Wavelet-Based and MAML-Driven Framework for Enhanced Few-Shot Malware Classification
Source abstract
Abstract
Traditional malware classification approaches primarily address fixed sets of well-studied malware types and therefore struggle to accommodate the continual emergence of novel or previously unseen malware strains. While visualization-based strategies have shown promise in few-shot malware classification, existing methods often produce representations with limited semantic richness. In parallel, few-shot learning models frequently converge with suboptimal solutions, limiting their ability to generalize effectively to new classes. To address these challenges, we propose MetaWave, a unified framework that jointly optimizes both data representation and model learning for few-shot malware classification. Rather than treating feature representation and learning strategy as largely independent stages, MetaWave is formulated as an explicit representation–adaptation integration framework that combines multi-view malware encoding with meta-learning-based optimization. At the data level, we propose a Wavelet Transform-based Malware Representation method that leverages multi-scale frequency analysis and complementary views to generate semantically enriched representations. At the model level, we adopt Model-Agnostic Meta-Learning (MAML) to optimize model initialization for rapid adaptation to unseen tasks under limited data conditions. Extensive experiments are conducted on two benchmark datasets, EMBER and Malicia, under a 5-way 5-shot protocol with disjoint class splits to ensure evaluation on previously unseen malware families. The proposed framework achieves superior performance, reaching 97.8% accuracy on EMBER and 96.2% on Malicia, consistently outperforming state-of-the-art methods. These results indicate that jointly enhancing representation quality and model adaptability can improve classification accuracy and unseen-family performance under the evaluated 5-way 5-shot protocol. Overall, MetaWave provides an effective framework for few-shot malware classification and offers a promising basis for detecting emerging malware under limited-data conditions, while robustness to adversarial perturbation, obfuscation, and polymorphism remains to be validated through dedicated future evaluation.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Adversarial Robustness in Machine Learning · Anomaly Detection Techniques and Applications
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Information Science, College of Humanities and Social Sciences, King Saud University, Riyadh P.O. Box 11451, Saudi Arabia
Department of Computer Science and Engineering, College of Applied Studies, King Saud University, Riyadh P.O. Box 11451, Saudi Arabia
Department of Information Science, College Art, Imam Abdulrahman Bin Faisal University, Dammam P.O. Box 2435, Saudi Arabia
Funding
King Saud University
References (78)
Show source-provided references
1. Mutambik, I. (2025). A Hybrid CNN–BiLSTM Framework Optimized with Bayesian Search for Robust Android Malware Detection. Systems, 13.10.3390/systems13070612 ↗
2. Bio-Inspired Algorithms for Cybersecurity—A Review of the State-of-the-Art and Challenges10.1504/IJBIC.2024.136199 ↗
3. IMCMK-CNN: A Lightweight Convolutional Neural Network with Multi-Scale Kernels for Image-Based Malware Classification10.1016/j.aej.2024.10.055 ↗
4. Hybrid Feature Extraction and Integrated Deep Learning for Cloud-Based Malware Detection10.1016/j.cose.2024.104233 ↗
5. Ransomware: Recent Advances, Analysis, Challenges and Future Research Directions10.1016/j.cose.2021.102490 ↗
6. Aslan, Ö., Aktuğ, S.S., Ozkan-Okay, M., Yilmaz, A.A., and Akin, E. (2023). A Comprehensive Review of Cyber Security Vulnerabilities, Threats, Attacks, and Solutions. Electronics, 12.10.3390/electronics12061333 ↗
