Highlights ViPER: Vision-based Packing-Aware Encoder for Robust Malware Detection Fatima Qaiser, Bisma Tahir, Muhammad Abid Mughal, Nauman Shamim • ViPER jointly learns malware classification and packing detection from byteplots • Residual gating mechanism conditions malware predictions on inferred packing state • LoRA-adapted ViT-B/14 trains only 1.49M of 88.66M parameters efficiently • Achieves ROC-AUC of 0.9260 and AUPR of 0.9279 on 200,000 PE byteplot images
arXiv:2606.12949v1 [cs.CR] 11 Jun 2026
• Packing detection auxiliary head attains AUC of 0.9949 on the test set
ViPER: Vision-based Packing-Aware Encoder for Robust Malware Detection Fatima Qaisera , Bisma Tahira , Muhammad Abid Mughala,∗ and Nauman Shamima a Department of Computer & Information Sciences, Pakistan Institute of Engineering & Applied Sciences (PIEAS), Islamabad, Pakistan
ARTICLE INFO
ABSTRACT
Keywords: malware detection vision transformer packing detection multi-task learning LoRA byteplot visualization cybersecurity
Visualization-based malware detection maps raw binary bytes to grayscale images and applies learned visual classifiers, providing an evasion-resistant and disassembly-free alternative to conventional analysis pipelines. However, executable packing remains a critical failure mode: packed binaries produce high-entropy images that obscure the structural patterns these models rely on. Because packing is also prevalent in benign software (e.g., for compression or copy protection), packing state alone is not a reliable indicator of maliciousness, and existing approaches do not address this challenge within a unified supervised framework. We present ViPER, a Vision-based Packing-Aware Encoder for Robust malware detection. ViPER builds on a LoRA-adapted ViT-B/14 backbone with a dual-head architecture that jointly learns malware classification and packing detection. A packing-aware gating mechanism conditions malware predictions on the inferred packing state, enabling distinct decision boundaries for packed and unpacked inputs. To address packing label skew during training, we employ frequency-weighted losses with stratified sampling over joint class-packing strata. Evaluated on 200,000 Windows PE byteplot images, ViPER achieves a balanced accuracy of 0.8521, ROC-AUC of 0.9260, and AUPR of 0.9279, outperforming representative state-of-the-art baselines across all primary metrics, while attaining a packing detection AUC of 0.9949.
1. Introduction Windows malware authors have long understood that detection is fundamentally a representation problem. If a defender cannot reliably extract features from an executable, no classifier, however sophisticated, can compensate for that upstream failure.Packing targets this weakness directly: when a binary’s payload is compressed or encrypted prior to delivery, static disassembly returns little more than an unstructured byte sequence, and the import tables, string literals, and control-flow patterns that conventional pipelines rely on become unavailable (Lyda and Hamrock, 2007). Dynamic analysis can partially recover this information at runtime, yet the computational cost per sample makes it impractical at deployment scale, and samples that detect sandbox conditions simply withhold their payloads until they execute in a genuine environment. Binary visualization, introduced by Nataraj et al. (2011), takes a different approach. Rather than parsing executable structure, it assigns each byte a pixel intensity value and arranges these values row by row into a two-dimensional grid, producing what is commonly called a byteplot. A learned classifier then operates directly on this image. Because no structural parsing is involved, the representation remains tolerant of encryption without modification, and malware families tend to produce consistent texture signatures in byteplot space that persist across repackaging. However, this framing does not account for the visual heterogeneity that packing introduces. A packed binary, ∗ Corresponding author
[email protected] (F. Qaiser); [email protected] (B. Tahir); [email protected] (M.A. Mughal); [email protected] (N. Shamim) ORCID (s): 0009-0005-5368-2433 (F. Qaiser); 0009-0008-8582-7205 (B. Tahir); 0000-0002-6148-9634 (M.A. Mughal)
Qaiser et al.: Preprint submitted to Elsevier
whose payload has been compressed or encrypted, fills its byteplot with near-uniform, high-entropy noise that carries little structural information. An unpacked binary looks quite different: low-entropy regions emerge wherever code sections, import tables, or embedded strings reside in memory. Passing both types through a single shared decision boundary treats visually dissimilar inputs as equivalent, and detection accuracy suffers most on the samples that have been most aggressively obfuscated. The problem is compounded by how widespread packing is outside the malware ecosystem. Commercial copyprotection tools, software installers, and archive utilities all generate high-entropy output for entirely legitimate reasons, which means packing state alone cannot reliably signal malicious intent. In our dataset of 200,000 Windows PE binaries, 76.20% of malware samples and 73.08% of benign samples are packed — a near-symmetric distribution that renders packing state alone a poor discriminator. A reliable detector must therefore simultaneously infer whether a binary is packed and whether it is malicious, using each inference to inform the other rather than treating them as independent questions. Prior work has addressed packing either by ignoring it entirely or by running a separate unpacking tool before feature extraction. The first approach accepts degraded performance on obfuscated samples. The second depends on the unpacker recognising the specific packer used, and fails silently on custom or novel compression schemes. Neither approach integrates packing knowledge into the learned representation itself. Recent self-supervised vision transformers have demonstrated that large-scale visual pre-training produces representations that transfer across surprisingly distant domains (Oquab et al., 2024). Whether the structural gap between Page 1 of 12
ViPER: Vision-based Packing-Aware Encoder
natural images and byte-level visualizations is small enough for such transfer to be useful is an open empirical question. Parameter-efficient adaptation methods such as LoRA (Hu et al., 2022) make it practical to fine-tune very large backbones on domain-specific data without discarding the pretrained representations, keeping trainable parameter counts manageable even when the backbone itself is large.
1.1. Summary of Contributions Dual-head packing-aware architecture. We propose a novel dual-head vision transformer architecture in which packing detection serves as an auxiliary supervised task. A learnable residual gating layer fuses packing confidence into the malware classification pathway, modulating the primary head logit as a function of the inferred packing state. To the best of our knowledge, no prior work treats packing state as an auxiliary learning signal within a unified visual classification framework. Multi-task joint training. ViPER is trained with a combined objective in which a weighted packing detection loss serves as an auxiliary signal alongside the primary malware classification loss, with the auxiliary weight set to reflect the subordinate role of packing detection without interfering with the primary objective. Packing asymmetry analysis and dataset-level insight. We perform a dataset-level packing analysis using Detect-It-Easy, revealing that packing prevalence is substantial in both classes (76.20% malware, 73.08% benign), indicating that packing state alone is an insufficient discriminator and motivating the learned, texture-based packing head design.
