همایش بین المللی هوش مصنوعی

صفحه اصلی / دومین همایش بین المللی هوش مصنوعی

Vision-based Static Detection of Windows Malware with Rule-Augmented Feature Maps

نویسندگان :

Mahdi Seyfipoor¹ Mohammad Mahdi Eskandari² Siamak Mohammadi³

1- دانشگاه تهران 2- دانشگاه تهران 3- دانشگاه تهران

کلمات کلیدی :

Windows Malware Detection،Static Analysis،Vision Transformer (ViT)،Rule-Augmented Feature Maps

چکیده :

Static malware detection has become a major challenge in recent years due to the increasing use of obfuscation, packaging, and multi-stage shellcode-based payloads in modern Windows threats. In this paper, we introduce a vision-based rule-augmented multi-channel framework that transforms Portable Executable (PE) files into visual feature maps composed of byte images, entropy gradients, opcode-density predictions, and a rule channel encoding high-level malicious indicators such as shellcode regions, hand-mapping patterns, and syscall-like instruction sequences. A Vision Transformer (ViT) backbone processes these merged representations to learn global structural relationships that traditional opcode-based or feature-engineered static approaches fail to capture. Experiments were conducted on the Malimg dataset, MalwareBazaar, and a verified set of 3000 benign Windows executables. The proposed framework achieved 97.4% accuracy on Malimg and 95.1% accuracy on MalwareBazaar, yielding an overall average accuracy of 96.6% across both datasets. The corresponding F1-scores were 97.3% and 95.2% respectively, reflecting strong resilience against compressed binaries, modified UPX artifacts, and encrypted multi-stage shellcode payloads. Further experiments show that the method successfully detects samples that evade commercial engines such as Kaspersky, CrowdStrike, and ESET.