[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-122278-en":3,"doc-seo-122278-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},122278,1099514067415,"Rowan","https://ap-avatar.wpscdn.com/avatar/100002539d78ffe74a7?x-image-process=image/resize,m_fixed,w_180,h_180&k=1779092875211072502",8,"Research & Report","Multimodal Deep Learning for Android Malware Classification","This study investigates the integration of diverse data modalities within deep learning ensembles for Android malware classification. Android applications can be represented as binary images and function call graphs, each offering complementary perspectives on the executable. The work synthesizes modalities by combining predictions from convolutional and graph neural networks via a multilayer perceptron. Experimental results show multimodal models outperform unimodal baselines while maintaining high efficiency, with the best setup reaching 90.6% accuracy.","Article  \nMultimodal Deep Learning for Android Malware Classification James Arrowsmith *, Teo Susnjak , Julian Jang-Jaccard   \nAcademic Editor: Francesco Buccafurri  \nReceived: 19 January 2025  \nRevised: 10 February 2025  \nAccepted: 24 February 2025  \nPublished: 28 February 2025  \nCitation: Arrowsmith, J.;  \nSusnjak, T.; Jang-Jaccard, J. Multimodal Deep Learning for Android Malware Classification. Mach. Learn. Knowl. Extr. 2025, 7, 23 . [https://doi.org/10.3390/](https://doi.org/10.3390/)[ ](https://doi.org/10.3390/)make7010023  \nCopyright: © 2025 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license ([https://creativecommons.org/](https://creativecommons.org/)[ ](https://creativecommons.org/)[licenses/by/4.0/](licenses/by/4.0/)) .  \nSchool of Mathematical and Computational Sciences, Massey University, Auckland 0632, New Zealand;  \n[t.susnjak@massey.ac.nz](t.susnjak@massey.ac.nz) (T.S.); [julian.jang-jaccard@ar.admin.ch](julian.jang-jaccard@ar.admin.ch) (J.J.-J.)  \n* [Corresponding author: james.arrowsmith.1@uni.massey.ac.nz](Corresponding author: james.arrowsmith.1@uni.massey.ac.nz)  \nAbstract: This study investigates the integration of diverse data modalities within deep learning ensembles for Android malware classification. Android applications can be represented as binary images and function call graphs, each offering complementary perspectives on the executable. We synthesise these modalities by combining predictions from convolutional and graph neural networks with a multilayer perceptron. Empirical results demonstrate that multimodal models outperform their unimodal counterparts while remaining highly efficient. For instance, integrating a plain CNN with 83.1% accuracy anda GCN with 80.6% accuracy boosts overall accuracy to 88.3% . DenseNet-GIN achieves 90.6% accuracy, with no further improvement obtained by expanding this ensemble to four models. Based on our findings, we advocate for the flexible development of modalities to capture distinct aspects of applications and for the design of algorithms that effectively integrate this information.  \nKeywords: multimodal deep learning for Android malware detection; enhanced malware analysis; graph neural networks; function call graphs (FCG); efficient multimodal late fusion; CNN GNN Ensemble; bytecode image analysis; Android APK analysis; data fusion  \n1. Introduction  \nMultimodal machine learning integrates diverse data sources, or modalities, to deliver richer representations and more robust predictive capabilities [1,2] . In malware detection, research often focuses on a single modality, such as byte-level signatures or high-level control flow structures. Yet, malicious software can manifest in complex ways that demand broader perspectives. Integrating complementary modalities—specifically, binary images encoding Dalvik Executable (DEX) bytecode and function call graphs (FCGs)—can thus offer a more comprehensive characterisation of malicious behaviours.  \nMalware detection and classification remain pivotal challenges given the rapid proliferation of harmful Android applications. Three-quarters of the global market share is dominated by Android (as of December 2024), making it a highly attractive target for cyberattacks [3–5] . Since traditional unimodal detection methods risk overlooking critical patterns, particularly when apps employ encryption or obfuscation tactics [6,7], harnessing multimodal data fusion increases the probability of detection by capturing more informative features from both byte-level images and structural call graphs [8,9] .  \nSeveral fusion strategies have been explored in multimodal learning, which are commonly classified into early, intermediate, and late fusion [2] . Early approaches concatenate modalities at the input level, intermediate approaches fuse extracted features in a shared layer, while late fusion integra","cbCaiur6S5Hl0V8D","https://ap.wps.com/l/cbCaiur6S5Hl0V8D","pdf",2686131,1,29,"English","en",105,"# Introduction\n## Multimodal machine learning for malware detection\n## Fusion strategies: early, intermediate, late\n## Study gap and proposed late-fusion method\n# Contributions","[{\"question\":\"What data modalities are integrated for Android malware classification?\",\"answer\":\"The method combines binary images derived from DEX bytecode with function call graphs (FCGs) that capture executable control-flow structure.\"},{\"question\":\"How does the proposed model fuse modalities?\",\"answer\":\"Predictions from CNNs and GNNs are concatenated and fed into a multilayer perceptron (MLP) meta-classifier, implementing a late fusion strategy.\"},{\"question\":\"Which fusion approach performs best in the study?\",\"answer\":\"Late fusion is identified as superior to intermediate fusion strategies for detection and classification, improving key performance metrics.\"}]","Multimodal Deep Learning for Android Malware Classification | PDF",1785809783,73,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"multimodal-deep-learning-for-android-malware-classification","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/multimodal-deep-learning-for-android-malware-classification/122278/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-04",true,{"@type":65,"interactionType":66,"userInteractionCount":4},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What data modalities are integrated for Android malware classification?","Question",{"text":75,"@type":76},"The method combines binary images derived from DEX bytecode with function call graphs (FCGs) that capture executable control-flow structure.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does the proposed model fuse modalities?",{"text":80,"@type":76},"Predictions from CNNs and GNNs are concatenated and fed into a multilayer perceptron (MLP) meta-classifier, implementing a late fusion strategy.",{"name":82,"@type":73,"acceptedAnswer":83},"Which fusion approach performs best in the study?",{"text":84,"@type":76},"Late fusion is identified as superior to intermediate fusion strategies for detection and classification, improving key performance metrics.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]