Bytes to Threats: Byte-Sequence Transformer For Malware Detection

arXiv:2610.18787v1 Announce Type: cross Abstract: Existing malware detection approaches heavily rely on handcrafted features derived from static or dynamic analysis of the executable files. These methods require specialized domain expertise, dedicated analysis tools, and time-consuming analysis, which limits their scalability and robustness in the face of the increasing complexity and diversity of modern malware. Consequently, there is a growing interest in approaches that operate directly on raw bytes, which contain rich semantic and structural information. However, capturing long-range dependencies within executable files remains challenging for conventional static and CNN-based methods. This paper presents MalwareFormer, a transformer-based, byte-level malware detection framework that operates directly on raw bytes, without requiring domain knowledge or feature extraction. MalwareFormer achieves an accuracy of 98.35%, a balanced accuracy of 98.32%, a macro-F1 of 98.32%, and a false positive rate of 1.94%, outperforming both baselines across all threshold-dependent classification metrics and demonstrating that transformers provide a powerful and scalable approach for byte-level malware detection.

Related

• Large Byte Model: Teaching Language Models About Compiled Code
• Adversarial Vulnerability Under Temporal Concept Drift: A Longitudinal Study of Android Malware Detection
• Delphi Scanner: efficient and interpretable static malware detection via API sequence modeling
• A Hybrid Approach For Malware Classification Using Secondary Features Fusion

Source: arXiv cs.AI | 2026-10-15