7. Dong, M., Liu, L., Guo, Q., Bai, H., Gong, R., Bai, Y., He, W., Wang, Z., Xu, G., and Zhang, J. (2025). LeoDroid: An LLM-Based Few-Shot Multi-Label Detection for Android Malware. 2025 IEEE Security and Privacy Workshops (SPW), IEEE.10.1109/SPW67851.2025.00042 ↗
8. MalFSLDF: A Few-Shot Learning-Based Malware Family Detection Framework10.1155/int/7390905 ↗
9. Enhancing Malware Detection and Classification in Network Traffic Using Deep Learning Techniques10.1111/1556-4029.70189 ↗
10. Mutambik, I. (2025). AI-Driven Cybersecurity in IoT: Adaptive Malware Detection and Lightweight Encryption via TRIM-SEC Framework. Sensors, 25.10.3390/s25227072 ↗
11. Cyber Attacks via Consumer Electronics: Studying the Threat of Covert Malware in Smart and Autonomous Vehicles10.1109/TCE.2023.3297965 ↗
12. Two Stage Malware Detection Model in Internet of Vehicles (IoV) Using Deep Learning-Based Explainable Artificial Intelligence with Optimization Algorithms10.1038/s41598-025-00269-y ↗
13. Mutambik, I. (2024). An Entropy-Based Clustering Algorithm for Real-Time High-Dimensional IoT Data Streams. Sensors, 24.10.3390/s24227412 ↗
14. A Comprehensive Survey on Deep Learning Based Malware Detection Techniques10.1016/j.cosrev.2022.100529 ↗
15. Taşcı, B. (2024). Deep-Learning-Based Approach for IoT Attack and Malware Detection. Appl. Sci., 14.10.3390/app14188505 ↗
16. Byte-Level Malware Classification Based on Markov Images and Deep Learning10.1016/j.cose.2020.101740 ↗
17. Windows and IoT Malware Visualization and Classification with Deep CNN and Xception CNN Using Markov Images10.1007/s10844-022-00734-4 ↗
18. IMCFN: Image-Based Malware Classification Using Fine-Tuned Convolutional Neural Network Architecture10.1016/j.comnet.2020.107138 ↗
19. A Learning Model to Detect Maliciousness of Portable Executable Using Integrated Feature Set10.1016/j.jksuci.2017.01.003 ↗
20. On the Effectiveness of Image Processing Based Malware Detection Techniques10.1080/01969722.2021.2020471 ↗
21. Mutambik, I. (2024). An Efficient Flow-Based Anomaly Detection System for Enhanced Security in IoT Networks. Sensors, 24.10.3390/s24227408 ↗
22. Using Entropy Analysis to Find Encrypted and Packed Malware10.1109/MSP.2007.48 ↗
23. Gibert, D., Mateu, C., Planes, J., and Vicens, R. (2018). Classification of Malware by Using Structural Entropy on Convolutional Neural Networks. Proceedings of the AAAI Conference on Artificial Intelligence, AAAI Press.10.1609/aaai.v32i1.11409 ↗
24. Kim, G., Yoon, D., Kwak, N., and Lee, B. (2026). Representation-Centric Approach for Android Malware Classification: Interpretability-Driven Feature Engineering on Function Call Graphs. Appl. Sci., 16.10.3390/app16062670 ↗
25. Mutambik, I. (2024). Enhancing IoT Security Using GA-HDLAD: A Hybrid Deep Learning Approach for Anomaly Detection. Appl. Sci., 14.10.3390/app14219848 ↗
26. Malware Analysis Using Visualized Images and Entropy Graphs10.1007/s10207-014-0242-0 ↗
27. MalFCS: An Effective Malware Classification Framework with Automated Feature Extraction Based on Deep Convolutional Neural Networks10.1016/j.jpdc.2020.03.012 ↗
28. SPAM: Signal Processing to Analyze Malware [Applications Corner]10.1109/MSP.2015.2507185 ↗
29. Nataraj, L., Mohammed, T.M., Nanjundaswamy, T., Chikkagoudar, S., Chandrasekaran, S., and Manjunath, B.S. (2021). OMD: Orthogonal Malware Detection Using Audio, Image, and Static Features. MILCOM 2021—2021 IEEE Military Communications Conference (MILCOM), IEEE.10.1109/MILCOM52596.2021.9653136 ↗
30. From Data and Model Levels: Improve the Performance of Few-Shot Malware Classification10.1109/TNSM.2022.3200866 ↗
31. PyraMal: Byte-Level Malware Detection and Classification via Pyramid Feature Map10.1109/TIFS.2026.3658992 ↗
32. Alshomrani, M., Albeshri, A., Alsulami, A.A., and Alturki, B. (2025). An Explainable Hybrid CNN–Transformer Architecture for Visual Malware Classification. Sensors, 25.10.3390/s25154581 ↗
33. Chelsea, F., Pieter, A., and Sergey, L. (2017). Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networks. Proceedings of the 34th International Conference on Machine Learning, PMLR.
