The core idea behind the framework, published in Cluster Computing, is to convert both static and dynamic analysis features of an application into two distinct two-dimensional image formats. The first is a conventional 2D grayscale image, in which extracted feature vectors are reshaped into pixel matrices so that patterns of malicious behavior appear as visual textures. The second is a QR code image representation, a more unusual encoding that arranges feature information into the blocky, high-contrast structure familiar from quick-response codes. The researchers trained separate Vision Transformer models on each image type. A Vision Transformer works by slicing an image into small patches, treating each patch as a token, and then using self-attention mechanisms to model the relationships between all patches simultaneously. This allows the model to capture long-range spatial dependencies that convolutional networks, which process images through local filters, can miss.

Once the two ViT models had been trained, the team did not simply take their final classification verdicts. Instead, they extracted the spatial pooling features from the deeper layers of each network, the compact numerical summaries that the transformers build up as they interpret the images. These feature sets, one derived from grayscale images and one from QR code images, were then combined into a single fused representation. The logic is that the two image encodings emphasize different aspects of an application’s behavior, so a classifier that sees both should have a richer picture than one that sees either alone. Feature fusion of this kind has become a recurring theme in malware research precisely because no single view of a program, whether permissions, API calls, or runtime behavior, tells the whole story.

The fused feature vector, however, contained a mixture of informative and redundant attributes, and feeding everything into a classifier can dilute the signal. To address this, the researchers applied Recursive Feature Elimination, an iterative selection technique that trains a model, ranks the features by importance, discards the weakest ones, and repeats the process until only the most discriminative subset remains. This RFE-optimized selection step proved to be one of the decisive ingredients of the framework. By pruning away noise before classification, it sharpened the boundaries between benign and malicious samples and reduced the computational burden of the final decision stage.

For the final classification, the team deployed a majority-voting ensemble, a strategy with a long pedigree in machine learning. Rather than trusting a single algorithm, several different machine learning classifiers each cast a vote on whether a sample is malicious, and the majority decision prevails. Ensembles of this kind tend to be more robust than individual models because the errors of one classifier can be corrected by the others, provided their mistakes are not perfectly correlated. Combined with the fused and filtered features, the voting ensemble delivered the framework’s headline result: an overall detection accuracy of 98.72 percent, outperforming the standalone Vision Transformer models and every single-modality configuration the authors tested.

The ablation-style comparison embedded in the results carries an important message for the field. Neither the grayscale pathway nor the QR code pathway alone matched the multimodal system, and the gains from fusing features and applying RFE-based selection were described by the authors as substantial contributions to the overall performance. In other words, the improvement did not come from a single clever trick but from the deliberate stacking of complementary techniques: two image representations, two transformer encoders, feature fusion, disciplined feature selection, and ensemble voting. Each layer of the pipeline removes a different weakness of the layer before it.

The study situates itself within a rapidly growing literature on image-based malware detection. Previous work has explored converting bytecode, permission lists, and network traffic into images for convolutional neural networks, and recent efforts have introduced transformer architectures such as ViTDroid for attending to malicious behavior in Android binaries. Others have fused multivariate features or applied reinforcement learning to feature selection. The Turkish team’s contribution is to bring these threads together in a single multimodal pipeline and to demonstrate, with a publicly available dataset, that the combination outperforms its individual components. The dataset used in the study can be accessed through the official UNB CIC website and Kaggle, a decision that supports reproducibility and allows other groups to benchmark against the reported results.

The practical implications are considerable. Because the framework relies on static and dynamic analysis features rather than on signatures of known malware families, it has the potential to generalize to new and obfuscated threats that signature databases have never seen. The QR code representation in particular is a novel twist, building on earlier work by one of the co-authors on cyber attack detection using QR code images with lightweight deep learning models. Encoding security-relevant features into a format designed for machine readability appears to produce distinctive visual signatures of malicious behavior that transformers can exploit effectively. For mobile security vendors, the findings suggest that multimodal image representations could become a standard component of next-generation detection engines, especially as transformer models continue to be optimized for deployment on resource-constrained platforms.

