Retrieval-Augmented Few-Shot Malware Detection via Binary Visualization and Vision–Language Embeddings
Source abstract
Abstract
The rapid evolution of malware families poses significant challenges for cybersecurity systems, particularly when newly emerging threats lack sufficient labeled data. Although image-based deep learning approaches have achieved strong performance under fully supervised conditions, their dependence on retraining limits adaptability in dynamic environments. To address this issue, we propose a Retrieval-Augmented Few-Shot Malware Detection Framework that integrates binary-to-image visualization, multimodal embedding using a frozen Vision–Language Model (Qwen2.5-VL), and similarity-based external memory retrieval. Malware binaries are converted into grayscale images and embedded into a semantic vector space without task-specific fine-tuning. During inference, query samples retrieve similar support embeddings from a vector database, and predictions are generated through similarity-weighted aggregation, enabling adaptation without parameter updates. Evaluated on the MalImg dataset with 25 malware families under 1-shot to 10-shot settings, the framework achieves 0.886 accuracy in the 10-shot configuration. Ablation results demonstrate that combining VLM embeddings with retrieval mechanisms provides consistent improvements over individual components. These findings highlight the effectiveness of decoupling representation learning from adaptation for scalable few-shot malware detection.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Cell Image Analysis Techniques · Anomaly Detection Techniques and Applications
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Information Security, Pai Chai University, Daejeon 35345, Republic of Korea
Funding
Institute of Information & Communications Technology Planning & Evaluation
References (35)
Show source-provided references
1. A comprehensive review on malware detection approaches10.1109/ACCESS.2019.2963724 ↗
2. AV-TEST Institute (2026, February 22). Malware Statistics & Trends Report. Available online: https://www.av-test.org/en/statistics/malware/.
3. You, I., and Yim, K. (2010). Malware obfuscation techniques: A brief survey. Proceedings of the International Conference on Broadband Wireless Computing, Communication and Applications (BWCCA), Fukuoka, Japan, 4–6 November 2010, IEEE.10.1109/BWCCA.2010.85 ↗
4. A survey on automated dynamic malware-analysis techniques and tools10.1145/2089125.2089126 ↗
5. Anderson, H.S., and Roth, P. (2018). Ember: An open dataset for training static PE malware machine learning models. arXiv.
6. Nataraj, L., Karthikeyan, S., Jacob, G., and Manjunath, B.S. (2011). Malware images: Visualization and automatic classification. Proceedings of the 8th International Symposium on Visualization for Cyber Security (VizSec ’11), Pittsburgh, PA, USA, 20 July 2011, Association for Computing Machinery.10.1145/2016904.2016908 ↗
7. Saxe, J., and Berlin, K. (2015). Deep neural network based malware detection using two dimensional binary program features. Proceedings of the IEEE International Conference on Malicious and Unwanted Software (MALWARE), Fajardo, PR, USA, 20–22 October 2015, IEEE.10.1109/MALWARE.2015.7413680 ↗
8. Image-based malware classification using ensemble of CNN architectures (IMCEC)10.1016/j.cose.2020.101748 ↗
9. Snell, J., Swersky, K., and Zemel, R. (2017). Prototypical networks for few-shot learning. Advances in Neural Information Processing Systems (NeurIPS 2017), Curran Associates.
10. Finn, C., Abbeel, P., and Levine, S. (2017). Model-agnostic meta-learning for fast adaptation of deep networks. Proceedings of the 34th International Conference on Machine Learning (ICML), PMLR.
11. A few-shot malware classification approach for unknown family recognition using malware feature visualization10.1016/j.cose.2022.102887 ↗
12. Liu, C., Li, B., Zhao, J., Zhen, Z., Liu, X., and Zhang, Q. (2022). FewM-HGCL: Few-shot malware variants detection via heterogeneous graph contrastive learning. IEEE Trans. Dependable Secur. Comput., 1–18.10.1109/TDSC.2022.3216902 ↗
13. Liu, H., Li, C., Wu, Q., and Lee, Y.J. (2023). Visual instruction tuning. arXiv.
14. Bai, J., Bai, S., Yang, S., Wang, S., Tan, S., Wang, P., Lin, J., Zhou, C., and Zhou, J. (2023). Qwen-VL: A versatile vision-language model for understanding, localization, text reading, and beyond. arXiv.