2. Related Work Visualization-based malware analysis, self-supervised vision transformers, multi-task learning for security, and packing detection form the four pillars on which ViPER is built. This section reviews each area, highlights the gaps that motivated our work, and ends with a consolidated comparison in Table 1.
2.1. Visualization-Based Malware Detection Nataraj et al. (2011) made the earliest observation that raw executable bytes, when arranged as a two-dimensional pixel grid, produce grayscale images whose texture differs consistently across malware families. Since pixel values come directly from byte content rather than from any parsed representation, the method avoids disassembly altogether and keeps working even when the underlying binary has been encrypted or otherwise modified. Convolutional approaches followed shortly after. Gibert et al. (2019) showed that CNNs learn spatial feature hierarchies from byteplots that consistently beat hand-crafted texture descriptors. Vasan et al. (2020) built on this with IMCFN, which fine-tunes an ImageNet-pretrained network on the Malimg benchmark and reaches competitive accuracy despite the large domain gap between natural photographs and binary visualizations. Bhodia et al. (2019) showed that Qaiser et al.: Preprint submitted to Elsevier
even under tight label budgets this gap remains manageable, as long as the source model was pretrained at sufficient scale. Transformer architectures entered the field as these models became more widely available. Ashawa et al. (2024) directly compared ResNet-152 and a standard ViT on grayscale malware images and found that accuracy on balanced benchmarks such as Malimg paints an overly optimistic picture: the two architectures diverge noticeably once class proportions shift, with direct consequences for how security datasets should be evaluated. Bavishi and Narayanan (2024) addressed the detection and attribution tasks jointly through LeViT-MC, a pipeline that passes samples through a DenseNet binary detector before handing them to a LeViT classifier for family assignment. Lu et al. (2026) reported that pairing a LeViT backbone with Progressive Focal Loss and Automatic Mixed Precision reduces GPU memory consumption by around 25% while pushing Macro-F1 to 0.953 and Cohen’s Kappa to 0.966 on Malimg. Hybrid designs have also made progress: combining ConvNeXtTiny with a Swin Transformer (Alshomrani et al., 2025) produced 99.25% accuracy across three benchmarks, and Masab et al. (2025) found that the global context attention mechanism in GCViT is particularly useful for separating families whose byteplot textures are close to one another. Despite this breadth of work, none of the methods above account for the packing state of the binary being classified. ViPER fills this gap by adding a packing detection head that runs alongside the malware classifier, with a gating layer that lets the inferred packing state influence the final detection decision.
2.2. Self-Supervised Vision Transformers and Transfer Learning The Vision Transformer (ViT), introduced by Dosovitskiy et al. (2021), demonstrated that pure attention-based architectures can match or surpass CNN performance on image recognition benchmarks when pre-trained at sufficient scale. The subsequent development of self-supervised pretraining objectives, including masked image modelling and self-distillation, has produced frozen feature extractors that generalise across visual domains without task-specific supervision. Caron et al. (2021) showed that self-distillation with no labels produces features with emergent semantic segmentation properties, while its successor DINOv2 (Oquab et al., 2024) scaled this approach to 142 million parameters and demonstrated that frozen ViT-B/14 features achieve stateof-the-art performance on a wide range of downstream tasks through simple linear probing. Despite the remarkable crossdomain transfer demonstrated by these models on natural image benchmarks, their applicability to binary visualization has not been systematically studied. ViPER therefore adopts a purely visual self-supervised encoder as its backbone, motivated by the structural mismatch between text-image supervision and the byte-level statistics of byteplot imagery.
Page 2 of 12
ViPER: Vision-based Packing-Aware Encoder
2.3. Multi-Task Learning for Malware Analysis Multi-task learning (MTL) improves model generalisation by sharing representations across related objectives, reducing the risk of overfitting on any single task and providing implicit regularisation through auxiliary gradients (Caruana, 1997). In the context of malware analysis, MTL has been applied to joint classification and family attribution (Yan et al., 2019), where sharing lower-layer representations between detection and attribution heads yielded consistent gains over independently trained models. Huang and Stokes (2016) proposed MTNet, which jointly optimises malware detection and API call sequence prediction, demonstrating that auxiliary sequence modelling provides useful inductive bias for the detection objective. Ki et al. (2015) incorporated packing-related metadata as a hard pre-processing step, unpacking the binary prior to feature extraction rather than treating it as a learned signal, which introduces brittleness against unknown or custom packers. ViPER departs from both paradigms by treating packing detection as a learned auxiliary task within a unified visual classification framework, trained end-to-end with a joint weighted loss. The auxiliary head learns to infer packing state directly from byteplot visual features, and its confidence is propagated to the primary detection head through a residual gating mechanism.
2.4. Packing Detection and Static Analysis Tools Early packing detection research rested on a simple empirical observation: packed or encrypted executable sections consistently show Shannon entropy above 7.0 bits (Lyda and Hamrock, 2007). This threshold is cheap to compute and straightforward to implement, which is why tools such as PEiD and Detect-It-Easy (Horšík, 2022) adopted it as a firstpass filter, pairing it with signature databases that match known packer fingerprints against PE structural features. The weaknesses of this design become apparent quickly in practice. When Ugarte-Pedrero et al. (2015) carried out a systematic evaluation across a wide range of packing detection tools, two recurring failure patterns emerged: signature matching breaks down against custom or previously unseen packers, and raw entropy thresholding generates too many false positives because compressed archives, self-extracting installers, and media files fall in the same high-entropy range as packed malware without actually being malicious. Biondi et al. (2018) traced both failures to the same underlying cause: a single scalar entropy value throws away the spatial and structural relationships inside a binary that would genuinely separate packing from legitimate compression, and called for richer feature representations capable of capturing those relationships. ViPER addresses this by shifting packing detection into the visual domain. The auxiliary packing head works on the same [CLS] embedding produced by the shared ViTB/14 backbone, meaning the features used to infer packing state are identical to those driving malware classification. This coupling ensures that the packing signal entering the residual gate is grounded in byteplot texture rather than an Qaiser et al.: Preprint submitted to Elsevier
independent entropy measurement, so the correction the gate produces stays aligned with the primary detection objective rather than working against it.