Challenges remain before such systems reach production. Image-based approaches depend on the quality and completeness of the underlying feature extraction, and adversaries who understand the encoding scheme may attempt to craft features that evade visual detection. The computational cost of running two Vision Transformer models per application also needs to be weighed against the latency requirements of app store scanning and on-device security tools. Nevertheless, the 98.72 percent accuracy reported by Başaran, Alaca, and Okucu represents a compelling data point in the ongoing effort to stay ahead of Android malware, and it underscores a broader trend in cybersecurity: the most effective defenses increasingly come not from looking harder at code, but from teaching machines to see it in entirely new ways.

Subject of Research: Multimodal Vision Transformer-based Android malware detection using 2D grayscale and QR code image representations

Article Title: Multimodal vision transformer framework for android malware detection via 2D grayscale and QR code ımage representations, feature fusion, and RFE-optimized majority voting

Article References: Başaran, E., Alaca, Y., & Okucu, Ö. (2026). Multimodal vision transformer framework for android malware detection via 2D grayscale and QR code ımage representations, feature fusion, and RFE-optimized majority voting. Cluster Computing, 29(15), Article 834. https://doi.org/10.1007/s10586-026-06667-9

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06667-9

Keywords: Android malware detection, Vision Transformer, QR code images, grayscale images, feature fusion, Recursive Feature Elimination, majority voting, machine learning, cybersecurity, deep learning, ensemble methods, mobile security

The central idea behind the research is deceptively simple: instead of relying on a single compression algorithm, chain two complementary techniques so that each one exploits the weaknesses left behind by the other. The first stage of both proposed schemes is a technique called Rounding Intensity Followed by Dividing, or RIFD, which was previously introduced by the same author in 2016. RIFD is a lossy operation that reduces the bit depth of an image by rounding pixel intensity values and then dividing them, which collapses many nearly identical gray levels into single representative values. This deliberate quantization shrinks the alphabet of symbols that the subsequent lossless coder has to handle, and it simultaneously reshapes the statistical distribution of those symbols, creating strong redundancies that entropy coders can harvest efficiently.

The two schemes differ in what happens after RIFD has done its work. The first, designated HLL1, feeds the preprocessed image into the Lossless Method of Decomposing Huffman Trees, abbreviated LM-DH, a technique first described by Alkhalayleh and Otair in 2015. Classical Huffman coding, invented by David Huffman in 1952, assigns shorter binary codes to more frequent symbols, but building and storing a single large Huffman tree for an image with many distinct intensity values can itself consume considerable space. LM-DH addresses this by decomposing the Huffman tree into smaller subtrees, which reduces the overhead of transmitting the coding table and improves the overall compression ratio. The second scheme, HLL2, pairs RIFD with the Lempel-Ziv-Welch algorithm, or LZW, the dictionary-based coder that Terry Welch derived from the foundational 1977 work of Jacob Ziv and Abraham Lempel and published in 1984. LZW builds a dictionary of recurring symbol sequences on the fly, so it needs no explicit code table to be sent alongside the compressed data.

To evaluate the two pipelines, the author ran experiments on a dataset of 20 standard test images spanning three common formats: 8-bit grayscale, 16-bit grayscale, and 24-bit RGB color. All processing was performed in MATLAB R2021b, a standard environment for image processing research, and the benchmark images were drawn from widely used public collections, including the CLIC dataset from the Challenge on Learned Image Compression, the USC-SIPI Image Database, the Kodak True Color Image Suite, and the Set11 collection of grayscale images used in reconstruction and compression studies. Using established public benchmarks matters, because it allows other researchers to reproduce the numbers and compare the new schemes directly against both classical baselines and modern learned codecs.

