PyraMal: Byte-Level Malware Detection and Classification via Pyramid Feature Map

The emergence of automated tools (e.g., polymorphic and metamorphic engines, packers, and genetic programming) has triggered an explosive proliferation of malware and its variants, posing a significant cybersecurity threat. To effectively address the urgent challenge of precise malware detection and classification, enabling security researchers and incident responders to promptly implement defensive measures against malware intrusions and mitigate associated damages, researchers have developed techniques such as API call analysis, permission analysis, opcode analysis, and visual image texture analysis. However, these approaches often exhibit platform-specific limitations, require specialized knowledge of PE/APK file formats, assembly languages, or low-level operating system mechanisms, and lack cross-platform compatibility. This paper introduces PyraMal, a novel malware visualization framework featuring a pyramid-structured feature distribution. PyraMal models binary bytes as a Markov chain, computes a state transition frequency matrix, and applies the Dual-threshold Truncation - Log Hierarchical Transformation Algorithm (DT-LHTA) to construct a pyramid-structured feature map for malware detection and classification. Extensive experiments conducted on six cross-platform malware benchmark datasets—CICAndMal2017Det, CICMal-Droid2020Det, Malimg, BIG-2015, CICMalDroid2020Cls, and MOTIF—demonstrate that the proposed method outperforms state-of-the-art approaches while exhibiting robustness against malware variants employing evasion techniques (e.g., packers, encryption obfuscation). Notably, the method demonstrates superior aging resistance for Android malware detection. Ablation studies further confirm that the stacking of pyramid-structured feature maps (via DT-LHTA) significantly enhances malware detection and classification performance.