dorsal/arxiv
View SchemaIntegrating APK Image and Text Data for Enhanced Threat Detection: A Multimodal Deep Learning Approach to Android Malware
| Authors | Md Mashrur Arifin, Maqsudur Rahman, Nasir U. Eisty |
|---|---|
| Categories | |
| ArXiv ID | 2601.08959vv1 |
| URL | https://arxiv.org/abs/2601.08959 |
| License | http://creativecommons.org/licenses/by/4.0/ |
Abstract
As zero-day Android malware attacks grow more sophisticated, recent research highlights the effectiveness of using image-based representations of malware bytecode to detect previously unseen threats. However, existing studies often overlook how image type and resolution affect detection and ignore valuable textual data in Android Application Packages (APKs), such as permissions and metadata, limiting their ability to fully capture malicious behavior. The integration of multimodality, which combines image and text data, has gained momentum as a promising approach to address these limitations. This paper proposes a multimodal deep learning framework integrating APK images and textual features to enhance Android malware detection. We systematically evaluate various image types and resolutions across different Convolutional Neural Networks (CNN) architectures, including VGG, ResNet-152, MobileNet, DenseNet, EfficientNet-B4, and use LLaMA-2, a large language model, to extract and annotate textual features for improved analysis. The findings demonstrate that RGB images at higher resolutions (e.g., 256x256, 512x512) achieve superior classification performance, while the multimodal integration of image and text using the CLIP model reveals limited potential. Overall, this research highlights the importance of systematically evaluating image attributes and integrating multimodal data to develop effective malware detection for Android systems.
{
"annotation_id": "7ebc9df0-7c83-47a1-bd6e-65c33048cbf7",
"date_created": "2026-02-17T05:53:20.016000Z",
"date_modified": "2026-02-17T05:53:20.016000Z",
"file_hash": "b3a9dea2892872b61f7cecd552eb56f099a52af9bde7ae4483c96808fc8a4a74",
"private": false,
"record": {
"abstract": "As zero-day Android malware attacks grow more sophisticated, recent research highlights the effectiveness of using image-based representations of malware bytecode to detect previously unseen threats. However, existing studies often overlook how image type and resolution affect detection and ignore valuable textual data in Android Application Packages (APKs), such as permissions and metadata, limiting their ability to fully capture malicious behavior. The integration of multimodality, which combines image and text data, has gained momentum as a promising approach to address these limitations. This paper proposes a multimodal deep learning framework integrating APK images and textual features to enhance Android malware detection. We systematically evaluate various image types and resolutions across different Convolutional Neural Networks (CNN) architectures, including VGG, ResNet-152, MobileNet, DenseNet, EfficientNet-B4, and use LLaMA-2, a large language model, to extract and annotate textual features for improved analysis. The findings demonstrate that RGB images at higher resolutions (e.g., 256x256, 512x512) achieve superior classification performance, while the multimodal integration of image and text using the CLIP model reveals limited potential. Overall, this research highlights the importance of systematically evaluating image attributes and integrating multimodal data to develop effective malware detection for Android systems.",
"arxiv_id": "2601.08959",
"authors": [
"Md Mashrur Arifin",
"Maqsudur Rahman",
"Nasir U. Eisty"
],
"categories": [
"cs.CR",
"cs.SE"
],
"license": "http://creativecommons.org/licenses/by/4.0/",
"title": "Integrating APK Image and Text Data for Enhanced Threat Detection: A Multimodal Deep Learning Approach to Android Malware",
"url": "https://arxiv.org/abs/2601.08959",
"version": "v1"
},
"schema_id": "dorsal/arxiv",
"source": {
"execution_id": "787efe69-e2d3-4732-9621-d33e7b81ac5c",
"id": "arXiv Dataset",
"type": "Model",
"variant": "snapshot-2026-01-17",
"version": "0.1.0"
},
"user_id": 1000002
}