The headline result concerns how much better the hybrid schemes perform than their own lossless components alone. HLL1 produced an average improvement in compression ratio, measured as an ICR value, of 0.20 over the RIFD plus Huffman baseline, meaning that decomposing the Huffman tree into subtrees consistently squeezed out additional savings beyond what conventional Huffman coding could achieve on the same preprocessed data. HLL2 delivered an even more striking figure on the 8-bit grayscale datasets, where pairing RIFD with LZW yielded an average improvement of 73 percent. The author attributes this to the way RIFD’s bit-depth reduction creates long runs of repeated intensity values, precisely the kind of repetitive structure that dictionary-based LZW coding converts into short dictionary references.

Just as important as the size reductions is what the schemes do not cost in quality. Because the second stage of each pipeline is strictly lossless, it introduces no additional distortion whatsoever beyond the RIFD preprocessing step. In other words, once the image has been rounded and divided, every subsequent operation is perfectly reversible, so the decoded image is an exact replica of the preprocessed version. The perceptual integrity of the image is therefore determined entirely by how aggressive the RIFD quantization is, giving practitioners a single, tunable knob for balancing file size against visual fidelity. The study reports that the proposed techniques dramatically shrink file sizes without sacrificing perceptual quality, which makes them candidates for bandwidth-constrained and storage-limited environments where every kilobyte counts.

The work situates itself within a long tradition of hybrid compression research. Earlier studies have combined the discrete wavelet transform with set partitioning techniques and Huffman encoding, and medical imaging researchers have stacked linear predictive coding, wavelet transforms, and Huffman coding to compress clinical scans. More recently, the field has been transformed by learned compression, in which neural networks are trained end to end to transform and entropy-code images, with systems such as variational models with scale hyperpriors, discretized Gaussian mixture likelihoods with attention modules, unevenly grouped space-channel contextual adaptive coding, and latent diffusion approaches for compression all pushing the state of the art. Against this backdrop, the appeal of the new schemes is their computational simplicity: RIFD, Huffman tree decomposition, and LZW all involve elementary arithmetic and table lookups rather than deep network inference, which makes them attractive for hardware with tight power and processing budgets.

The technical logic of why the hybrids work is worth unpacking. Lossless entropy coders are bounded by the entropy of their input: the more skewed and repetitive the symbol distribution, the fewer bits per symbol they need. A raw 8-bit grayscale image often uses most of its 256 possible values with a relatively flat distribution, which limits any lossless coder working alone. RIFD deliberately flattens fine distinctions between neighboring intensities, concentrating probability mass on a smaller set of representative values. For Huffman-style coding, this means shorter average code lengths and, with LM-DH, a smaller tree structure to serialize. For dictionary coding, it means the same intensity values recur in predictable spatial patterns, so the LZW dictionary fills with long, frequently reused phrases. The lossy step thus acts as an amplifier for the lossless stage, and the two designs test two different ways of cashing in that amplification.

The practical implications reach across several domains. Telemedicine systems transmitting diagnostic images over rural networks, remote sensing platforms downlinking satellite imagery, digital archives preserving vast image collections, and consumer services serving billions of photos all face the same trade-off between bandwidth, storage cost, and image fidelity. A method that can be tuned by adjusting a single quantization parameter, that runs quickly on ordinary hardware, and that guarantees no hidden loss beyond the explicitly chosen quantization offers a predictable and auditable alternative to opaque neural codecs. The fact that the study used only public datasets, including CLIC, USC-SIPI, Kodak, and Set11, and performed all experiments in a widely available MATLAB release further lowers the barrier for independent verification and adoption.

There are, of course, boundaries to what the study claims. The reported gains are averages over 20 standard test images in three bit-depth formats, and performance on any particular image class, such as noisy medical scans or highly textured natural photographs, would need separate validation. The comparison baselines are the author’s own RIFD plus Huffman configuration rather than the newest learned codecs, so the schemes should be understood as an efficient classical alternative rather than a replacement for state-of-the-art neural compression at the very highest performance frontier. Nevertheless, the paper demonstrates a clear and reproducible principle: a carefully designed lossy preprocessing step can unlock substantial extra performance from decades-old lossless algorithms, and the choice of the lossless partner, whether a decomposed Huffman tree or an adaptive LZW dictionary, meaningfully shapes where the biggest wins appear. As image volumes continue to explode, such pragmatic hybrids may prove that some of the best new tools for an old problem are clever recombinations of proven ones.

