Seeing and Listening at Once: Dual-View AI Spots Malware That Single Detectors Miss

Cybersecurity researchers have unveiled a dynamic malware detection system that fuses two very different views of a suspicious program — the sequence of system calls it makes while running, and images generated from snapshots of a computer’s memory taken from outside the virtual machine — and the combined approach reached 98.6 percent accuracy on a test dataset. The work, published in the open-access journal Cybersecurity, addresses a stubborn weakness in modern antivirus technology: sophisticated malware increasingly hides from any single method of observation, but it is far harder to fool two independent witnesses at once.

The scale of the problem motivating the research is enormous. According to the AV-TEST Institute, more than 450,000 new malware samples were registered every day in 2024, a torrent that overwhelms signature-based defenses and demands automated, behavior-driven analysis. Detection techniques split into two broad families. Static methods inspect files without executing them, offering speed but struggling against packing, encryption and obfuscation that deliberately scramble a program’s visible contents. Dynamic methods run samples inside monitored environments and watch what they actually do, which makes them less susceptible to evasion — but each dynamic technique carries blind spots of its own.

The most widely used dynamic signal is the API call sequence: the ordered list of functions a program requests from the operating system, captured inside a sandbox. These sequences effectively reflect runtime behavior, but they are what researchers call in-band features, gathered from the same observation perspective as the operating system itself. That shared vantage point creates an opening for attackers. Some malware bypasses monitored API calls entirely, manipulating memory directly or exploiting system vulnerabilities to avoid leaving the traces API-based detectors depend on. Anti-sandbox strains can go further, detecting that they are running in a sandbox and delaying or suppressing malicious actions until the observation window closes.

The complementary approach watches from outside. Memory-based detection typically runs a suspect inside a virtual machine and captures snapshots of its memory from the hypervisor level, a perspective the guest operating system cannot tamper with. The catch is that a snapshot is exactly that — a frozen moment that may miss transient malicious activity. Traditional virtual machine introspection also demands heavy semantic reconstruction to interpret raw memory bytes, adding complexity and computational overhead. Each technique in isolation, the researchers argue, offers only an incomplete representation of malicious behavior, which is precisely why evasive malware so often slips past single-modal defenses.

The new method, developed by Lexin Jia, Jian Zhang, Xiangyi Wang and Wei Zheng, runs each sample in a Cuckoo sandbox to collect API call sequences while simultaneously executing it in a KVM virtual machine and dumping the entire memory from outside at intervals of ten to twenty seconds. On the text side, behavioral attributes such as API names, categories, file paths, registry references and string data are transformed with feature hashing into fixed-dimensional vectors, then processed by a fine-tuned Long Short-Term Memory network. The architecture normalizes inputs through batch normalization, passes them through a gated convolutional layer with parallel kernels acting as temporal n-gram extractors, and feeds the result into a bidirectional LSTM that preserves the influence of both preceding and succeeding calls.

On the memory side, the team adopted a targeted dimensionality-reduction trick. Rather than converting an entire multi-gigabyte memory dump into an image, they used the open-source forensics tool Volatility to locate the offsets of two Windows registry hives — HKEY_LOCAL_MACHINE, which stores system-wide configurations such as driver loading and service registrations closely tied to malware persistence, and HKEY_CURRENT_USER, which holds personal user settings. From each offset they read 98,304 validated data values, enough to reshape into a 256-by-256 three-channel color image saved as a PNG. These pseudo-images are then analyzed by a fine-tuned ResNet18, whose residual blocks mitigate gradient problems and whose global average pooling compresses high-level features into a compact vector for classification.

The two feature vectors are merged through feature-level concatenation followed by a fully connected layer, and this choice proved decisive in ablation experiments. Decision-level fusion, which simply averages the prediction probabilities of the two branches, performed worse because it keeps each modality’s learning isolated until the final step. Cross-modal attention fusion, a popular dynamic-weighting technique, performed suboptimally in this setting, yielding near-random precision — a result the authors attribute to the structural mismatch between one-dimensional sequential API logic and two-dimensional spatial memory snapshots, which makes learning shared representations difficult. Simple concatenation lets the fully connected layers learn the non-linear interdependencies between the two views without imposing extra alignment complexity.

The evaluation dataset comprised 1,570 malware samples, including the CryptoRansomware encryption ransomware family, the system-locking Locker variant, and the Zeus banking Trojan, along with strains employing anti-VM and anti-sandbox techniques, plus 1,557 benign programs drawn largely from CNET. Eighty percent of samples trained the models and twenty percent were held out for testing. The full multi-modal model achieved 98.6 percent accuracy, outperforming both the memory-only branch, which showed a slightly lower recall suggesting some missed malicious samples, and the API-only branch, which had lower overall accuracy despite strong precision. Feature hashing for API encoding beat one-hot and TF-IDF schemes, reaching a precision of 0.984 while remaining robust to previously unseen API names, and the fine-tuned LSTM outperformed a Transformer on this task — the authors suggest the relatively small dataset, moderate sequence lengths and strict temporal dependencies favor recurrent architectures, while the Transformer’s many parameters invite overfitting.

Efficiency comparisons highlighted the value of selective memory extraction. A prior whole-memory difference-analysis approach required thousands of seconds for feature extraction, and the MDMV framework’s SimHash mapping of fixed 16-megabyte regions still imposed non-negligible overhead from bitwise operations. The registry-guided method processed far smaller regions while achieving strong detection performance, and resolution tests showed 256-by-256 inputs offered the best balance, with 384-by-384 images actually degrading results, possibly through feature sparsity or slight overfitting. Against rival multi-modal systems, the approach beat HYDRA, which relies on static features vulnerable to obfuscation; the whole-memory method of Zheng and colleagues, which introduces noise and heavy computational cost; and HyperMD, which requires intrusive Xen hypervisor modifications and expert-defined hardware performance counters. Against single-modal baselines including IMCFN, Li and colleagues’ API method, MDMV, and a VGG16 image classifier that collapsed into over-predicting the positive class, the new branches consistently came out ahead.

The authors are candid about limitations. The pipeline’s end-to-end runtime is dominated by dynamic sample execution and data acquisition, making it best suited to sandbox-based and offline analysis rather than real-time gatekeeping, and performance on entirely new malware families or samples from different sources may shift, since the training data came mainly from VirusTotal and CNET. They plan to optimize the slowest stages and evaluate the method on newly emerging threats and more diverse data to test generalization. Still, the core result stands as a striking demonstration of a simple principle: a program’s behavior over time and its footprint in memory are two different kinds of evidence, and an AI that reads both is considerably harder to deceive than one that reads either alone.

Subject of Research: Multi-modal dynamic malware detection combining API call sequences and memory dump image features

Article Title: A dynamic malware detection method based on multi-modal features

Article References: Jia, L., Zhang, J., Wang, X., & Zheng, W. (2026). A dynamic malware detection method based on multi-modal features. Cybersecurity, 9(1), Article 245. https://doi.org/10.1186/s42400-026-00683-3

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00683-3

Keywords: malware detection, multi-modal deep learning, API call sequences, memory forensics, virtual machine introspection, LSTM, ResNet18, sandbox analysis, cybersecurity, feature fusion, ransomware, dynamic analysis