MalwareFormer：字节级 Transformer 恶意软件检测框架
Bytes to Threats: Byte-Sequence Transformer For Malware Detection
MalwareFormer 直接啃二进制字节就能抓恶意软件，不用逆向分析，准确率 98.35%，误报不到 2%。
arXiv 论文提出 MalwareFormer，一个基于 Transformer 的字节级恶意软件检测框架，直接处理可执行文件的原始字节，无需人工特征工程或领域知识。传统方案依赖静态或动态分析的手工特征，需要专用工具和耗时分析，CNN 类方法又难以捕捉可执行文件内的长距离依赖。MalwareFormer 在分类指标上达到 98.35% 准确率、98.32% 宏 F1，误报率仅 1.94%，全面超过基线方法。
Bytes to Threats: Byte-Sequence Transformer For Malware Detection
Existing malware detection approaches heavily rely on handcrafted features derived from static or dynamic analysis of the executable files. These methods require specialized domain expertise, dedicated analysis tools, and time-consuming analysis, which limits their scalability and robustness in the face of the increasing complexity and diversity of modern malware. Consequently, there is a growing interest in approaches that operate directly on raw bytes, which contain rich semantic and structural information. However, capturing long-range dependencies within executable files remains challenging for conventional static and CNN-based methods. This paper presents MalwareFormer, a transformer-based, byte-level malware detection framework that operates directly on raw bytes, without requiring domain knowledge or feature extraction. MalwareFormer achieves an accuracy of 98.35%, a balanced accuracy of 98.32%, a macro-F1 of 98.32%, and a false positive rate of 1.94%, outperforming both baselines across all threshold-dependent classification metrics and demonstrating that transformers provide a powerful and scalable approach for byte-level malware detection.
