Behavioral Heatmap-Driven Vision Transformer Framework for Malware Classification

Abstract

The process of detecting and classifying malware has remained an ongoing challenge in cybersecurity since its incep-tion. Adversaries use dynamic code transformation techniques and malicious code concealment methods to defeat standard security measures. Signature-based systems display operational maturity yet function as reactive systems because their per-formance depends on previously obtained data. This paper presents a malware classification framework combining sandbox dynamic testing and behavioral heatmap visualization with a Vision Transformer (ViT) model. We tested malware samples in a secure Windows environment which allowed them to monitor malware operations and track its API interactions and system changes and network activity. The system creates RGB heatmap images which represent interaction logs through spatial patterns that display how activities occurred over time. A pretrained ViT model uses input images to process information through its self-attention system which analyzes the complete image structure to identify all things that connect across distinct areas of space. We tested their method on 22,056 samples which included eight different family groups. The system achieves 98.66% accuracy through its ability to obtain flawless results in two of the eight categories while reaching F1 scores above 0.93 in all categories.