Abstract
As malware evolves in complexity, conventional detection techniques reliant on singular static or behavioral attributes exhibit constrained generalization and sluggish reactions to zero-day threats. This research presents a malware identification methodology utilizing multimodal data fusion to tackle these difficulties. Static characteristics are derived from portable executable (PE) structures, whilst dynamic behaviors are recorded via API call sequences and memory activities, and are encoded utilizing a three-layer CNN and a bidirectional LSTM. System call sequences are additionally represented as call graphs, and behavioral pathways are acquired through a gated graph neural network. Furthermore, executable files are converted into grayscale images, from which structural elements are retrieved utilizing ResNet-18. The diverse features are aligned and integrated using positional encoding, LayerNorm, and a multihead self-attention mechanism within a Transformer framework to create a cohesive representation for categorization. A federated incremental learning framework utilizing FedAvg facilitates collaborative training and ongoing model adaption across remote nodes at the deployment level. Experimental findings indicate that the suggested method attains a detection accuracy of 89 % ∼ 93 %, a zero-day recall rate of 90 %, and high fusion efficiency (45 ms for 5,000 samples), signifying substantial robustness and efficacy in malware detection and network security protection.