Subject of Research: Hybrid lossy-lossless image compression using RIFD preprocessing with Huffman tree decomposition and LZW coding

Article Title: Hybrid image compression techniques based on RIFD with LM-DH and LZW

Article References: Otair, M. (2026). Hybrid image compression techniques based on RIFD with LM-DH and LZW. Multimedia Tools and Applications, 85(9), Article 741. https://doi.org/10.1007/s11042-026-21902-6

Image Credits: AI Generated

DOI: 10.1007/s11042-026-21902-6

Keywords: image compression, hybrid compression, RIFD, Huffman coding, LM-DH, LZW, lossless coding, lossy compression, entropy coding, MATLAB, grayscale images, Multimedia Tools and Applications

The core insight of the work is that noise identification and noise removal are two distinct problems that benefit from different tools. The first stage of the proposed pipeline applies singular value decomposition, a fundamental technique of linear algebra that factors any matrix into a product of three simpler matrices. When an image is treated as a matrix of pixel intensities, SVD exposes its underlying structure through singular values, which capture the dominant energy of the image content. Salt-and-pepper corruption disturbs this structure in characteristic ways, because impulsive pixels contribute abrupt, high-magnitude outliers that the singular spectrum does not smoothly accommodate. By examining the decomposition, the researchers can flag pixels whose behavior deviates from the structured representation of the scene, effectively producing a map of suspected noise locations.

What distinguishes this method from earlier hybrid designs is what happens to the SVD output next. Rather than using the decomposition results solely as a direct detection criterion, the team converts them into a structured dataset that can be learned from. Each sample in the dataset encodes the diagnostic information generated by the singular value analysis for a given pixel, together with its known true status as noisy or clean. This transformation of a deterministic mathematical procedure into training data is the step that brings machine learning into the loop. A decision tree classifier is then trained on this dataset. Decision trees are among the most interpretable models in machine learning: they partition the feature space through a hierarchy of binary decisions, each learned automatically from the training examples, and they ultimately classify each new pixel as corrupted or uncorrupted with a chain of transparent rules.

The choice of a decision tree is significant for a denoising application. Deep neural networks, which dominate much of the modern image restoration literature, can deliver impressive results but demand enormous training sets, substantial computational resources, and careful architectural tuning, and their decisions remain largely opaque. A decision tree, by contrast, trains rapidly on a modest dataset, requires no specialized hardware, and yields a model whose reasoning can be inspected. For deployment scenarios where processing must occur on ordinary hardware, or where practitioners need to understand and trust why a pixel was flagged, this simplicity becomes a genuine advantage rather than a compromise. The classifier inherits the discriminating power of the SVD features while adding the adaptivity that a fixed threshold rule lacks.

Once the decision tree has identified which pixels are corrupted, the second half of the pipeline takes over: replacing the flagged values with plausible estimates. For this, the authors propose an improved median filter that they call the Frequency Deviation Median Filter, or FDMF. Median filtering is the classical remedy for impulse noise because the median of a neighborhood is inherently robust to extreme outliers; a scattering of pure black and pure white values does not drag the median the way it drags a mean. Conventional median filters, however, apply their operation indiscriminately and can smooth away fine detail. Variants developed over decades, from the standard median filter to adaptive, directional, and decision-based medians, have sought to limit filtering to corrupted pixels and to choose replacement values more intelligently. The FDMF continues this lineage by using the deviation of frequencies within a processing window to guide the replacement of noisy pixels, aiming to preserve edges and textures while filling in the damaged values.