2.5. Class Imbalance in Malware Detection Class imbalance is a pervasive challenge in cybersecurity datasets, where benign samples typically outnumber malware samples by large margins in real-world deployment (Pendlebury et al., 2019). Existing approaches include oversampling via SMOTE (Chawla et al., 2002), cost-sensitive learning (Elkan, 2001), and threshold calibration at inference time. Lu et al. (2026) demonstrated that Progressive Focal Loss improves minority-class Macro-F1 and Cohen’s Kappa on Malimg without adding parameters or inference latency. ViPER addresses packing label skew through classfrequency-weighted cross-entropy applied independently to each head, combined with weighted random sampling over joint class-packing strata.
2.6. Summary and Research Gap Table 1 consolidates representative works across the four areas surveyed above. Two gaps are consistently apparent: no existing work combines visualization-based malware detection with explicit packing-state supervision in a unified learned framework; and self-supervised vision transformers have not been applied to binary visualization tasks with parameter-efficient adaptation. ViPER is designed to close both gaps simultaneously.
3. Proposed Methodology We propose ViPER (Vision-based Packing-Aware Encoder for Robust Malware Detection), a dual-head vision transformer framework that jointly learns malware classification and packing detection from byteplot visualizations of Windows PE binaries. The overall architecture is illustrated in Fig. 1.
3.1. Problem Formulation
Let = {(𝐱𝑖 , 𝑦𝑐𝑖 , 𝑦𝑝𝑖 )}𝑁 denote the dataset of 𝑁 𝑖=1 3×224×224 byteplot images, where 𝐱𝑖 ∈ ℝ is the 𝑖-th input image, 𝑦𝑐𝑖 ∈ {0, 1} is the malware/benign label (0 = benign, 1 = malware), and 𝑦𝑝𝑖 ∈ {0, 1} is the packing label (0 = unpacked, 1 = packed). ViPER learns a shared visual encoder 𝑓𝜃 ∶ ℝ3×224×224 → 768 ℝ together with two classification heads and a residual gating mechanism: 𝐳 = 𝑓𝜃 (𝐱)
(1)
𝐥𝑐 = 𝑔𝑐 (𝐳)
(2)
𝐥𝑝 = 𝑔𝑝 (𝐳) ̂𝐥 = 𝐥𝑐 + 𝛽 ⋅ 𝑟(𝐥𝑝 )
(3) (4)
where 𝑔𝑐 and 𝑔𝑝 are the malware and packing MLP heads respectively, 𝑟(⋅) is a residual correction network mapping packing logits to a correction in the same output space as 𝐥𝑐 ,
Page 3 of 12
Figure 1: Overall architecture of ViPER. A LoRA-adapted DINOv2 ViT-B/14 backbone produces a shared [CLS] embedding fed to two independent MLP heads. The packing head output passes through a residual gating network whose output is added as a weighted correction to the malware classification logit. Both heads are trained jointly with class-weighted cross-entropy losses.
ViPER: Vision-based Packing-Aware Encoder
Qaiser et al.: Preprint submitted to Elsevier
Page 4 of 12
ViPER: Vision-based Packing-Aware Encoder Table 1 Comparison of Representative Related Works. Work
Input
Model
Pack-Aware
Multi-Task
Self-Supervised
Nataraj et al. (2011) Gibert et al. (2019) Vasan et al. (2020) Ki et al. (2015) Yan et al. (2019) Huang et al. (2016) Ugarte-Pedrero et al. (2015) Ashawa et al. (2024) Bavishi & Narayanan (2024) Alshomrani et al. (2025) Masab et al. (2025) Lu et al. (2026)
Byteplot Byteplot Byteplot Static features Raw bytes API sequences PE metadata
k-NN CNN Fine-tuned CNN SVM Multi-task DNN MTNet Entropy threshold
No No No Partial No No Yes
No No No No Yes Yes No
No No No No No No No
Byteplot Byteplot
ResNet-152 + ViT LeViT-MC
No No
No No
No No
Byteplot
ConvNeXt + Swin
No
No
No
Byteplot Byteplot
GCViT LeViT+Focal Loss
No No
No No
No No
ViPER (ours)
Byteplot
ViT-B/14 + LoRA
Learned
Yes
Yes
and 𝛽 = 0.3 is a fixed scalar weight. The final prediction is 𝑦̂𝑐 = arg max(̂𝐥). The model is trained to minimise the multi-task weighted loss: = cls (̂𝐥, 𝑦𝑐 ) + 𝜆 pack (𝐥𝑝 , 𝑦𝑝 )
(5)
where cls and pack are class-weighted cross-entropy losses and 𝜆 = 0.2 is the auxiliary loss weight.
3.2. Dataset 3.2.1. Source and Composition The malware corpus was assembled from publicly available malware repositories. Due to the sensitive nature of executable samples, the raw binaries are not publicly released. To facilitate reproducibility, the SHA-256 hashes of all 200,000 Windows PE binaries used in this study are publicly available1 , allowing verification and reconstruction of the dataset from publicly available malware repositories such as VirusTotal or MalwareBazaar. The dataset comprises 200,000 PNG images: 100,000 malware samples and 100,000 benign samples, covering a diverse range of Windows Portable Executable (PE) binaries. Each image is a grayscale byteplot in which raw binary bytes are mapped to pixel intensity values and arranged into a two-dimensional grid row by row (Nataraj et al., 2011). This representation requires neither disassembly nor dynamic execution, making it inherently robust to many evasion strategies.
3.2.2. Packing Label Generation Ground-truth packing labels are not provided with the dataset. We derive them automatically using Detect-It-Easy (DiE) (Horšík, 2022), an open-source static analysis tool that combines signature-based packer identification with heuristic structural analysis of PE files. For each binary, DiE 1 https://drive.google.com/drive/folders/ 1uzVXm7ceyjR0Gae6ArT4kGotcB-5uVHM?usp=sharing
Qaiser et al.: Preprint submitted to Elsevier
Table 2 Packing Label Distribution in the Malware Dataset Class
Total
Packed
Unpacked
Pack %
Benign Malware
100,000 100,000
73,085 76,200
26,915 23,800
73.08% 76.20%
Overall
200,000
149,285
50,715
74.64%
examines the PE section layout, section name conventions, entry-point characteristics, and overlay patterns, and cross references these structural indicators against an extensible database of known packer signatures to produce a packing verdict. Samples for which DiE reports a known packer, protector, or installer signature are labelled packed; samples for which no such indicator is detected are labelled unpacked. This approach grounds the packing labels in interpretable structural evidence rather than scalar entropy values, which are known to produce excessive false positives due to legitimately high-entropy benign content such as compressed archives and media files (Ugarte-Pedrero et al., 2015; Biondi et al., 2018). The resulting packing distribution is summarised in Table 2 and visualised in Fig. 2. Among malware samples, 76.20% are packed; among benign samples, 73.08% are packed. The near-symmetric packing prevalence across both classes indicates that packing state alone is an insufficient discriminator, and motivates the residual gating design: the gate provides a soft texture-based correction rather than a hard routing signal.
