Bytes to Threats: Byte-Sequence Transformer For Malware Detection

Abstract:Existing malware detection approaches heavily rely on handcrafted features derived from static or dynamic analysis of the executable files. These methods require specialized domain expertise, dedicated analysis tools, and time-consuming analysis, which limits their scalability and robustness in the face of the increasing complexity and diversity of modern malware. Consequently, there is a growing interest in approaches that operate directly on raw bytes, which contain rich semantic and structural information. However, capturing long-range dependencies within executable files remains challenging for conventional static and CNN-based methods. This paper presents MalwareFormer, a transformer-based, byte-level malware detection framework that operates directly on raw bytes, without requiring domain knowledge or feature extraction. MalwareFormer achieves an accuracy of 98.35%, a balanced accuracy of 98.32%, a macro-F1 of 98.32%, and a false positive rate of 1.94%, outperforming both baselines across all threshold-dependent classification metrics and demonstrating that transformers provide a powerful and scalable approach for byte-level malware detection.

7 pages, 4 figures. Accepted and published at IEEE ICAD 2026

Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)

arXiv:2610.18787 [cs.CR]

(or arXiv:2610.18787v1 [cs.CR] for this version)

https://doi.org/10.48550/arXiv.2610.18787 Focus to learn more arXiv-issued DOI via DataCite (pending registration)

2026 IEEE International Conference on AI and Data Analytics (ICAD), Boston, MA, USA, 2026, pp. 1-7

https://doi.org/10.1109/ICAD69378.2026.11608884 Focus to learn more DOI(s) linking to related resources

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.