💻 computer science

FOCA: Multimodal Malware Classification via Hyperbolic Cross-Attention

This paper introduces FOCA, a novel multimodal malware classification framework that transforms binaries into audio and visual representations and leverages hyperbolic space with cross-attention mechanisms to capture intrinsic hierarchical relationships, achieving state-of-the-art performance on benchmark datasets.

Original authors: Nitin Choudhury, Bikrant Bikram Pratap Maurya, Orchid Chetia Phukan, Arun Balaji Buduru

Published 2026-01-27

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Nitin Choudhury, Bikrant Bikram Pratap Maurya, Orchid Chetia Phukan, Arun Balaji Buduru

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to identify a specific type of criminal (a "malware" or virus) hiding inside a computer file. Traditionally, security experts have looked at these files like a detective reading a list of ingredients (the raw code). But hackers are clever; they often disguise their ingredients so the detective can't recognize them.

The researchers in this paper, FOCA, decided to try a different approach. Instead of just reading the code, they turned the file into two different types of sensory experiences: a song (audio) and a picture (visual).

Here is how their system works, explained simply:

1. Turning Code into Senses

Think of a computer file as a long string of numbers.

The Audio Approach: They turned these numbers into sound waves. It's like listening to the file. Some patterns might sound like a steady drumbeat, while others sound like chaotic static. This helps catch tiny, detailed "byte-level" clues.
The Visual Approach: They turned the same numbers into a picture. Imagine taking the numbers and painting them into a grid of colors. This creates a "map" that shows the big-picture structure and shape of the file.

2. The Problem with Mixing Them

Usually, when you try to combine a song and a picture to solve a puzzle, you just mash them together. The researchers realized this is like trying to mix oil and water; they don't blend well because they have different "shapes" or structures.

In the computer world, most systems use Euclidean space (think of it as a flat, straight-lined map). On a flat map, it's hard to show how one thing is "inside" or "above" another in a complex hierarchy. But malware has a hidden hierarchy: the tiny sound details are the foundation, and the big visual patterns are the roof.

3. The Solution: A Curved Map (Hyperbolic Space)

To fix the mixing problem, FOCA uses a special mathematical trick called Hyperbolic Space.

The Analogy: Imagine a flat map (Euclidean) vs. a funnel or a coral reef (Hyperbolic). A flat map gets crowded quickly if you try to draw a tree with many branches. A funnel, however, gets wider as you go out, giving plenty of room for every branch to sit comfortably without touching.
The Benefit: This "curved" space is perfect for showing the relationship between the audio (the small details) and the visual (the big structure). It respects the natural "family tree" of the data.

4. The "Cross-Attention" Mechanism

Once the data is on this curved map, FOCA uses a Hyperbolic Cross-Attention mechanism.

The Analogy: Imagine you have a detective listening to a song and looking at a photo. In a normal system, they might shout over each other. In FOCA, they have a special "translator" that helps them focus on exactly the right parts of the song that match the right parts of the photo.
This translator ensures the audio and visual clues align perfectly, even while they are on that curved, funnel-shaped map.

5. The Results

The researchers tested this system on two huge collections of known malware files (called Mal-Net and CICMalDroid2020).

The Outcome: FOCA was better at spotting the bad files than:
- Systems that only listened to the audio.
- Systems that only looked at the pictures.
- Systems that tried to mix audio and pictures using the old, "flat" map methods.
In fact, it became the new best-in-class (State-of-the-Art) for these specific tests.

Summary

In short, FOCA is a new way to catch computer viruses. Instead of just reading the code, it turns the code into music and art. It then uses a special curved mathematical map to help the music and art understand each other perfectly, leading to a much smarter and more accurate security guard than we've had before.

Note: The paper claims this method works specifically for classifying malware on these two datasets. It does not claim to work on other types of data or in other real-world scenarios outside of this specific context.

Technical Summary: FOCA – Multimodal Malware Classification via Hyperbolic Cross-Attention

Problem Statement
Malware classification faces a persistent "cat-and-mouse" challenge where attackers utilize obfuscation and polymorphism to evade traditional signature-based defenses. While machine learning and deep learning approaches have improved detection, they often struggle with evolving threats. Recent research has explored converting raw binary files into alternative modalities, such as images (visual) and audio (waveforms), to leverage pre-trained models. However, existing multimodal fusion methods typically rely on Euclidean space, which fails to capture the intrinsic hierarchical relationships between different data modalities. Specifically, while audio representations may encode fine-grained byte-level characteristics and visual representations capture higher-level structural patterns, current fusion strategies (e.g., simple concatenation or standard cross-attention) do not explicitly model this hierarchy, limiting their potential for robust classification.

