MalCAFF: A Cross Attention-Based Feature Fusion Framework for Malware Classification

Malware detection faces growing challenges due to sophisticated obfuscation techniques that undermine the robustness of single-modal approaches relying solely on static code analysis or dynamic behavioral profiling. To address this issue, we propose MalCAFF, a cross-attention-based framework for fine-grained fusion of static assembly semantics and dynamic API behaviors. Static features are refined through program slicing to preserve critical semantics, while dynamic behaviors are represented by API Semantic Block Sequence (ABS), which aggregate API calls into parameter-aware, semantically enriched units aligned with static functions. A Cross Attention-based Feature Enhancement (CAFE) module then achieves bidirectional semantic complementation across modalities. Furthermore, contrastive pre-training mitigates inter-modal distributional discrepancies and enhances generalization. Extensive experiments on the VirusShare dataset demonstrate that MalCAFF outperforms state-of-the-art methods.