Malware detection and classification are crucial for protecting digital devices and information systems. Accurate identification of malware enables researchers and incident responders to take prompt measures against malware and mitigate its damage. With the development of attention mechanisms in the field of computer vision, attention mechanism-based malware detection techniques are also rapidly evolving. The essence of the attention mechanism is to focus on the information of interest and suppress the useless information. In this paper, we develop different plug-and-play attention mechanisms based on the ResNeXt tagging model, where the designed model is trained to focus on the malware features by capturing the malware image channel perception field of view and is also able to provide more helpful and flexible information than other methods. We have named this designed neural network ResNeXt+, and its core modules are built with different plug-and-play attention mechanisms. Extensive experimental results show that ResNeXt+ is effective and efficient in malware detection and classification with high classification accuracy. The proposed methods outperform the state-of-the-art techniques with seven benchmark datasets. Cross-dataset experiments conducted on the Windows and Android datasets, with an accuracy of 90.64% on cross-dataset detection of the android. Ablation experiments are also conducted on seven datasets, which demonstrate that attention mechanisms can improve malware detection and classification accuracy.

With the rapid development of automation tools including polymorphic and metamorphic engines, generic packers, and genetic programming, many variants of malware have emerged, which pose a significant threat to the Internet security. To effectively detect malware variants, researchers have developed visualization-based approaches that can visualize malware adaptations for in-depth malware analysis. However, most existing visualization approaches rely on the binary image of a malware sample, which fail to provide an effective texture feature representation and thus often result in low efficiency in coping with challenging malware samples. In this paper, we proposeSpecView, a malware spectrum visualization framework with singular spectrum transformation. SpecView converts malware binary code into one-dimensional time series spectrum data, and leverages the singular spectrum transformation method to obtain the structural changes preserved in the time series spectrum data. Then, we utilize the particle swarm optimization algorithm to optimize the singular spectrum transformation performance in SpecView. We apply SpecView in the task of malware classification. Extensive experimental results show that SpecView is effective and efficient in malware classification on the Malimg, Malheur, Drebin, and PRAGuard Malgenome Class Encryption datasets, with classification accuracy exceeding 99%, and it can effectively identify malware variants that use evasive techniques such as packer and encryption obfuscation. The proposed method outperforms the state-of-the-art methods on all datasets and the classification accuracy reaches 100% for 5 malware families packed by the UPX packer on the Malimg dataset, as well as 9 malware families that use Class Encryption obfuscation techniques on the PRAGuard Malgenome Class Encryption datasets.