As software becomes widespread, malware poses a significant threat to information system security. Graph neural networks (GNNs) used in existing machine learning-based methods for malware detection ignore deeper semantic information in code graphs. These methods also lack feature extraction of global data information, resulting in incomplete feature for detection. To address these limitations, we propose a multi-modal fusion architecture, MultiMal, that combines function call graphs, control flow graphs, and entropy features to detect Portable Executable (PE) malware. MultiMal proposes a multi-head softmax module to effectively capture graph features in multiple representation spaces. It also constructs an entropy-based learning module to extract binary features related to data randomness and obfuscation, which are then fused with the graph encoding to better detect malware code pattern. For accurate evaluation, we also introduce a new PE malware dataset with evenly distributed samples over the years and detailed family and category labels. Experiments demonstrate that MultiMal outperforms three existing baselines in terms of effectiveness. At an FPR threshold of 0.1 %, the TPR and bACC exceed the best results of the baselines by 11.83 % and 5.54 %, respectively.

Binary Code Similarity Detection (BCSD) is significant for software security as it can address binary tasks such as malicious code snippets identification and binary patch analysis by comparing code patterns. Recently, there has been a growing focus on artificial intelligence-based approaches in BCSD due to their scalability and generalization. Because binaries are compiled with different compilation configurations, existing approaches still face notable limitations when comparing binary similarity. First, BCSD requires analysis on code behavior, and existing work claims to extract semantic, but actually still makes analysis in terms of syntax. Second, directly extracting features from assembly sequences, existing work cannot address the issues of instruction reordering and different syntax expressions caused by various compilation configurations. In this paper, we propose STRTUNE, which slices binary code based on data dependence and perform slice-level fine-tuning. To address the first limitation, STRTUNE performs backward slicing based on data dependence to capture how a value is computed along the execution. Each slice reflects the collecting semantics of the code, which is stable across different compilation configurations. STRTUNE introduces flow types to emphasize the independence of computations between slices, forming a graph representation. To overcome the second limitation, based on slices corresponding to the same value computation but having different syntax representation, STRTUNE utilizes a Siamese Network to fine-tune such pairs, making their representations closer in the feature space. This allows the cross-graph attention to focus more on the matching of similar slices based on slice contents and flow types involved. Our evaluation results demonstrate the effectiveness and practicality of STRTUNE. We show that STRTUNE outperforms the state-of-the-art methods for BCSD, achieving a Recall@1 that is 25.3% and 22.2% higher than jTrans and GMN in the task of function retrieval cross optimization in x64.