-025-057230.
[2] A. Patel and S. M. Ghosh, "EML-AMD: An explainable machine learning framework for adaptive Android malware detection," Peer- to-Peer Netw. Appl., vol. 18, no. 5, Art. no. 264 (2025), doi: 10.1007/ s12083-025-02069-7.
[3] C. D. McDermott and M. Nicho, "Threat detection in smart homes: A sociotechnical multimodal conversational approach for improved cyber situational awareness," Int. J. Inf. Security, vol. 24, no. 4, Art. no. 173 (2025), doi: 10.1007/s10207-025-01051-x.
[4] S. S. Baawi, Z. Ch. Oleiwi, A. M. A. Al-Muqarm, D. Al-Shammary,
and F. Sufi, "Efficient malware detection based on machine learning for enhanced cloud privacy protection," Evolving Syst., vol. 16, no. 1, Art. no. 30 (2025), doi: 10.1007/s12530-025-09661-5.
[5] J. Kumar, B. Rajendran, and S. D. Sudarsan, "Zero-day malware clas- sification and detection using machine learning," SN Comput. Sci., vol. 5, no. 1, Art. no. 93 (2024), doi: 10.1007/s42979-023-02404-w.
[6] H. Yan, J. Zhang, Z. Tang, H. Long, M. Zhu, T. Zhang, L. Luo, and H. Li, "Malware classification method based on feature fusion," Int. J. Inf. Security, vol. 24, no. 2, Art. no. 97 (2025), doi: 10.1007/s10207-025- 01013-3.
[7] N. Almakayeel, “Deep learning-based improved transformer model on Android malware detection and classification in Internet of Vehicles,” Sci. Rep., vol. 14, no. 1, Art. no. 25175 (2024), doi: 10.1038/s41598-024-74017-z.
[8] A. Chhaybi and S. Lazaar, “A novel wavelet-based model for Android malware detection utilizing system calls features,” J. Netw. Syst. Manag., vol. 33, no. 3, Art. no. 58 (2025), doi: 10.1007/s10922-025-09939-8.
[9] Z. Li, Y. Liu, C. Zhang, W. Shan, H. Zhang, and X. Zhu, “Trustworthy deep learning for encrypted traffic classification,” Soft Comput., vol. 29, no. 2, pp. 645–662 (2025), doi: 10.1007/s00500-025-10462-w.
[10] B. Yuan, H. Sun, Y. Guo, Q. Liu, and X. Zhan, “Explainable analysis of infrared and visible light image fusion based on deep learning,” Sci. Rep., vol. 15, no. 1, Art. no. 2223 (2025), doi: 10.1038/s41598-024-79684-6.
[11] S. A. R. Sathyabama and J. Katiravan, “Enhancing anomaly detection and prevention in Internet of Things (IoT) using deep neural networks and blockchain based cyber security,” Sci. Rep., vol. 15, no. 1, Art. no. 22369 (2025), doi: 10.1038/s41598-025-04164-4.
[12] D. Vaya and R. K. Saxena, “Security attack classification and performance analysis of machine learning algorithms over CSIC HTTP dataset,” J. Discrete Math. Sci. Cryptogr., vol. 28, no. 5-A, pp. 1569–1578 (2025), doi: 10.47974/JDMSC-2155.
[13] D. Moud and R. K. Saxena, “Development of signature recognition system using VGG16,” J. Discrete Math. Sci. Cryptogr., vol. 26, no. 3, pp. 807–813 (2023), doi: 10.47974/JDMSC-1756.
[14] D. Moud and R. K. Saxena, “Development of novel signature architecture for signature recognition,” J. Discrete Math. Sci. Cryptogr., vol. 28, no. 5-A, pp. 1763–1769 (2025).
