A hybrid deep learning architecture named RGA-MalNet has demonstrated high detection and classification accuracy for malware by analyzing text representations of dynamic behavioral features. Developed to overcome operational limitations found in traditional detection methodologies, the model processes dynamic behavioral indicators, specifically system permissions and application programming interface calls, to identify and categorize malicious software.
The structural foundation of RGA-MalNet relies on three parallel processing streams designed to extract complementary patterns from the behavioral input text. One branch uses residual gated attention blocks, another implements a long short-term memory network integrated with feature attention, and the third employs a multi-head self-attention module. Combining the residual gated attention blocks with the recurrent network captures both short-range and long-range sequential dependencies, while the multi-head self-attention module concentrates on essential behavioral features.
Information processed by the three parallel branches is subsequently consolidated using global average pooling and global max pooling operations. The pooled feature representations are then routed through dense layers with dropout regularization before reaching a Softmax classifier. For optimal configuration and tuning, the researchers implemented the Hyperband optimization technique to govern hyperparameter selection throughout the pipeline.
To ensure the consistency and robustness of the model, five-fold cross-validation was applied on four CIC datasets. The experimental evaluations yielded mean classification accuracies of 99.78 percent on the CICMalDroid 2020 dataset, 99.97 percent on the CIC-AndMal2017 dataset, 99.86 percent on the CIC-AAGM2017 dataset, and 98.87 percent on the CCCS-CIC-AndMal-2020 dataset.
Across all four evaluated benchmark datasets, the architecture achieved competitive state-of-the-art performance while maintaining structural scalability and computational efficiency. Based on these validation outcomes, the study authors concluded that the integrated deep learning framework provides strong practical potential for deployment in real-time malware detection applications.
Subject of Research: Deep learning architecture for malware detection and classification
Article Title: A novel malware detection and classification architecture based on residual gated multi-head attention long short-term memory
Article References: Abbas, M. J., Khan, M. A., Iqbal, S., Zhang, Y., Hussain, A., Alabdullah, B., & Damaševičius, R. (2026). A novel malware detection and classification architecture based on residual gated multi-head attention long short-term memory. Cluster Computing, 29(16), Article 935. https://doi.org/10.1007/s10586-026-06760-z
Image Credits: AI Generated
DOI: 10.1007/s10586-026-06760-z
Keywords: RGA-MalNet, malware detection, malware classification, residual gated attention, long short-term memory, multi-head self-attention, feature attention, dynamic behavioral features, API calls, system permissions, Hyperband optimization, 5-fold cross-validation, Softmax classifier, CICMalDroid 2020, CIC-AndMal2017, CIC-AAGM2017, CCCS-CIC-AndMal-2020, global average pooling
News Source: Denise Maddox. (November 12, 2026). RGA-MalNet Architecture Detects Malware With High Accuracy Across Benchmark Datasets. Scienmag.
