EAAI Journal 2026 Journal Article
A novel android malware classification approach based on multi-scale feature fusion for encrypted traffic
- Jiahui Lu
- jinfu chen
- Saihua Cai
- Yisong Liu
- Shengran Wang
With the widespread adoption of Android system, the volume of malware targeting Android devices continues to increase, posing significant threats to security and privacy data. To safeguard data transmission, most applications have adopted the Transport Layer Security (TLS) protocol. Although TLS improves communication security, it also provides a convenient means for attackers to conceal malicious payloads, thereby challenging traditional malware classification methods in encrypted traffic scenarios. However, most existing methods rely on a single type of network traffic feature, limiting their ability to capture complex malicious behaviors and leading to the issues such as limited feature diversity, weak generalization and sensitivity to encryption. To address these challenges, this paper proposes a novel Android Malware Classification method based on Multi-scale Feature Fusion (AMC-MFF) for encrypted network traffic. This method treats session flows as the basic unit and extracts gray-scale images, statistical features and TLS protocol features from raw byte streams, using Residual Network 18 (ResNet18), Bidirectional Gated Recurrent Unit (Bi-GRU), and Multi-Layer Perceptron (MLP) models, respectively, to achieve multi-scale feature modeling. Then, a two-layer cross-attention mechanism is introduced to capture the semantic associations among features from different scales, and a Transformer-based fusion module is employed to integrate these features effectively. Finally, the residual connections and a fully connected layer are used for accurate malware classification. Experimental results on two public datasets demonstrate that AMC-MFF outperforms existing baselines, achieving a classification accuracy of up to 99. 87%, which highlights its strong classification performance.