A particularly valuable contribution of the paper extends beyond the algorithm itself: the researchers explicitly document the factors that influence how well such a machine learning based denoising system performs. Two factors receive detailed attention. The first is the number of images selected to construct the training dataset. Because the decision tree learns the signature of noise exclusively from the examples it sees, an insufficient or unrepresentative training pool limits generalization, while the study shows that dataset composition plays a direct role in optimizing the method’s performance. The second factor is the direction of training the dataset, meaning the orientation in which training data are extracted and presented to the classifier. These findings matter for anyone reproducing or adapting the method, because two implementations of the same algorithm can yield noticeably different results depending on how these design choices are made.

To validate the approach, the authors carried out experiments on a diverse set of images: a black image, a white image, eleven natural images, and additionally medical and satellite imagery. Testing across such varied content is essential, because a filter that works well on landscapes may falter on the smooth gradients of medical scans or the repetitive textures of aerial views. The images were subjected to salt-and-pepper noise at multiple densities, allowing the team to evaluate performance not just in mild conditions but in the high-density regimes where most classical filters break down. Both qualitative visual inspection and quantitative metrics were used, with comparisons against existing denoising methods drawn from the extensive literature on median filter variants, adaptive algorithms, and earlier SVD-based hybrid techniques.

The reported results show that the proposed method delivers promising outcomes relative to the competing approaches, with the advantage becoming most pronounced as noise density increases. This pattern makes intuitive sense. At low noise levels, even simple filters can restore images adequately, and differences between methods are marginal. At high densities, where a large fraction of pixels has been overwritten and clean neighborhoods are scarce, the ability to detect corruption reliably before filtering becomes decisive. The SVD-driven detection feeding a trained decision tree provides exactly that discriminative first stage, allowing the FDMF to operate on a precisely identified set of corrupted pixels rather than spreading its efforts across the whole image. The researchers note that the method was validated through these experiments and that comparisons, both qualitative and quantitative, supported its effectiveness, especially for higher noise densities.

The study also situates itself within a long trajectory of research. The lineage includes landmark work on directional weighted median filters, pixel-density based methods, trimmed and winsorized mean filters, adaptive frequency medians, and algebraic approaches using tropical mathematics, several of which involve overlapping author groups. Earlier efforts already incorporated machine learning, including decision-tree-based denoising and directional switching median filters combined with learning methods, and more recent literature has explored convolutional neural networks for magnetic resonance images, encoder-decoder networks for mixed Gaussian and impulse noise, and PDE-informed models. What the new work adds is a careful articulation of the dataset creation process itself, treating the construction of training data from SVD outputs, and the choice of how many images to use and in which direction to train, as first-class design decisions whose effects are measured rather than assumed.

The practical implications reach across the fields where image quality is critical. Medical diagnostics cannot afford artifacts that obscure anatomical structure; satellite and aerial imagery underpins environmental monitoring and security; and industrial vision systems rely on clean inputs for accurate measurement. A denoising pipeline that is computationally light, interpretable, and robust at high noise densities offers a credible alternative to heavyweight deep learning models in such settings. The authors’ demonstration that training-set size and training direction materially affect performance gives practitioners concrete guidance for tuning the system. The datasets analyzed in the study were drawn from publicly available repositories, including the USC-SIPI Image Database, supporting reproducibility. As digital imaging continues to expand into noisier acquisition environments, hybrid frameworks of this kind, marrying the mathematical rigor of decomposition methods with the adaptive judgment of machine learning, suggest a productive middle path between classical filtering and modern deep networks.

Subject of Research: Machine learning based image denoising of salt-and-pepper noise using singular value decomposition and median filtering

Article Title: Extended machine learning method and factors that influence the performance of image denoising process

Article References: Extended machine learning method and factors that influence the performance of image denoising process. (n.d.). https://doi.org/10.1007/s11042-026-21904-4

Image Credits: AI Generated

DOI: 10.1007/s11042-026-21904-4

Keywords: image denoising, salt-and-pepper noise, singular value decomposition, decision tree, machine learning, median filter, Frequency Deviation Median Filter, digital image processing, noise detection, grayscale images, medical imaging, satellite imagery