Papers › Orthrus: A Bimodal Learning Architecture for Malware Classification
Orthrus: A Bimodal Learning Architecture for Malware Classification
Daniel Gibert, Carles Mateu, Jordi Planes
Malware detection and classification is a challenging problem and an active area of research. Traditional machine learning methods depend almost entirely on the ability to extract a set of discriminative features into which characterize malware. However, this feature engineering process is very time consuming. On the contrary, deep learning methods replace manual feature engineering by a system that performs both feature extraction and classification from raw data at once. Despite that, a major shortfall of these methods is their inhability to consider multiple disparate sources of information when performing classification, leading them to perform poorly when compared to multimodal approaches. In this work, we introduce Orthrus, a new bimodal approach to categorize malware into families based on deep learning. Orthrus combines two modalities of data: (1) the byte sequence representing the malware’s binary content, and (2) the assembly language instructions extracted from the assembly language source code of malware, and performs automatic feature learning and classification with a convolutional neural network. The idea is to benefit from multiple feature types to reflect malware’s characteristics. The experiments carried on the Microsoft Malware Classification Challenge dataset show that our proposed solution achieves higher classification performance than deep learning approaches in the literature and n-gram based methods.
Code
Repository list and official/mentioned flags are the archive's, frozen 2025-07-28. Reachability, where shown, is from one Syntology probe window (2026-09-16 to 2026-09-18); repositories not probed show nothing. GitHub stars are not tracked.
Code Syntology ran Syntology
Not run by Syntology. Nothing on this page verifies that the listed code works.
Tasks
Results from the paper archive 2025-07-28
| Task | Dataset | Model | Metric | Value | Rank at snapshot | Leaderboard | Report |
|---|---|---|---|---|---|---|---|
| Malware Classification | Microsoft Malware Classification Challenge | Orthrus | Accuracy (10-fold) | 0.9924 | #4 of 29 | Archive leaderboard | report |
| Malware Classification | Microsoft Malware Classification Challenge | Orthrus | Macro F1 (10-fold) | 0.9872 | #4 of 29 | Archive leaderboard | report |
| Malware Classification | Microsoft Malware Classification Challenge | Grayscale images + Opcode N-grams (Feature selection for malware classification) | Accuracy (10-fold) | 0.9770 | #14 of 29 | Archive leaderboard | report |
| Malware Classification | Microsoft Malware Classification Challenge | Deep Transferred Generative Adversarial Networks | Accuracy (10-fold) | 0.9639 | #20 of 29 | Archive leaderboard | report |
Ranks are positions in the archive's leaderboards as they stood at the 2025-07-28 snapshot. Results published since then are not among these rows, so a rank here is not a current standing.
Report a problem or propose a change · a person checks every report against the paper or source before anything changes; decisions are listed on /corrections