34. El Youssofi, C., and Chougdali, K. (2025). YoloMal-XAI: Interpretable Android Malware Classification Using RGB Images and YOLO11. J. Cybersecur. Priv., 5.10.3390/jcp5030052 ↗
35. Meta-Learning Approaches for Learning-to-Learn in Deep Learning: A Survey10.1016/j.neucom.2022.04.078 ↗
36. Cross-Attention Feature Fusion for Interpretable Zero-Day Malware Detection10.19139/soic-2310-5070-2900 ↗
37. MalCAFF: A Cross Attention-Based Feature Fusion Framework for Malware Classification10.1109/TNSE.2025.3627147 ↗
38. Recent Advances of Few-Shot Learning Methods and Applications10.1007/s11431-022-2133-1 ↗
39. A Transformer-Based Few-Shot Learning Pipeline for Barley Disease Detection from Field-Collected Imagery10.1016/j.compag.2024.109751 ↗
40. Few-Shot Class-Incremental Learning for Classification and Object Detection: A Survey10.1109/TPAMI.2025.3529038 ↗
41. Awan, M.J., Masood, O.A., Mohammed, M.A., Yasin, A., Zain, A.M., Damaševičius, R., and Abdulkareem, K.H. (2021). Image-Based Malware Classification Using VGG19 Network and Spatial Convolutional Attention. Electronics, 10.10.3390/electronics10192444 ↗
42. Singh, J., and Singh, J. (2021). Malware Classification Using Multi-Layer Perceptron Model, Springer.10.1007/978-981-15-5148-2_14 ↗
43. Tran, K., Sato, H., and Kubo, M. (2020). MANNWARE: A Malware Classification Approach with a Few Samples Using a Memory Augmented Neural Network. Information, 11.10.3390/info11010051 ↗
44. Alavizadeh, H., Alavizadeh, H., and Jang-Jaccard, J. (2022). Deep Q-Learning Based Reinforcement Learning Approach for Network Intrusion Detection. Computers, 11.10.3390/computers11030041 ↗
45. A Few-Shot Malware Classification Approach for Unknown Family Recognition Using Malware Feature Visualization10.1016/j.cose.2022.102887 ↗
46. A Systematic Literature Review on Windows Malware Detection: Techniques, Research Issues, and Future Directions10.1016/j.jss.2023.111921 ↗
47. The Rise of Machine Learning for Detection and Classification of Malware: Research Developments, Trends and Challenges10.1016/j.jnca.2019.102526 ↗
48. Rahman, S.S.M.M., Biplob, K.B.M.B., Rahman, M.H., Sarker, K., and Islam, T. (2020). An Investigation and Evaluation of N-Gram, TF-IDF and Ensemble Methods in Sentiment Classification, Springer.10.1007/978-3-030-52856-0_31 ↗
49. and Sharma, P. (2022). Windows Malware Detection Using Machine Learning and TF-IDF Enriched API Calls Information. 2022 Second International Conference on Computer Science, Engineering and Applications (ICCSEA), IEEE.
50. Zhang, Z. (2018). Improved Adam Optimizer for Deep Neural Networks. 2018 IEEE/ACM 26th International Symposium on Quality of Service (IWQoS), IEEE.10.1109/IWQoS.2018.8624183 ↗
51. Shinde, O., Khobragade, A., and Agrawal, P. (2023). Static Malware Detection of Ember Windows-PE API Call Using Machine Learning, AIP Publishing.10.1063/5.0130256 ↗
52. Oyama, Y., Miyashita, T., and Kokubo, H. (2019). Identifying Useful Features for Malware Detection in the Ember Dataset. 2019 Seventh International Symposium on Computing and Networking Workshops (CANDARW), IEEE.10.1109/CANDARW.2019.00069 ↗
53. Sebastián, M., Rivera, R., Kotzias, P., and Caballero, J. (2016). AVclass: A Tool for Massive Malware Labeling, Springer.10.1007/978-3-319-45719-2_11 ↗
54. Deep Learning Applied to Imbalanced Malware Datasets Classification10.5753/jisa.2024.3907 ↗
55. Discrete Markov Image Modeling and Inference on the Quadtree10.1109/83.826777 ↗
56. El Rhayati, O., Essadeq, H., El Beqqali, O., Tairi, H., Lamrini, M., and Riffi, J. (2025). Structured Heatmap Learning for Multi-Family Malware Classification: A Deep and Explainable Approach Using CAPEv2. J. Cybersecur. Priv., 5.10.3390/jcp5030072 ↗
57. Image Classification by a Two-Dimensional Hidden Markov Model10.1109/78.823977 ↗
