As zero-day Android malware attacks grow more sophisticated, recent research highlights the effectiveness of using image-based representations of malware bytecode to detect previously unseen threats. However, existing studies often overlook how image type and resolution affect detection and ignore valuable textual data in Android Application Packages (APKs), such as permissions and metadata, limiting their ability to fully capture malicious behavior. The integration of multimodality, which combines image and text data, has gained momentum as a promising approach to address these limitations. This paper proposes a multimodal deep learning framework integrating APK images and textual features to enhance Android malware detection. We systematically evaluate various image types and resolutions across different Convolutional Neural Networks (CNN) architectures, including VGG, ResNet-152, MobileNet, DenseNet, EfficientNet-B4, and use LLaMA-2, a large language model, to extract and annotate textual features for improved analysis. The findings demonstrate that RGB images at higher resolutions (e.g., 256x256, 512x512) achieve superior classification performance, while the multimodal integration of image and text using the CLIP model reveals limited potential. Overall, this research highlights the importance of systematically evaluating image attributes and integrating multimodal data to develop effective malware detection for Android systems.

翻译：随着零日Android恶意软件攻击日益复杂化，近期研究凸显了利用恶意软件字节码的图像表示来检测未知威胁的有效性。然而，现有研究往往忽视图像类型和分辨率对检测的影响，并忽略了Android应用包（APK）中宝贵的文本数据（如权限和元数据），这限制了其全面捕捉恶意行为的能力。融合图像与文本数据的多模态方法作为一种解决这些局限性的可行途径，已获得广泛关注。本文提出了一种集成APK图像与文本特征的多模态深度学习框架，以增强Android恶意软件检测。我们系统评估了不同卷积神经网络（CNN）架构（包括VGG、ResNet-152、MobileNet、DenseNet、EfficientNet-B4）下的多种图像类型与分辨率，并采用大型语言模型LLaMA-2提取和标注文本特征以改进分析。研究结果表明，较高分辨率（如256x256、512x512）的RGB图像能实现更优的分类性能，而使用CLIP模型进行图像与文本的多模态融合则显示出有限的潜力。总体而言，本研究强调了系统评估图像属性并整合多模态数据对于开发有效的Android系统恶意软件检测方法的重要性。