Abstract: To address the problem of exponential growth in malware and variants, and the limited capability of traditional detection methods to identify unknown threats, this paper proposes a MobileNetV2_AD detection method combining "multimodal visualization + lightweight" approaches. The main feature is the fusion of multi-source semantic visual information, representing byte entropy, disassembled instruction streams, and API call sequences as RGB three-channel images to achieve "one image integrating three domains." This reveals the complementary discriminative patterns of different semantic modalities in the image space, offering finer-grained feature extraction compared to grayscale images. Secondly, the lightweight backbone with strong scale perception incorporates Atrous Spatial Pyramid Pooling (ASPP) into MobileNetV2, enhancing the model's receptive field and multi-scale feature extraction capabilities. Additionally, a "category-feature" dual decoupled distillation approach is employed, using ResNeXt50 as the teacher model to simultaneously transfer macro classification logic and micro feature distributions. This resolves the "precision-generalization" trade-off issue in lightweight student models, resulting in an 11.7% increase in F1 score on unknown family samples after distillation. Finally, cross-dataset performance validation is conducted on the Kaggle (400 GB) and DataCon (latest attack-defense competition) public benchmarks, achieving accuracy rates of 96.41% and 98.68% respectively for MobileNetV2_AD, which is 6.31% and 4.21% higher than the original MobileNetV2. The inference speed reaches 280 samples per second, meeting the real-time detection requirements of terminal devices. The experimental results demonstrate that the proposed method significantly improves malware detection effectiveness in resource-constrained scenarios, providing an effective technical solution for cybersecurity defense.

摘要： 针对恶意软件数量及变种指数级增长，且传统检测方法对未知威胁识别能力有限的问题，提出结合“多模态图像化+轻量化”的MobileNetV2_AD检测方法。主要特点是多源语义视觉融合，将字节熵、反汇编指令流与API 调用序列表征为RGB三通道图像，实现“一图融三域”，揭示不同语义模态在图像空间的互补判别规律，较灰度图挖掘特征粒度更细；其次，轻量骨架强尺度感知，在MobileNetV2中植入空洞空间金字塔池化(ASPP)，提升模型感受野，增强多尺度特征提取能力。并且采用“类别-特征”双解耦蒸馏，以ResNeXt50为教师，将宏观分类逻辑与微观特征分布同步迁移，解决轻量学生“精度-泛化”跷跷板难题，蒸馏后学生模型在未知家族样本上F1提升11.7%。最后，进行跨数据集性能验证，在Kaggle（400 GB）与DataCon（最新攻防赛）双公开基准上，MobileNetV2_AD准确率分别达96.41%与98.68%，较原始MobileNetV2提升6.31%与4.21%，且推理速度达280样本/秒，满足终端实时检测需求。实验结果表明，所提方法在资源受限场景下，显著提升了恶意软件检测效果，为网络安全防护提供了有效的技术方案。