FOCA: Multimodal Malware Classification via Hyperbolic Cross-Attention
Nitin Choudhury, Bikrant Bikram Pratap Maurya, Orchid Chetia Phukan, Arun Balaji Buduru
TL;DR
This work tackles malware classification by leveraging multimodal information from binaries, represented as audio and visual modalities, and fusing them in hyperbolic space to capture hierarchical cross-modal structure. The approach, FOCA, integrates a hyperbolic projection, Hyperbolic Cross-Attention with a curvature-aware distance, and Möbius addition to produce a unified, curvature-aware embedding for classification. Empirical results on Mal-Net and CICMalDroid2020 show that FOCA outperforms unimodal and Euclidean multimodal baselines, achieving state-of-the-art performance, with the best gains observed for the combination of HuBERT and ViT. By demonstrating the effectiveness of hyperbolic fusion for multimodal malware analysis, the work highlights a principled path toward more robust and scalable defenses, and provides code and models for reproducibility.
Abstract
In this work, we introduce FOCA, a novel multimodal framework for malware classification that jointly leverages audio and visual modalities. Unlike conventional Euclidean-based fusion methods, FOCA is the first to exploit the intrinsic hierarchical relationships between audio and visual representations within hyperbolic space. To achieve this, raw binaries are transformed into both audio and visual representations, which are then processed through three key components: (i) a hyperbolic projection module that maps Euclidean embeddings into the Poincare ball, (ii) a hyperbolic cross-attention mechanism that aligns multimodal dependencies under curvature-aware constraints, and (iii) a Mobius addition-based fusion layer. Comprehensive experiments on two benchmark datasets-Mal-Net and CICMalDroid2020- show that FOCA consistently outperforms unimodal models, surpasses most Euclidean multimodal baselines, and achieves state-of-the-art performance over existing works.