The core idea behind the framework, published in Cluster Computing, is to convert both static and dynamic analysis features of an application into two distinct two-dimensional image formats. The first is a conventional 2D grayscale image, in which extracted feature vectors are reshaped into pixel matrices so that patterns of malicious behavior appear as visual textures. The second is a QR code image representation, a more unusual encoding that arranges feature information into the blocky, high-contrast structure familiar from quick-response codes. The researchers trained separate Vision Transformer models on each image type. A Vision Transformer works by slicing an image into small patches, treating each patch as a token, and then using self-attention mechanisms to model the relationships between all patches simultaneously. This allows the model to capture long-range spatial dependencies that convolutional networks, which process images through local filters, can miss.

Once the two ViT models had been trained, the team did not simply take their final classification verdicts. Instead, they extracted the spatial pooling features from the deeper layers of each network, the compact numerical summaries that the transformers build up as they interpret the images. These feature sets, one derived from grayscale images and one from QR code images, were then combined into a single fused representation. The logic is that the two image encodings emphasize different aspects of an application’s behavior, so a classifier that sees both should have a richer picture than one that sees either alone. Feature fusion of this kind has become a recurring theme in malware research precisely because no single view of a program, whether permissions, API calls, or runtime behavior, tells the whole story.

The fused feature vector, however, contained a mixture of informative and redundant attributes, and feeding everything into a classifier can dilute the signal. To address this, the researchers applied Recursive Feature Elimination, an iterative selection technique that trains a model, ranks the features by importance, discards the weakest ones, and repeats the process until only the most discriminative subset remains. This RFE-optimized selection step proved to be one of the decisive ingredients of the framework. By pruning away noise before classification, it sharpened the boundaries between benign and malicious samples and reduced the computational burden of the final decision stage.

For the final classification, the team deployed a majority-voting ensemble, a strategy with a long pedigree in machine learning. Rather than trusting a single algorithm, several different machine learning classifiers each cast a vote on whether a sample is malicious, and the majority decision prevails. Ensembles of this kind tend to be more robust than individual models because the errors of one classifier can be corrected by the others, provided their mistakes are not perfectly correlated. Combined with the fused and filtered features, the voting ensemble delivered the framework’s headline result: an overall detection accuracy of 98.72 percent, outperforming the standalone Vision Transformer models and every single-modality configuration the authors tested.

The ablation-style comparison embedded in the results carries an important message for the field. Neither the grayscale pathway nor the QR code pathway alone matched the multimodal system, and the gains from fusing features and applying RFE-based selection were described by the authors as substantial contributions to the overall performance. In other words, the improvement did not come from a single clever trick but from the deliberate stacking of complementary techniques: two image representations, two transformer encoders, feature fusion, disciplined feature selection, and ensemble voting. Each layer of the pipeline removes a different weakness of the layer before it.

The study situates itself within a rapidly growing literature on image-based malware detection. Previous work has explored converting bytecode, permission lists, and network traffic into images for convolutional neural networks, and recent efforts have introduced transformer architectures such as ViTDroid for attending to malicious behavior in Android binaries. Others have fused multivariate features or applied reinforcement learning to feature selection. The Turkish team’s contribution is to bring these threads together in a single multimodal pipeline and to demonstrate, with a publicly available dataset, that the combination outperforms its individual components. The dataset used in the study can be accessed through the official UNB CIC website and Kaggle, a decision that supports reproducibility and allows other groups to benchmark against the reported results.

The practical implications are considerable. Because the framework relies on static and dynamic analysis features rather than on signatures of known malware families, it has the potential to generalize to new and obfuscated threats that signature databases have never seen. The QR code representation in particular is a novel twist, building on earlier work by one of the co-authors on cyber attack detection using QR code images with lightweight deep learning models. Encoding security-relevant features into a format designed for machine readability appears to produce distinctive visual signatures of malicious behavior that transformers can exploit effectively. For mobile security vendors, the findings suggest that multimodal image representations could become a standard component of next-generation detection engines, especially as transformer models continue to be optimized for deployment on resource-constrained platforms.

Challenges remain before such systems reach production. Image-based approaches depend on the quality and completeness of the underlying feature extraction, and adversaries who understand the encoding scheme may attempt to craft features that evade visual detection. The computational cost of running two Vision Transformer models per application also needs to be weighed against the latency requirements of app store scanning and on-device security tools. Nevertheless, the 98.72 percent accuracy reported by Başaran, Alaca, and Okucu represents a compelling data point in the ongoing effort to stay ahead of Android malware, and it underscores a broader trend in cybersecurity: the most effective defenses increasingly come not from looking harder at code, but from teaching machines to see it in entirely new ways.

Subject of Research: Multimodal Vision Transformer-based Android malware detection using 2D grayscale and QR code image representations

Article Title: Multimodal vision transformer framework for android malware detection via 2D grayscale and QR code ımage representations, feature fusion, and RFE-optimized majority voting

Article References: Başaran, E., Alaca, Y., & Okucu, Ö. (2026). Multimodal vision transformer framework for android malware detection via 2D grayscale and QR code ımage representations, feature fusion, and RFE-optimized majority voting. Cluster Computing, 29(15), Article 834. https://doi.org/10.1007/s10586-026-06667-9

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06667-9

Keywords: Android malware detection, Vision Transformer, QR code images, grayscale images, feature fusion, Recursive Feature Elimination, majority voting, machine learning, cybersecurity, deep learning, ensemble methods, mobile security

The core insight behind BTFA is that human interaction with a mobile device carries a behavioral signature as distinctive as a fingerprint, but one that requires no special hardware, no scanning, and no additional action from the user. When someone types a password on a touchscreen, the rhythm of their taps, the pressure they apply, the size of their touch contacts, and the micro-movements of the device in their hand all combine into a pattern that is difficult for an impostor to replicate even when the password itself has been compromised. BTFA captures these signals during the ordinary act of logging in and feeds them to a machine learning model that decides, in real time, whether the observed behavior matches the enrolled owner. If it does, the login proceeds seamlessly; if it does not, the system can demand additional verification or block access entirely.