3.2.3. Dataset Partitioning The dataset is partitioned into training (70%), validation (15%), and test (15%) sets using a two-stage stratified split. A composite stratum label is constructed by concatenating the binary class label and the packing label, yielding four strata: Page 5 of 12
ViPER: Vision-based Packing-Aware Encoder
Figure 2: Packing label distribution in the dataset. Left: Malware samples (76.20% packed). Right: Benign samples (73.08% packed). The near-symmetric packing prevalence across both classes confirms that packing state alone is an insufficient discriminator.
Table 3 Dataset Partition Statistics Split
Total
Benign
Malware
Packed
Train Val Test
140,000 30,000 30,000
70,000 15,000 15,000
70,000 15,000 15,000
104,500 22,393 22,392
Total
200,000
100,000
100,000
149,285
and contrast perturbation of ±0.1, and random erasing (𝑝 = 0.15, scale (0.02, 0.06)) are applied. Spatial flips are valid augmentations for byteplots because the mapping from byte sequence to pixel coordinates depends only on the chosen row width and is otherwise spatially arbitrary. Random rotation is deliberately excluded, as byteplots are not rotationally invariant. No augmentation is applied during validation or testing.
3.4. Class Imbalance Handling benign-unpacked, benign-packed, malware-unpacked, and malware-packed. StratifiedShuffleSplit from scikit-learn is applied twice to ensure that all four strata are proportionally represented in every partition, preventing the inadvertent introduction of evaluation bias. The resulting partition sizes are summarised in Table 3.
3.3. Data Preprocessing 3.3.1. Image Preparation
The packing label distribution in the training set is imbalanced (74.64% packed, 25.36% unpacked). To address this, the packing head loss is independently weighted using balanced class weights computed from the training partition:
𝑤𝑝 =
𝑁train , 2 ⋅ 𝑁𝑝train
𝑝 ∈ {unpacked, packed}
(6)
Byteplot images are stored as grayscale PNGs, as each pixel encodes a single byte value in the range [0, 255] and no colour information is present in the source data. To satisfy the three-channel input requirement of the ViT-B/14 backbone, each grayscale image is converted to RGB via channel replication, in which the single luminance channel is copied identically across all three channels. This operation is lossless and introduces no spurious colour information; it is a standard adaptation step when applying pre-trained RGB vision models to single-channel binary visualizations. All images are resized to 224 × 224 pixels using bilinear interpolation and normalised with byteplot-specific statistics (𝜇 = [0.5, 0.5, 0.5], 𝜎 = [0.25, 0.25, 0.25]), which are appropriate for the approximately uniform byte distribution of binary data and preferred over ImageNet statistics for this domain.
yielding 𝑤unpacked = 1.9718 and 𝑤packed = 0.6699. The malware classification head uses the same class-frequency weighting formulation, ensuring the framework generalises directly to deployment settings with realistic benign-tomalware skew without modification.
3.3.2. Training Augmentation During training, random horizontal flip (𝑝 = 0.5), random vertical flip (𝑝 = 0.5), colour jitter with brightness
ViPER employs a self-supervised vision transformer pre-trained on 142 million images via self-distillation with no labels (Oquab et al., 2024) as its visual backbone. The
Qaiser et al.: Preprint submitted to Elsevier
3.4.1. Weighted Random Sampling To ensure balanced batch composition during training, a WeightedRandomSampler assigns each training sample a weight inversely proportional to the frequency of its composite stratum (class × packing label). Sampling is performed with replacement, ensuring that all four strata are represented in every training batch. This data-level correction operates independently of and complementarily to the loss-level weighting described above.
3.5. ViPER Architecture 3.5.1. Backbone: Self-Supervised Visual Encoder
Page 6 of 12
ViPER: Vision-based Packing-Aware Encoder
ViT-B/14 variant uses a patch size of 14 × 14 pixels and produces a 768-dimensional [CLS] token embedding 𝐳 ∈ ℝ768 from each input image. The [CLS] token serves as the global image representation and is fed to both classification heads.
3.5.2. Parameter-Efficient Fine-Tuning via LoRA To adapt the backbone to the byteplot domain while preserving pre-trained representations and minimising trainable parameters, we apply Low-Rank Adaptation (LoRA) (Hu et al., 2022) to the query-key-value (QKV) projection matrices of all 12 transformer blocks. For each frozen weight matrix 𝐖 ∈ ℝ𝑑×𝑘 , LoRA introduces two low-rank matrices 𝐀 ∈ ℝ𝑟×𝑘 and 𝐁 ∈ ℝ𝑑×𝑟 such that the adapted forward pass computes: 𝛼 (7) 𝐖′ 𝐱 = 𝐖𝐱 + 𝐁𝐀𝐱 𝑟 where 𝑟 = 16 is the rank, 𝛼 = 32 is the scaling factor, and all elements of 𝐁 are initialised to zero, ensuring an identity mapping at initialisation. All original backbone weights remain frozen throughout training; only 𝐀 and 𝐁 are updated. This configuration yields a substantially reduced set of trainable backbone parameters relative to full fine-tuning, enabling efficient domain adaptation without modifying the pre-trained feature representations. 3.5.3. Dual Classification Heads Two independent MLP heads are attached to the shared backbone embedding 𝐳: Malware head (primary task): 𝑔𝑐 (𝐳) = 𝐖3 GELU(𝐖2 GELU(𝐖1 LN(𝐳)))
(8)
with dimensions 768 → 512 → 256 → 2 and dropout rates of 0.3 and 0.15 after the first and second projections respectively. Packing head (auxiliary task): 𝑔𝑝 (𝐳) = 𝐖6 GELU(𝐖5 GELU(𝐖4 LN(𝐳)))
(9)
with dimensions 768 → 384 → 192 → 2 and dropout rate of 0.3. LN denotes Layer Normalisation.
