Malware never sleeps, but the data needed to fight it cannot legally leave the organizations that collect it. That tension sits at the heart of a new study from researchers at Beijing University of Posts and Telecommunications, who have built a federated learning system that lets multiple institutions jointly train a powerful malware classifier without ever sharing a single malicious binary. The work, published in the journal Cybersecurity, tackles two of the most stubborn obstacles in applied machine learning security: privacy constraints that fragment threat data across organizations, and the statistical skew that makes collaborative training collapse when different organizations see wildly different kinds of malware.
The problem is more acute than it might first appear. Malware samples are scattered across security vendors, internet service providers, cloud platforms, enterprises, and endpoint devices, and each organization observes a different slice of the threat landscape. Financial institutions encounter predominantly banking trojans, while healthcare systems are more frequently targeted by ransomware variants. Privacy regulations, security policies, and commercial sensitivity make it nearly impossible to pool raw binaries, disassembly files, or endpoint traces in one place. A model trained only on local data fits its own narrow threat environment and generalizes poorly elsewhere. Federated learning, in which clients exchange model updates rather than data, offers a way around this, but it introduces a fresh difficulty: when local label distributions are highly non-independent and identically distributed, a phenomenon known as non-IID, standard aggregation methods such as FedAvg become unstable and converge slowly or badly.
The research team, led by Shaohua Liu and Wenbo Zhang with colleagues Tingting Yang, Guanghao Li, and Lihua Zhang, approached the problem from two directions at once. First, they gave each participating client a multimodal view of every malware sample. Rather than relying on a single representation, each binary is encoded into two complementary static forms: a three-channel image and a fixed-length token sequence. The image is not a conventional picture but a mathematically constructed 224-by-224 pixel tensor whose three channels capture distinct aspects of the file. The first channel is a raw-byte grayscale map, produced by reshaping the parsed hexadecimal byte stream into a two-dimensional matrix whose width adapts to file size, preserving the coarse spatial layout and texture patterns that malware visualization research has long exploited. The second channel is a Shannon entropy map computed over sliding windows of the byte stream, with the window length scaled to the file and the resulting entropy values min-max normalized to the standard grayscale range; this highlights regions of unusual byte diversity, which often mark packing or encryption. The third channel derives from static disassembly: opcode-like tokens are extracted from the .text section and summarized with a MinHash signature using 1024 permutations, injecting lightweight semantic information into the visual branch without executing the sample.
The second modality is a token sequence of fixed length 112, drawn from the disassembly file. Rule-based matching extracts call-related tokens, including operations tied to file access, memory allocation, process handling, network communication, and registry activity. These tokens are mapped to a vocabulary of 3,869 entries and padded or truncated to uniform length. The sequence branch processes this input through 128-dimensional embeddings, two one-dimensional convolutional blocks with max pooling, and a two-layer bidirectional LSTM, capturing both local call patterns and longer-range dependencies. Crucially, the entire pipeline is static: no sandbox execution, no dynamic tracing, which matters enormously in federated settings where clients may lack the computing budget for repeated behavioral analysis.
At the heart of the client-side model sits the fusion architecture, and this is where the paper makes its most technically interesting contribution. The image encoder, a ResNet-18 backbone initialized with ImageNet-pretrained weights, produces a 512-dimensional visual vector, while the sequence encoder outputs 128 dimensions. Both are projected into a shared 384-dimensional fusion space, and a bidirectional multi-head cross-attention module with six attention heads lets the two modalities query each other. In one direction, the image feature attends to sequence tokens; in the other, sequence features attend to image regions. This mutual calibration means that when one modality is unreliable on a particular client, the other can compensate. But attention-based fusion has a known weakness: when the attention-enhanced features are perturbed by client-specific distribution shifts, the fused representation can become unstable. The authors address this with an adaptive residual path. A learned sigmoid gate computes a coefficient between zero and one from the original image and sequence features, and the final fused representation is a convex combination of the attention-enhanced feature and a residual projection of the original image feature. Because the gate is bounded, the authors prove a simple but useful local stability property: any perturbation in the attention branch is attenuated by the gate coefficient before reaching the fused output, so the fused feature can never drift farther from the residual visual path than the attention branch itself does.
On the federated side, the team adapted FedBN, a strategy originally designed for non-IID feature distributions. The key insight is that Batch Normalization layers, ubiquitous in deep networks, maintain running statistics of activation means and variances, and these statistics can differ drastically across clients whose malware populations differ. If such statistics are averaged globally, as in conventional FedAvg, the resulting global statistics match no client well. FedBN instead decomposes model parameters into a shared set and a client-specific set: batch normalization parameters and running statistics remain permanently local, while everything else is aggregated at the server weighted by sample counts. The authors provide an explicit mismatch bound showing that the error introduced by using global rather than local normalization statistics grows with the divergence between local and global activation distributions, and FedBN eliminates exactly this term. In the multimodal context, where unstable features from one branch can propagate through the fusion module, keeping normalization local turns out to be especially valuable.
