This paper proposes an Android-oriented zero-day malware detection method named ”Android Zero-Day Guard.” By integrating deep neural networks with zero-shot learning, this approach is capable of identifying emerging threats without prior exposure to malicious samples. The method converts APK files into images and extracts deep features, enabling effective capture of behavioral malware patterns. Experimental results demonstrate that the proposed method achieves a precision of 94.93%, a recall of 93.75%, and an F1-score of 94.28% across multiple malware families. Without relying on dynamic analysis, it exhibits strong detection capability and generalization performance, making it well-suited for the early identification of emerging threats. While the model performs strongly on benchmark datasets, continuous validation on the latest families is essential for deployment in a rapidly evolving threat landscape.

With the continuous upgrading and development of malware attack methods, traditional detection methods have shown a series of serious problems such as low classification accuracy, easy overfitting, and high false alarm rate when facing new malware attacks. To address these challenges, this study introduces an innovative deep convolutional neural network (D-CNN) method that cleverly integrates permission features and API call graphs. Learn high-level abstract representation through DNN and combine it with CNN to build multiscale feature representation, aiming to improve the performance of the detection model and enhance the resistance to new malicious attacks. In order to ensure the standardization and representativeness of the data, the Min–Max method is first used to normalize the permission characteristics to ensure the standardization of the data. Second, the ant colony optimization method is used to achieve dimensionality reduction and prevent over-fitting. This article conducts experiments on Drebin and Google Play Store datasets. The results prove that the hybrid structure of D-CNN exhibits a deeper understanding of the data structure and achieves an accuracy of 96.80%, enabling more comprehensive and accurate malware detection and classification. It outperforms single deep learning methods in detection performance.

In recent years, the Internet of Things (IoT) has penetrated all aspects of our lives through smart cities, health, industries and others that are related to people's livelihood. With the increasing number of IoT devices, more and more personal information is exposed in the network space, which inevitably brings some network security problems. Due to the diversity and heterogeneity of IoT devices, identification of such devices in the complex IoT environments remains a major challenge. Existing deep learning-based device identification methods achieve identification of IoT devices by automatically extracting device traffic features, but usually only single modal features of device traffic are considered, which cannot achieve all-around characterization features of communication traffic and affect the identification results. Therefore, we propose an identification method, termed DMRMTT, that employs a Deep convolutional maxout network and MTT model (Multiple Time-series Transformers) to automatically extract the spatial and temporal features of IoT communication session fingerprints and perform further fusion using the structure of the residual, which makes up for the limitations of the existing methods for studying device traffic. This method can improve the characterization of device traffic behaviour and achieve a more accurate identification of IoT devices. Its efficacy is experimentally validated by using two publicly availbale datasets and compared with existing methods. Results show that our method outperforms other methods in widely used performance metrics and achieves 99.82% identification accuracy, demonstrating its superiority and usefulness in IoT device identification.