{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/orthrus-a-bimodal-learning-architecture-for","title":"Orthrus: A Bimodal Learning Architecture for Malware Classification","arxiv_id":null,"date":"2020-09-28","proceeding":null,"authors":["Daniel Gibert","Carles Mateu","Jordi Planes"],"abstract":"Malware detection and classification is a challenging problem and an active area of research. Traditional machine learning methods depend almost entirely on the ability to extract a set of discriminative features into which characterize malware. However, this feature engineering process is very time consuming. On the contrary, deep learning methods replace manual feature engineering by a system that performs both feature extraction and classification from raw data at once. Despite that, a major shortfall of these methods is their inhability to consider multiple disparate sources of information when performing classification, leading them to perform poorly when compared to multimodal approaches. In this work, we introduce Orthrus, a new bimodal approach to categorize malware into families based on deep learning. Orthrus combines two modalities of data: (1) the byte sequence representing the malware’s binary content, and (2) the assembly language instructions extracted from the assembly language source code of malware, and performs automatic feature learning and classification with a convolutional neural network. The idea is to benefit from multiple feature types to reflect malware’s characteristics. The experiments carried on the Microsoft Malware Classification Challenge dataset show that our proposed solution achieves higher classification performance than deep learning approaches in the literature and n-gram based methods.","url_abs":"https://ieeexplore.ieee.org/document/9206671","url_pdf":"https://ieeexplore.ieee.org/document/9206671","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"orthrus-a-bimodal-learning-architecture-for","repo_url":"https://github.com/danielgibert/mlw_classification_orthrus","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"tf","reach":null}],"tasks":[{"task_slug":"classification-1","task_name":"Classification"},{"task_slug":"deep-learning","task_name":"Deep Learning"},{"task_slug":"feature-engineering","task_name":"Feature Engineering"},{"task_slug":"classification","task_name":"General Classification"},{"task_slug":"malware-classification","task_name":"Malware Classification"},{"task_slug":"malware-detection","task_name":"Malware Detection"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[{"leaderboard":"/sota/malware-classification-on-microsoft-malware","task":"Malware Classification","dataset":"Microsoft Malware Classification Challenge","model":"Orthrus","rank_in_archive_order":4,"of":29,"metrics":{"Accuracy (10-fold)":"0.9924","Macro F1 (10-fold)":"0.9872"},"uses_additional_data":false},{"leaderboard":"/sota/malware-classification-on-microsoft-malware","task":"Malware Classification","dataset":"Microsoft Malware Classification Challenge","model":"Grayscale images + Opcode N-grams (Feature selection for malware classification)","rank_in_archive_order":14,"of":29,"metrics":{"Accuracy (10-fold)":"0.9770"},"uses_additional_data":false},{"leaderboard":"/sota/malware-classification-on-microsoft-malware","task":"Malware Classification","dataset":"Microsoft Malware Classification Challenge","model":"Deep Transferred Generative Adversarial Networks","rank_in_archive_order":20,"of":29,"metrics":{"Accuracy (10-fold)":"0.9639"},"uses_additional_data":false}],"syntology":{"atlas_url":null,"mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}