The experimental evaluation was conducted on the Microsoft Malware Classification Challenge dataset, known as BIG 2015, containing 10,868 samples across nine malware families, with a simulated federation of five clients and sixty communication rounds on modest hardware, a single GeForce GTX 1660 Ti with 6 GB of VRAM. Three partition regimes were tested. Under the IID partition, where data are evenly distributed, the proposed framework reached 99.31 percent accuracy, within half a percentage point of a centralized model trained on all pooled data. Under a class-dominant non-IID partition, in which each client is dominated by one or more families with 80 percent of its samples drawn from those classes, the framework achieved 99.42 percent accuracy, the best accuracy, macro-precision, and macro-recall among the compared methods, and statistically significant improvements over single-modality baselines. Under a Dirichlet non-IID protocol with ten clients and a severe concentration parameter of 0.3, the model still reached 97.34 percent accuracy and 92.14 percent macro-F1. Sensitivity analysis across five, ten, and twenty clients showed accuracy remaining above 97 percent throughout, while macro-level metrics actually improved as the federation grew, suggesting the fusion-and-FedBN combination scales gracefully.
Ablation studies confirmed that every component earns its place. Removing FedBN caused a clear accuracy drop; removing bidirectional cross-attention cost 0.80 percentage points of non-IID accuracy; removing adaptive residual fusion cost 1.32 points. Single-direction attention performed worse than the full bidirectional design, and fixed residual weighting performed worse than the adaptive gate. Modality-level ablations showed that adding the opcode-derived MinHash channel improved image-only accuracy from 97.31 to 97.93 percent, and adding the sequence branch pushed it to 98.17 percent, demonstrating that the two disassembly-derived representations encode genuinely complementary granularities: the image channel provides an order-insensitive summary of opcode occurrences, while the sequence branch preserves the temporal order of call semantics.
Perhaps most notably for a security venue, the authors went beyond statistical heterogeneity to test adversarial robustness. They simulated label-flipping poisoning attacks, in which a malicious client corrupts its local labels before training, under both targeted and untargeted variants. At a 20 percent poisoning ratio, accuracy fell only from 99.42 to 95.92 percent under the untargeted attack, and to 96.15 percent under the targeted variant; even at 40 percent poisoning the model retained 92.47 percent accuracy, outperforming FedAvg in both settings. Replacing weighted averaging with coordinate-wise median aggregation of the shared parameters, while keeping batch normalization local as before, further improved accuracy to 93.56 percent under attack, at the modest server-side cost of sorting-based aggregation. The authors are careful to note that this is robustness, not immunity: at a 60 percent poisoning ratio accuracy fell to 82.01 percent under untargeted attack, and FedBN was designed for statistical heterogeneity rather than Byzantine behavior, so poisoning at scale remains an open problem requiring complementary defenses.
Efficiency figures round out the practical picture. Full training took roughly one hour and forty-five minutes over sixty rounds, with 14.61 million parameters and about 557 megabytes of communication per round across five clients, close to simpler fusion baselines and competitive given the accuracy gains, particularly since FedBN excludes batch normalization statistics from transmission. The framework’s limitations are candidly acknowledged: BIG 2015 is now more than a decade old, static features can be defeated by heavy obfuscation or polymorphism, the evaluation is closed-set, and future work will incorporate dynamic behavioral signals, open-set recognition, continual learning, and stronger Byzantine-resilient aggregation. Still, the study offers the clearest demonstration yet that multimodal malware classification, long validated only in centralized laboratories, can survive contact with the fragmented, skewed, privacy-bound, and occasionally hostile reality of cross-organization deployment.
Subject of Research: Federated multimodal malware family classification under non-IID client data distributions
Subject of Research: Technology and Engineering
Article Title: Federated multimodal malware classification under non-IID data
Article References: Liu, S., Zhang, W., Yang, T., Li, G., & Zhang, L. (2026). Federated multimodal malware classification under non-IID data. Cybersecurity, 9(1), Article 197. https://doi.org/10.1186/s42400-026-00630-2
Image Credits: AI Generated
DOI: 10.1186/s42400-026-00630-2
Keywords: malware family classification, federated learning, multimodal learning, cross-attention, FedBN, non-IID data, batch normalization, label-flipping attack, robust aggregation, privacy-preserving machine learning
Cite Scienmag News
APA
MLA
Chicago
Veronica Carney. (September 3, 2026). Federated multimodal approach boosts malware classification across non-IID data. Scienmag. https://scienmag.com/federated-multimodal-approach-boosts-malware-classification-across-non-iid-data/
Veronica Carney. “Federated multimodal approach boosts malware classification across non-IID data.” Scienmag, 3 September 2026, https://scienmag.com/federated-multimodal-approach-boosts-malware-classification-across-non-iid-data/. Accessed 3 September 2026.
Veronica Carney. “Federated multimodal approach boosts malware classification across non-IID data.” Scienmag. September 3, 2026. https://scienmag.com/federated-multimodal-approach-boosts-malware-classification-across-non-iid-data/
Copy citation
Download RIS
Tags: addressing data heterogeneity in securitycollaborative threat intelligencecross-organization threat data sharingcross-organizational malware trainingdecentralized malware analysisdecentralized malware detectiondistributed threat data analysisfederated cybersecurity systemsfederated learning for cybersecurityfederated learning for malware detectionFederated malware classificationmachine learning privacy constraintsmalware dataset fragmentationmalware threat landscape analysismultimodal malware classificationmultimodal threat detectionnon-IID cybersecurity datanon-IID data in machine learningprivacy regulations in cybersecurityprivacy-preserving cybersecurityprivacy-preserving machine learningsecurity model generalizationthreat landscape diversification