Technically, the researchers turned to a Long Short-Term Memory network, a class of recurrent neural architecture well suited to sequential data. Touch gestures and sensor readings arrive as time series, and LSTM networks excel at learning the temporal dependencies within such sequences—the way one tap flows into the next, how accelerometer and gyroscope values oscillate as a hand steadies a phone. The team trained separate models on touch interaction data and on motion sensor data collected during login, allowing them to compare which modality carried the stronger authentication signal. This design choice matters because behavioral biometrics are inherently noisy: a user may be seated on a train one day and standing in a corridor the next, and the system must tolerate that natural variability while still rejecting an attacker with surgical precision.

To evaluate the approach under realistic conditions rather than in a sterile laboratory setting, the team conducted a field study using a custom-developed mobile application with registration and login interfaces. Participants used the app in their daily lives, generating a substantial corpus of 38,542 behavioral samples that were used for model training and validation. Field data of this kind is considerably harder to model than curated laboratory recordings, precisely because it contains the posture changes, device swaps, and environmental distractions of real-world use. The scale of the dataset also matters for deep learning: LSTM networks require enough examples to generalize across sessions and days rather than memorizing individual recordings, and the collected volume gave the models that opportunity.

The results revealed a striking asymmetry between the two behavioral modalities. The model trained on sensor data—accelerometer and gyroscope readings captured while the user interacted with the login screen—achieved an area under the ROC curve of 97.28 percent, with an equal error rate of just 6.84 percent. The touch gesture model, by contrast, reached 78.67 percent AUC with an equal error rate of 28.48 percent. The researchers attribute the gap primarily to the stability of motion patterns: the way a person’s hand trembles, tilts, and counterbalances during typing is remarkably consistent across sessions, whereas touch characteristics such as tap duration and swipe geometry fluctuate more with context, device position, and even mood. In practical terms, the sensor channel alone provides a second authentication factor strong enough to meaningfully complement a password.

Equal error rate deserves a moment of explanation, because it is the figure of merit by which biometric systems are judged. It is the point at which the system’s false rejection rate—legitimate users wrongly locked out—equals its false acceptance rate—impostors wrongly waved through. A lower EER means the threshold can be tuned so that both errors are rare simultaneously. An EER of 6.84 percent for the sensor-driven model means that security administrators can calibrate BTFA to reject the vast majority of attackers while inconveniencing only a small fraction of legitimate users, a trade-off that compares favorably with many published behavioral biometric systems evaluated under similar conditions.

What makes BTFA particularly relevant for Identity and Access Management systems is its resistance to phishing and its zero-burden design. Phishing remains one of the most successful attack vectors in enterprise environments: a user is tricked into entering credentials on a fraudulent site, handing the attacker everything needed to impersonate them. But stolen credentials alone are useless against BTFA, because the attacker logging in from their own device or an automated script will not reproduce the victim’s hand movements and sensor signatures. Unlike SMS one-time passwords, which can be intercepted through SIM swapping, or push-based approval, which users can be manipulated into accepting through fatigue attacks, behavioral verification cannot be forwarded, replayed, or socially engineered out of the user. The second factor exists only in the physical act of the legitimate owner logging in.

The user-experience implications are equally significant. Surveys of multi-factor adoption consistently find that friction is the primary reason users disable or circumvent second factors, and organizations under regulatory pressure to enforce MFA often face pushback when the added security slows daily workflows. BTFA inverts this equation: the second factor is collected passively as a byproduct of the login the user was going to perform anyway. There is no code to read, no token to carry, no notification to approve. The researchers emphasize that this reduction in user dependency on the MFA solution is especially valuable in IAM applications where critical and confidential information is accessed and shared, since those environments demand both stringent security and sustained user cooperation.

The work builds on a growing body of research into behavioral biometrics and continuous authentication on mobile devices, and the authors position BTFA as a pragmatic deployment model for that science—one that targets the specific, high-value moment of login rather than demanding background monitoring throughout a session. The study’s limitations are those of the field generally: behavioral patterns can drift over time as users’ habits change, models must be retrained or adapted to accommodate new devices, and privacy considerations around collecting motion data require careful governance. Yet the field study’s results suggest that the technical barriers are surmountable with data already being generated by every tap. As organizations worldwide retire passwords in favor of phishing-resistant authentication, BTFA offers a vision of security that asks nothing extra of the user—because the strongest proof of identity, it turns out, may simply be the way you hold your phone.

Subject of Research: Behavioral biometric two-factor authentication for Identity and Access Management systems

Article Title: BTFA: Behavioral Two Factor Authentication For IAM Systems

Article References: Mahfouz, A., ALMouh, K., Samrouth, K., Bakir, N., & Chalhoub, G. (2026). BTFA: Behavioral Two Factor Authentication For IAM Systems. Mobile Networks and Applications. https://doi.org/10.1007/s11036-026-02515-7

Image Credits: AI Generated

DOI: 10.1007/s11036-026-02515-7

Keywords: behavioral biometrics, two-factor authentication, IAM systems, LSTM, touch gestures, sensor data, smartphone security, phishing resistance, user authentication, machine learning, mobile security, identity and access management