3.5.4. Packing-Aware Residual Gating Mechanism The packing head logit 𝐥𝑝 ∈ ℝ2 is passed through a residual correction network 𝑟(⋅) (Linear(2, 32) → ReLU → Dropout(0.1) → Linear(32, 2)) to produce a correction vector in the same output space as the malware logit. The corrected logit is computed as: ̂𝐥 = 𝐥𝑐 + 𝛽 ⋅ 𝑟(𝐥𝑝 ), 𝛽 = 0.3 (10) This residual formulation ensures that the packing signal augments rather than replaces the malware classification, maintaining the primacy of the visual features learned by the malware head. The choice of additive rather than multiplicative gating is motivated by the similar packing distributions across classes in this dataset: a multiplicative gate conditioned on packing confidence would produce noisy scaling and degrade the primary objective under near-symmetric packing prevalence. Qaiser et al.: Preprint submitted to Elsevier
3.6. Training Protocol 3.6.1. Loss Function ViPER is trained with the multi-task objective defined in Eq. (5). The auxiliary weight 𝜆 = 0.2 reflects the subordinate role of packing detection relative to the primary malware classification objective. This value is set conservatively to account for the observation that packing distributions are similar across classes in this dataset, reducing the discriminative value of the auxiliary signal and warranting a lower weight to prevent interference with the primary head.
3.6.2. Optimiser and Schedule Parameters are updated using AdamW (Loshchilov and Hutter, 2019) with differential learning rates: LoRA adapter parameters are trained at 𝜂LoRA = 1×10−4 and classification head parameters at 𝜂head = 3 × 10−4 , both with weight decay 10−2 . The learning rate follows a linear warmup over three epochs followed by cosine annealing (Loshchilov and Hutter, 2017) over the remaining training budget, with a minimum learning rate of 𝜂min = 10−7 . Gradient norms are clipped to 1.0 to stabilise transformer fine-tuning. 3.6.3. Training Configuration Training proceeds for a maximum of 20 epochs with early stopping triggered when the validation ROC-AUC of the malware head does not improve for five consecutive epochs. The model checkpoint achieving the highest validation AUC is retained for all test evaluations. A per-GPU batch size of 128 with BFloat16 mixed-precision training is used throughout. All experiments are conducted on an NVIDIA RTX 5090 GPU (32 GB VRAM). Table 4 summarises all hyperparameters.
4. Results and Discussion 4.1. Evaluation Protocol All models are evaluated on the same held-out test set of 30,000 samples (15,000 benign, 15,000 malware) derived from the joint-stratified split described in Section 3. We report balanced accuracy (BalAcc), ROC-AUC (AUC), and area under the precision-recall curve (AUPR). Balanced accuracy and AUPR are prioritised over plain accuracy and AUC respectively, as they are more informative under class imbalance conditions. All metrics are computed on the test set using the best validation-AUC checkpoint.
4.2. Ablation Study To isolate the contribution of each architectural component, we conduct a controlled ablation across four configurations with all other settings held constant. Table 5 reports test set results for each variant. Configuration (1) establishes the performance ceiling of frozen DINOv2 features without any fine-tuning or taskspecific heads, quantifying the baseline transfer capability of the pre-trained backbone. Configuration (2) introduces LoRA fine-tuning and the primary malware classification head without packing supervision, isolating the gain from domain adaptation alone. The jump from (1) to (2), a gain Page 7 of 12
ViPER: Vision-based Packing-Aware Encoder Table 4 ViPER Hyperparameter Summary Hyperparameter
Value
Backbone LoRA rank 𝑟 LoRA scaling 𝛼 Input resolution Normalisation Batch size Max epochs Best epoch Early stopping Optimiser LR (LoRA) LR (heads) Weight decay LR warmup LR schedule Grad clip 𝜆 (pack) 𝛽 (gate) Dropout (cls) Dropout (pack) Precision Hardware
ViT-B/14 (DINOv2 self-supervised) 16 32 224 × 224 mean 0.5, std 0.25 (byteplot) 128 20 18 patience = 5 (val AUC) AdamW 1 × 10−4 3 × 10−4 10−2 3 epochs (linear) Cosine annealing 1.0 0.2 0.3 0.3 / 0.15 0.3 BFloat16 NVIDIA RTX 5090 (32 GB)
of +0.0363 in BalAcc and +0.0285 in AUC, is the largest single gain across the ablation, confirming that LoRA finetuning of the attention projections is the most impactful component. Configuration (3) adds the dual-head multi-task objective but removes the residual gate, allowing assessment of whether packing-aware gradient sharing provides benefit independent of gating. The full ViPER model (4) combines all components, achieving the best AUC (0.9260) and AUPR (0.9279), confirming the incremental contribution of the residual gate. Notably, the gate improves AUC by +0.0017 over dual-head without gating while maintaining identical BalAcc, suggesting the gate’s benefit manifests primarily in ranking quality rather than threshold-dependent accuracy. The ROC curves for all four configurations are shown in Fig. 3, and the training dynamics of the full model are plotted in Fig. 4.
4.3. Main Results Table 6 presents the final evaluation of the full ViPER model on the test set for both the malware detection and packing detection tasks, alongside the frozen baseline. Table 7 reports per-class precision, recall, and F1 for the malware detection task.
