Pretrained ResNet1D-152 for classing malware signals as described by this paper.

The full code bases, including training and evaluation proceedure, is available here.

Malware signals are 1D representations of the bytecode of an executable which act as an alternative to byteplot images as input to machine learning models. These signals can be statically extracted from various formated (e.g. EXE, APK), and used to train a 1D CNN for malware classification. By using a 1D representation of the binaries, more information from the original binary is preserved and the addition of spurious spatial correlation is avoided, resulting in improved downstream model performance. A comparison of malware signals with byteplot images is shown below:

The model is a ResNet152 model with a deep stem and squeeze-and-excitation layers which has been adapted to operate on 1D signals by replacing the 2D convolutions with 1D convolutions, and squaring the kernel sizes and stride values.

ResNet1DV2-152D-SE outperforms all existing 2D models on MalNet binary, type, and family level classification:

@misc{wilkie2025signalbasedmalwareclassificationusing,
    title={Signal-Based Malware Classification Using 1D CNNs}, 
    author={Jack Wilkie and Hanan Hindy and Ivan Andonovic and Christos Tachtatzis and Robert Atkinson},
    year={2025},
    eprint={2509.06548},
    archivePrefix={arXiv},
    primaryClass={cs.CR},
    url={https://arxiv.org/abs/2509.06548}, 
}