Methodology
The authors propose FOCA (FusiOn with Hyperbolic Cross-Attention), a framework designed to fuse audio and visual modalities within a hyperbolic space to better model their hierarchical dependencies. The methodology proceeds through the following stages:

Binary-to-X Transformation:
- Audio Modality: Raw byte sequences from APK-dex files are mapped into continuous time-series waveform samples (.wav files).
- Visual Modality: Raw bytes are treated as unsigned integers (0–255), concatenated into a 1D array, and reshaped into 2D matrices where header, data, and remaining sections map to RGB channels, creating image representations.
Representation Extraction:
- Audio: State-of-the-art (SOTA) pre-trained models (PTMs)—Wav2vec2, WavLM, and HuBERT—are used to extract 768-dimensional embeddings via mean pooling from their last hidden layers.
- Visual: SOTA vision PTMs—ResNet50, VGG19, and ViT—are used to extract embeddings (2048, 4096, or 768 dimensions) via average pooling.
- Unimodal Processing: Extracted features pass through a CNN-based architecture (two 1D-CNN layers with max pooling) before entering the fusion module.
Hyperbolic Fusion (FOCA Core):
- Hyperbolic Projection: Euclidean features are projected into the Poincaré ball ( $B^d$ ) using the exponential map at the origin.
- Hyperbolic Cross-Attention (HCA): A novel mechanism aligns audio and visual modalities. Unlike standard attention, HCA computes attention weights using hyperbolic distance ( $d_H$ ) in the Poincaré ball, ensuring curvature-aware alignment of queries, keys, and values.
- Möbius Fusion: The attended values are aggregated using Möbius addition ( $\oplus_H$ ) and scalar multiplication ( $\otimes_H$ ), operations specific to hyperbolic geometry. The final fused representation is mapped back to Euclidean space via the logarithmic map for classification.

Key Contributions
The paper claims three primary contributions:

First Exploration of Hierarchy: It is the first study to explicitly explore and model the hierarchical relationship between audio (fine-grained) and visual (structural) modalities for malware classification.
Novel Framework (FOCA): The proposal of a multimodal framework that leverages hyperbolic space to fuse these modalities, introducing a Hyperbolic Cross-Attention mechanism and Möbius addition-based fusion layer.
Empirical Superiority: Extensive experiments demonstrate that FOCA consistently outperforms unimodal models and Euclidean-based multimodal baselines (including simple concatenation and standard cross-attention), establishing new state-of-the-art (SOTA) performance.

Experimental Results
The framework was evaluated on two benchmark datasets: Mal-Net (filtered to 8,000 samples across 10 classes) and CICMalDroid2020 (17,341 samples across 5 classes).

Performance: FOCA achieved the highest accuracy and macro-F1 scores across all tested configurations.
- On CICMalDroid2020, the best configuration (HuBERT $\oplus_H$ ViT) achieved 99.10% accuracy and 98.85% macro-F1, surpassing the previous SOTA (Yang et al.) which reported 98.52% accuracy.
- On Mal-Net, the best configuration achieved 82.84% accuracy, outperforming the previous SOTA (Samaneh et al. at 41.73% and Scott et al. at 70.12%).
Comparative Analysis:
- FOCA consistently outperformed simple concatenation and Euclidean cross-attention baselines.
- t-SNE visualizations indicated that FOCA produces more distinct and compact clusters compared to Euclidean cross-attention, suggesting better separation of malware families.
- Among unimodal baselines, audio representations generally outperformed image representations, though no single audio model dominated across both datasets.

Significance and Claims
The authors position this work as a pioneering step in malware classification by bridging hierarchical relationship modeling with geometry-aware approaches. They claim that FOCA is the first study to leverage hyperbolic space for the fusion of multimodal representations in malware classification. By moving beyond Euclidean constraints, the framework offers a principled advantage in aligning modalities with different levels of abstraction. The work establishes hyperbolic multimodal fusion as a promising new direction for the field, providing a robust solution that adapts to the evolving nature of malware threats. The code and trained models are made publicly available to support reproducibility.