Geometry-Aware Multi-view Malware Detection Using Gromov–Wasserstein Fusion

Intrusion Detection Systems (IDS) are becoming increasingly challenged with the continuous evolution of modern malware that is obscured, using multiple methods to bypass detection and even being able to deceive the detection base solely based on signatures. The use of single-view or static detection models is often nonproductive because they cannot perceive the various behavioral patterns and memory-level patterns shown during runtime. This situation motivates the development of multi-view geometry-aware fusion schemes. In this study, we present GSTF, a leakage-free IDS pipeline that merges network-flow telemetry and memory-forensics artifacts. The process uses Gromov–Wasserstein registration to harmonize different feature spaces, followed by ridge regression propagation and discriminative augmentation, which maintain the class-conditional structure. Together with a class-weighted Random Forest classifier, a PCA–NCA embedding promotes separability, while a calibrated decision rule ensures maximum recall under the precision constraint. The newly proposed GSTF framework on the large-scale, dual-view BCCC-Mal-NetMem-2025 dataset attained an accuracy of 99.84%, precision of 99.84%, and recall of 100%. These findings illustrate that geometry-consistent multi-view fusion significantly enhances the robustness of IDS against very high-dimensional and real-world malware threats.