4.4. Comparison with CNN Baselines To contextualise ViPER’s performance within the broader landscape of convolutional architectures, we evaluate two standard CNN baselines on the same dataset, training protocol, and evaluation conditions: ResNet-50 (He et al., 2016)
Qaiser et al.: Preprint submitted to Elsevier
with its final layer4 block fine-tuned, and MobileNetV3Large (Howard et al., 2019) with its full backbone finetuned. Both baselines use the identical AdamW optimiser with warmup and cosine annealing schedule, the same 20epoch training budget, and the same class-weighted crossentropy loss as ViPER, ensuring a controlled comparison. Several observations merit discussion. First, ViPER substantially outperforms both CNN baselines across all reported metrics despite training only 1.49M parameters, compared to 16.15M for ResNet-50 and 3.19M for MobileNetV3Large. This result demonstrates that parameter-efficient adaptation of a high-capacity self-supervised backbone is a more effective strategy for this task than extensive finetuning of a smaller purpose-built CNN. Second, ResNet-50 and MobileNetV3-Large achieve broadly comparable performance (AUC of 0.9021 and 0.9004 respectively), suggesting that architectural scale within the CNN family provides diminishing returns at this dataset size once the backbone receptive field is sufficiently large to capture byteplot texture statistics. This plateau motivates the shift to transformer-based architectures with global attention, which ViPER exploits through the DINOv2 backbone. Third, the TPR@1%FPR gap is operationally significant: ViPER achieves a true positive rate of 0.4635 at a 1% false positive rate, compared to 0.4201 for ResNet-50 and 0.4010 for MobileNetV3-Large. In a deployment scenario where the false positive budget is constrained, ViPER detects approximately 4.3 to 6.3 percentage points more malware samples per 100 queried files than either CNN baseline, a meaningful operational improvement at no additional inference cost relative to ResNet-50 given the compact trainable footprint. Fourth, and most relevant to the novelty of this work, the CNN baselines have no mechanism for packing-aware inference: they apply a single shared decision boundary regardless of the estimated packing state of the input binary. ViPER’s residual gating mechanism provides a soft, learned correction conditioned on packing texture, which contributes to the consistent AUC and AUPR improvements visible in Table 8.
4.5. Discussion The ablation results confirm that LoRA fine-tuning provides the largest single performance gain over the frozen baseline, as domain adaptation of the attention weights allows the model to develop byteplot-specific feature selectivity unavailable in the natural-image pre-trained representations. The packing-aware multi-task objective provides a secondary improvement, particularly in AUC and AUPR, which are most sensitive to the quality of probability calibration across the full operating range. The residual gate further refines this, adding a directed correction from packing-specific visual features without displacing the primary malware head. A key observation from the dataset analysis is that packing is prevalent in both classes (76.20% malware, 73.08% benign), meaning entropy alone cannot discriminate malware Page 8 of 12
ViPER: Vision-based Packing-Aware Encoder Table 5 Ablation Study on the Malware Dataset Test Set (30,000 samples). Bal. Acc. = balanced accuracy; AUPR = area under precisionrecall curve. Configuration
BalAcc
AUC
AUPR
(1) Frozen ViT, single head (2) LoRA, single head (no packing) (3) LoRA, dual head (no gate) (4) ViPER (LoRA + dual head + gate)
0.8133 0.8496 0.8521 0.8521
0.8959 0.9244 0.9243 0.9260
0.9049 0.9273 0.9249 0.9279
Figure 3: ROC curves for all four ablation configurations on the test set. The area under each curve corresponds to the AUC values reported in Table 5.
from benign files. However, the packing texture patterns within each class remain visually distinct: packed malware tends toward uniform high-entropy noise associated with encryption and custom compression, while packed benign software, such as installers and archives, exhibits more structured high-entropy patterns. The learned packing head is therefore forced to model fine-grained texture differences beyond raw entropy, and the resulting correction signal provides useful refinement to the malware head without requiring explicit supervision on packer types. The joint stratification of the dataset split over classpacking strata ensures that test set performance reflects the
true operational distribution of all four subgroups, preventing systematic evaluation bias at both the class and packing boundaries.
4.6. Hyperparameter Sensitivity Analysis To validate the robustness of the two fixed scalar hyperparameters, 𝛽 (residual gate weight) and 𝜆 (auxiliary packing loss weight), we conduct a coarse-grid sensitivity analysis. The sensitivity runs are conducted as independent training experiments with different random seeds from the main evaluation; the modest deviation from the main results in Tables 5 and 6 reflects stochastic training variance across runs, consistent with the narrow stability range observed across the 𝛽 sweep itself. The gate weight 𝛽 is varied across
Figure 4: Training curves for ViPER (configuration 4). Loss decreases smoothly for both heads across 20 epochs. Validation AUC and balanced accuracy improve consistently through epoch 18 (best checkpoint) before plateauing.
Qaiser et al.: Preprint submitted to Elsevier
Page 9 of 12
ViPER: Vision-based Packing-Aware Encoder Table 6 ViPER Final Test Set Results on the Malware Dataset Test Set (30,000 samples). Task / Model
BalAcc
Malware detection Frozen ViT (baseline) ViPER (proposed) Δ improvement
0.8133 0.8521 +0.0388
AUC
AUPR
0.8959 0.9260 +0.0301
0.9049 0.9279 +0.0230
Packing detection (ViPER auxiliary head) ViPER pack head 0.9688 0.9949
–
Table 9 Sensitivity Analysis of Gate Weight 𝛽 and Auxiliary Loss Weight 𝜆. Metrics are reported on the held-out test set. The trained values used in ViPER are indicated with (⋆). 𝛽
BalAcc
AUC
AUPR
0.1 0.2 0.3⋆ 0.5 0.7
0.8567 0.8585 0.8585 0.8575 0.8536
0.9275 0.9278 0.9280 0.9281 0.9280
0.9297 0.9298 0.9298 0.9293 0.9289
Δmax across 𝛽: AUC ±0.0006, AUPR ±0.0005, BalAcc ±0.0025 Table 7 Per-Class Malware Detection Results on the Malware Dataset Test Set (ViPER, 30,000 samples). Class
Precision
Recall
F1
Support
Benign Malware
0.8426 0.8622
0.8661 0.8382
0.8542 0.8500
15,000 15,000
Macro avg
0.8524
0.8521
0.8521
30,000
𝜆
BalAcc
AUC
AUPR
0.05 0.10 0.20⋆ 0.40 0.60
0.8296 0.8319 0.8337 0.8313 0.8350
0.9135 0.9146 0.9163 0.9152 0.9166
0.9200 0.9208 0.9232 0.9217 0.9228
Δmax across 𝜆: AUC ±0.0016, AUPR ±0.0016, BalAcc ±0.0027
Total Params
Trainable
BalAcc
MobileNetV3-Large ResNet-50
3.60M 24.69M
3.19M (88.7%) 16.15M (65.4%)
0.8211 0.8249
ViPER (ours)
88.66M
1.49M (1.69%)
0.8521
the expectation that the packing head acts as an auxiliary regulariser: too small a weight provides insufficient auxiliary gradient, while too large a weight risks allowing the packing objective to interfere with the primary malware classification head. Taken together, these results confirm that the selected hyperparameter values are well-positioned within a stable operating region, and that the reported ViPER performance is not an artefact of precise hyperparameter tuning.