15. Bai, S., Chen, K., Liu, X., Wang, J., Ge, W., Song, S., Dai, K., Wang, P., Wang, S., and Tang, J. (2025). Qwen2.5-VL technical report. arXiv.
16. Retrieval-augmented generation for knowledge-intensive NLP tasks
17. Khandelwal, U., Levy, O., Jurafsky, D., Zettlemoyer, L., and Lewis, M. (2020, January 26–30). Generalization through Memorization: Nearest Neighbor Language Models. Proceedings of the International Conference on Learning Representations (ICLR), Addis Ababa, Ethiopia.
18. Rubin, O., Herzig, J., and Berant, J. (2023). Learning to retrieve prompts for in-context learning. arXiv.10.18653/v1/2022.naacl-main.191 ↗
19. Learning transferable visual models from natural language supervision
20. Scaling up visual and vision-language representation learning with noisy text supervision
21. Align before fuse: Vision and language representation learning with momentum distillation
22. Raff, E., Barker, J., Sylvester, J., Brandon, R., Catanzaro, B., and Nicholas, C.K. (2017). Malware detection by eating a whole EXE. arXiv.
23. BHMDC: A byte and hex n-gram based malware detection and classification method10.1016/j.cose.2023.103118 ↗
24. A simple framework for contrastive learning of visual representations
25. He, K., Fan, H., Wu, Y., Xie, S., and Girshick, R. (2020). Momentum contrast for unsupervised visual representation learning. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Seattle, WA, USA, 13–19 June 2020, IEEE.10.1109/CVPR42600.2020.00975 ↗
26. Bootstrap your own latent: A new approach to self-supervised learning
27. Caron, M., Touvron, H., Misra, I., Jegou, H., Mairal, J., Bojanowski, P., and Joulin, A. (2021, January 10–17). Emerging properties in self-supervised vision transformers. Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), Montreal, QC, Canada.10.1109/ICCV48922.2021.00951 ↗
28. Ning, Y., Lv, P., Zhang, Q., Xiao, L., and Wang, C. (2025). From vision-only to vision + language: A multimodal framework for few-shot unsound wheat grain classification. AI, 6.10.3390/ai6090207 ↗
29. dos Santos Lima Junior, M.S.P., Ortiz-de-Lazcano-Lobato, J.M., and López-Rubio, E. (2025). Training-free few-shot image classification via kernel density estimation with CLIP embeddings. Mathematics, 13.10.3390/math13223615 ↗
30. Wang, P., Li, H.-C., Lin, H.-C., Lin, W.-H., and Xie, N.-Z. (2025). A transductive zero-shot learning framework for ransomware detection using malware knowledge graphs. Information, 16.10.3390/info16060458 ↗
31. Ma, H., Fan, B., Ng, B.K., and Lam, C.-T. (2024). VL-Few: Vision–language alignment for multimodal few-shot meta-learning. Appl. Sci., 14.10.3390/app14031169 ↗
32. Zhou, Y., Yan, H., Ding, K., Cai, T., and Zhang, Y. (2024). Few-shot image classification of crop diseases based on vision–language models. Sensors, 24.10.20944/preprints202406.1456.v1 ↗
33. Evaluation: From precision, recall and F-measure to ROC, informedness, markedness and correlation
34. Manning, C.D., Raghavan, P., and Schütze, H. (2008). Introduction to Information Retrieval, Cambridge University Press.10.1017/CBO9780511809071 ↗
35. A systematic analysis of performance measures for classification tasks10.1016/j.ipm.2009.03.002 ↗