58. Liaqat, A., Shahid, U., Shah, I., Kaleem, A., and Riaz, A. (2025). Deep Learning-Based Malware Detection Using Independent Stream Analysis of RGB and Grayscale Images. 2025 International Conference on Artificial Intelligence, Computer, Data Sciences and Applications (ACDSA), IEEE.10.1109/ACDSA65407.2025.11166223 ↗
59. Eroğlu Demirkan, E., and Aydos, M. (2025). Enhancing Malware Detection via RGB Assembly Visualization and Hybrid Deep Learning Models. Appl. Sci., 15.10.3390/app15137163 ↗
60. He, K., Lu, H., and Gu, D. (2025). MultiMal: Multimodal Fusion Combining Graph and Entropy Features for Malware Detection. 2025 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER), IEEE.10.1109/SANER64311.2025.00093 ↗
61. Nandini, Y., and Murali, G. (2026). A Hybrid Quantum–Deep Learning Architecture with Entropy-Driven Features for Secure IoT Malware Detection. 2026 International Conference on Electronics and Renewable Systems (ICEARS), IEEE.10.1109/ICEARS67481.2026.11416756 ↗
62. Intelligent and Behavioral-Based Detection of Malware in IoT Spectrum Sensors10.1007/s10207-022-00602-w ↗
63. Dhingra, M., Jain, A., Thakur, N., Choubey, A., Donelli, M., Dubey, A.K., and Panwar, A. (2026). Image-Based Malware Classification Using DCGAN-Augmented Data and a CNN–Transformer Hybrid Model. Future Internet, 18.10.3390/fi18020102 ↗
64. A Network Security Situation Prediction for Consumer Data in the Internet of Things Using Variational Mode Decomposition (VMD) and Fused CNN-BiLSTM-Attention10.1109/TCE.2023.3323546 ↗
65. Multi-View Few-Shot Malware Classification With Support-Query Prototypes10.1109/TDSC.2025.3627810 ↗
66. Zheng, C., Lu, C., Li, C., Zheng, Z., and Pan, L. (2025). CyberDualNER: A Dual-Stage Approach for Few-Shot Named Entity Recognition in Cybersecurity. Electronics, 14.10.3390/electronics14091791 ↗
67. Chen, M.-Y., Ban, T., Cheng, S.-M., and Takahashi, T. (2025). TOM-Net: Few-Shot IoT Malware Classification Via Open-Set Aware Transductive Meta-Learning. 2025 22nd Annual International Conference on Privacy, Security, and Trust (PST), IEEE.10.1109/PST65910.2025.11268864 ↗
68. Wang, J., Lin, T., Wu, H., and Wang, P. (2024). AGProto: Adaptive Graph ProtoNet towards Sample Adaption for Few-Shot Malware Classification. Electronics, 13.10.3390/electronics13050935 ↗
69. Zheng, W., Gou, C., Yan, L., and Mo, S. (2020). Learning to Classify: A Flow-Based Relation Network for Encrypted Traffic Classification. Proceedings of The Web Conference 2020, ACM.10.1145/3366423.3380090 ↗
70. Androfim: Few-Shot Android Malware Family Detection Based on Image Representation10.1186/s42400-025-00358-5 ↗
71. Zhao, L., Zhang, Y., and Hou, R. (2026). FuzzyHawk: Unveiling Ransomware Behavior Patterns via Graph-Based Fuzzy Matching, Springer.10.1007/978-981-95-6209-1_20 ↗
72. Meta-Learning in Neural Networks: A Survey
73. Catch Me If You Can: Evaluating Android Anti-Malware Against Transformation Attacks10.1109/TIFS.2013.2290431 ↗
74. Bi, Z., Singha, A., Xue, H., Li, T., Chen, Y., and Zhang, Y. (2025). Physical Backdoor Attacks against MmWave-Based Human Activity Recognition. 2025 IEEE 45th International Conference on Distributed Computing Systems (ICDCS), IEEE.10.1109/ICDCS63083.2025.00079 ↗
75. Huang, H., Xie, Y., Gao, J., Fan, C., and Cao, Z. (2025). Select and Order: Optimizing Few-Shot Image Classification with In-Context Learning, Springer.10.1007/978-981-96-2064-7_31 ↗
76. Jain, S., Gupta, S., Pundir, A., Singh, S., and Saxena, G.J. (2025). FS-ProtoNet: Enterprise Network Security Using Few-Shot Learning with Prototypical Networks. 2025 IEEE International Conference on Recent Advances in Computing and Systems (REACS), IEEE.10.1109/REACS67479.2025.11413551 ↗
77. SSL-ProtoNet: Self-Supervised Learning Prototypical Networks for Few-Shot Learning10.1016/j.eswa.2023.122173 ↗
78. Mutambik, I., and Almuqrin, A. (2025). Balancing Efficiency and Efficacy: A Contextual Bandit-Driven Framework for Multi-Tier Cyber Threat Detection. Appl. Sci., 15.10.3390/app15116362 ↗