– –
– –
+0.0272 +0.0310
5. Conclusion and Future Work
Table 8 Comparison of ViPER Against CNN Baselines on the Test Set (30,000 samples). Trainable parameters for ViPER reflect LoRA adapters and classification heads only. Model
Δ vs. ResNet-50 Δ vs. MobileNetV3
Model
AUC
AUPR
TPR@1%FPR
MobileNetV3-Large ResNet-50
0.9004 0.9021
0.9080 0.9094
0.4010 0.4201
ViPER (ours)
0.9260
0.9279
0.4635
Δ vs. ResNet-50 Δ vs. MobileNetV3
+0.0239 +0.0256
+0.0185 +0.0199
+0.0434 +0.0625
five values while holding all other parameters fixed and reevaluating the trained ViPER checkpoint; no retraining is required since 𝛽 appears only in the forward pass. The auxiliary weight 𝜆 is evaluated via independent five-epoch training runs from scratch for each candidate value, providing a relative comparison of training dynamics under different auxiliary loss scales. Results are reported in Table 9. The 𝛽 sweep demonstrates that ViPER’s primary metrics are largely insensitive to the gate weight across the range [0.1, 0.7], with AUC varying by no more than 0.0006. This confirms that the residual gating mechanism provides a stable correction signal rather than a brittle additive offset, and that the choice of 𝛽 = 0.3 is not a critically tuned value. The 𝜆 sweep reveals that performance peaks near 𝜆 = 0.2 and degrades modestly at both extremes, consistent with Qaiser et al.: Preprint submitted to Elsevier
We presented ViPER, a packing-aware dual-head vision transformer for visualization-based malware detection. By treating packing detection as a learned auxiliary task and coupling its output to the primary malware classification head through a residual gating mechanism, ViPER addresses a structural limitation that has persisted across the body of prior work in this area: the uniform treatment of packed and unpacked executables under a single shared decision boundary. Parameter-efficient fine-tuning via LoRA adapts the self-supervised ViT-B/14 backbone to the byteplot domain while keeping the trainable parameter count to 1.69% of the full model. Evaluated on 200,000 Windows PE byteplot images, ViPER achieves a ROC-AUC of 0.9260 and AUPR of 0.9279, outperforming all evaluated convolutional and transformer baselines across every reported metric while training only 1.49M parameters. Controlled ablation validates the contribution of each architectural component, and the packing detection auxiliary head achieves an AUC of 0.9949, confirming that byteplot visual features carry strong discriminative signal for packing state inference. Several directions remain open for future work. First, ViPER currently frames malware detection as a binary classification problem. A natural extension is to incorporate fine-grained malware family classification as an additional Page 10 of 12
ViPER: Vision-based Packing-Aware Encoder
supervised head, enabling simultaneous detection, packingstate inference, and family attribution within a single unified framework. Second, identifying the specific packer or protector type rather than a binary packed/unpacked label could further refine the gating signal, as distinct packers produce visually distinguishable byteplot textures that carry discriminative information beyond a scalar packing confidence. Third, exploring adaptive row-width representations that preserve section boundaries could enrich the visual features available to the backbone beyond the single fixed row width used in the current implementation.
Acknowledgements The authors would like to thank the Department of Computer and Information Sciences at PIEAS and the Bioinformatics Lab at PIEAS for providing access to the computational resources used in this work.
CRediT authorship contribution statement Fatima Qaiser: Conceptualization, Methodology, Software, Formal analysis, Investigation, Data curation, Visualization, Writing – original draft. Bisma Tahir: Software, Validation, Data curation, Writing – original draft. Muhammad Abid Mughal: Conceptualization, Resources, Supervision, Project administration, Writing – review and editing. Nauman Shamim: Supervision, Writing – review and editing.
References Alshomrani, M., Albeshri, A., Alsulami, A.A., Alturki, B., 2025. An explainable hybrid CNN-transformer architecture for visual malware classification. Sensors 25 (15), 4581. https://doi.org/10.3390/s25154581. Ashawa, M., Owoh, N., Hosseinzadeh, S., Osamor, J., 2024. Enhanced image-based malware classification using transformerbased convolutional neural networks. Electronics 13 (20), 4081. https://doi.org/10.3390/electronics13204081. Bavishi, S., Narayanan, A., 2024. Accelerating malware classification: A vision transformer solution. arXiv preprint arXiv:2409.19461. https://doi.org/10.48550/arXiv.2409.19461. Bhodia, N., Prajapati, P., Di Troia, F., Stamp, M., 2019. Transfer learning for image-based malware classification. arXiv preprint arXiv:1903.11551. https://doi.org/10.48550/arXiv.1903.11551. Biondi, F., Enescu, M.A., Given-Wilson, T., Legay, A., Puodzius, C., Quilbeuf, J., 2018. Tutorial: An overview of malware detection and evasion techniques. In: Proc. Int. Symp. Leveraging Applications of Formal Methods (ISoLA), Limassol, Cyprus. pp. 235–266. https://doi.org/10.1007/978-3-030-03418-4_34. Caron, M., Touvron, H., Misra, I., Jégou, H., Mairal, J., Bojanowski, P., Joulin, A., 2021. Emerging properties in self-supervised vision transformers. In: Proc. IEEE/CVF Int. Conf. Computer Vision (ICCV). pp. 9650–9660. https://doi.org/10.1109/ICCV48922.2021.00951. Caruana, R., 1997. Multitask learning. Mach. Learn. 28 (1), 41–75. https://doi.org/10.1023/A:1007379606734. Chawla, N.V., Bowyer, K.W., Hall, L.O., Kegelmeyer, W.P., 2002. SMOTE: Synthetic minority over-sampling technique. J. Artif. Intell. Res. 16, 321–357. https://doi.org/10.1613/jair.953. Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., Uszkoreit, J., Houlsby, N., 2021. An image is worth 16×16 words: Transformers for image recognition at scale. In: Proc. Int. Conf. Learning Representations (ICLR). https://doi.org/10.48550/arXiv.2010.11929.
Qaiser et al.: Preprint submitted to Elsevier
Elkan, C., 2001. The foundations of cost-sensitive learning. In: Proc. 17th Int. Joint Conf. Artificial Intelligence (IJCAI), Seattle, WA, USA. pp. 973–978. Gibert, D., Mateu, C., Planes, J., Vicens, R., 2019. Using convolutional neural networks for classification of malware represented as images. J. Comput. Virol. Hacking Tech. 15 (1), 15–28. https://doi.org/10.1007/s11416018-0323-0. He, K., Zhang, X., Ren, S., Sun, J., 2016. Deep residual learning for image recognition. In: Proc. IEEE Conf. Computer Vision and Pattern Recognition (CVPR), Las Vegas, NV, USA. pp. 770–778. https://doi.org/10.1109/CVPR.2016.90. Horšík, J., 2022. Detect-It-Easy. GitHub repository. https://github.com/ horsicq/Detect-It-Easy (accessed 1 January 2024). Howard, A., Sandler, M., Chu, G., Chen, L.C., Chen, B., Tan, M., Wang, W., Zhu, Y., Pang, R., Vasudevan, V., Le, Q.V., Adam, H., 2019. Searching for MobileNetV3. In: Proc. IEEE/CVF Int. Conf. Computer Vision (ICCV), Seoul, Korea. pp. 1314–1324. https://doi.org/10.1109/ICCV.2019.00140. Hu, E.J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., Chen, W., 2022. LoRA: Low-rank adaptation of large language models. In: Proc. Int. Conf. Learning Representations (ICLR). https://doi.org/10.48550/arXiv.2106.09685. Huang, W., Stokes, J.W., 2016. MTNet: A multi-task neural network for dynamic malware classification. In: Proc. 13th Int. Conf. Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA). pp. 399–418. https://doi.org/10.1007/978-3-319-40667-1_20. Ki, Y., Kim, E., Kim, H.K., 2015. A novel approach to detect malware based on API call sequence analysis. Int. J. Distrib. Sens. Netw. 11 (6), 659101. https://doi.org/10.1155/2015/659101. Loshchilov, I., Hutter, F., 2017. SGDR: Stochastic gradient descent with warm restarts. In: Proc. Int. Conf. Learning Representations (ICLR). https://doi.org/10.48550/arXiv.1608.03983. Loshchilov, I., Hutter, F., 2019. Decoupled weight decay regularization. In: Proc. Int. Conf. Learning Representations (ICLR). https://doi.org/10.48550/arXiv.1711.05101. Lu, Z., Tu, S., Li, Z., 2026. Malware image classification based on lightweight vision transformer and progressive focal loss. In: Proc. 2025 15th Int. Conf. Communication and Network Security (ICCNS). pp. 217–222. https://doi.org/10.1145/3789456.3789463. Lyda, R., Hamrock, J., 2007. Using entropy analysis to find encrypted and packed malware. IEEE Security Privacy 5 (2), 40–45. https://doi.org/10.1109/MSP.2007.48. Masab, M., Ahmad, K., Hussain, M., Khan, M.S., 2025. Malware image classification using global context vision transformers for information security. ICCK Trans. Inf. Security Cryptography 2 (1), 1–15. https://doi.org/10.62762/TISC.2025.775760. Nataraj, L., Karthikeyan, S., Jacob, G., Manjunath, B.S., 2011. Malware images: Visualization and automatic classification. In: Proc. 8th Int. Symp. Visualization for Cyber Security (VizSec), Pittsburgh, PA, USA. pp. 1–7. https://doi.org/10.1145/2016904.2016908. Oquab, M., Darcet, T., Moutakanni, T., Vo, H., Szafraniec, M., Khalidov, V., Fernandez, P., Haziza, D., Massa, F., El-Nouby, A., Assran, M., Ballas, N., Galuba, W., Howes, R., Huang, P.Y., Li, S.W., Misra, I., Rabbat, M., Sharma, V., Synnaeve, G., Xu, H., Jegou, H., Mairal, J., Labatut, P., Joulin, A., Bojanowski, P., 2024. DINOv2: Learning robust visual features without supervision. Trans. Machine Learning Research. https://doi.org/10.48550/arXiv.2304.07193. Pendlebury, F., Pierazzi, F., Jordaney, R., Kinder, J., Cavallaro, L., 2019. TESSERACT: Eliminating experimental bias in malware classification across space and time. In: Proc. USENIX Security Symp., Santa Clara, CA, USA. pp. 729–746. https://doi.org/10.48550/arXiv.1807.07838. Ugarte-Pedrero, X., Balzarotti, D., Santos, I., Bringas, P.G., 2015. SoK: Deep packer inspection: A longitudinal study of the complexity of runtime packers. In: Proc. IEEE Symp. Security and Privacy (S&P), San Jose, CA, USA. pp. 659–673. https://doi.org/10.1109/SP.2015.48. Vasan, D., Alazab, M., Wassan, S., Safaei, B., Zheng, Q., 2020. IMCFN: Image-based malware classification using fine-tuned convolutional neural network architecture. Comput. Networks 171, 107138.
Page 11 of 12
ViPER: Vision-based Packing-Aware Encoder https://doi.org/10.1016/j.comnet.2020.107138. Yan, J., Qi, Y., Rao, Q., 2019. Detecting malware with an ensemble method based on deep neural network. Security and Communication Networks 2019, 1–16. https://doi.org/10.1155/2018/7247095. Fatima Qaiser is an undergraduate student in the Department of Computer and Information Sciences at the Pakistan Institute of Engineering and Applied Sciences (PIEAS), Islamabad, Pakistan. Her research focus is on cybersecurity, malware analysis, and software systems. This includes visualization-based threat detection, generative AI and its applications in security, and explainable AI (XAI). Bisma Tahir is an undergraduate student in the Department of Computer and Information Sciences at the Pakistan Institute of Engineering and Applied Sciences (PIEAS), Islamabad, Pakistan. Her research interests include deep learning, cybersecurity, computer architecture, generative AI applications, and explainable AI.
Muhammad Abid received the Ph.D. degree in Computer Science from Tsinghua University, China, in 2012. He is currently a Principal Scientist/ Associate Professor with the Pakistan Institute of Engineering and Applied Sciences (PIEAS). He has organized number of hands-on workshops on Malware Analysis, Network Penetration Testing, and Intrusion Analysis. He established Nvidia GPU Education Centre, Data Science Lab, and DIL Lab in PIEAS. His current research interests include the data security and privacy, malware analysis, and network security.
Dr. Nauman Shamim is a faculty member in the Department of Computer and Information Sciences at PIEAS, Islamabad, Pakistan. His research interests include cybersecurity, network security, and applied machine learning.
Qaiser et al.: Preprint submitted to Elsevier
Page 12 of 12