# ThreatVisionAI: A Hybrid CNN-ViT Framework for Image-Based Malware Classification

arXiv: https://arxiv.org/abs/2607.03653 · HTML: https://mlsanity.com/paper/2607.03653/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 13 of its 35 references that are in the map.
- First posted on arXiv 4 Jul 2026.

## Builds on (most cited first, 13 of 13)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localization](https://mlsanity.com/paper/1610.02391/) (2016)
- [HuntGPT: Integrating Machine Learning-Based Anomaly Detection and Explainable AI with Large Language Models (LLMs)](https://mlsanity.com/paper/2309.16021/) (2023)
- [Imbalanced Malware Images Classification: a CNN based Approach](https://mlsanity.com/paper/1708.08042/) (2017)
- [Transfer Learning for Image-Based Malware Classification](https://mlsanity.com/paper/1903.11551/) (2019)
- [A Survey of Malware Detection Using Deep Learning](https://mlsanity.com/paper/2407.19153/) (2024)
- [AI-based Malware and Ransomware Detection Models](https://mlsanity.com/paper/2207.02108/) (2022)
- [Self-Supervised Vision Transformers for Malware Detection](https://mlsanity.com/paper/2208.07049/) (2022)
- [Malware Detection Using Frequency Domain-Based Image Visualization and Deep Learning](https://mlsanity.com/paper/2101.10578/) (2021)
- [Stegomalware: A Systematic Survey of MalwareHiding and Detection in Images, Machine LearningModels and Research Challenges](https://mlsanity.com/paper/2110.02504/) (2021)
- [Accelerating Malware Classification: A Vision Transformer Solution](https://mlsanity.com/paper/2409.19461/) (2024)
- [Enhancing Cyber Security Through Predictive Analytics: Real-Time Threat Detection and Response](https://mlsanity.com/paper/2407.10864/) (2024)

## Abstract (arXiv)

Traditional malware detection methods struggle to generalize to obfuscated or previously unseen threats. This paper introduces ThreatVisionAI, a hybrid malware family classification framework that integrates a raw-image CNN, a wavelet-based CNN, and a Vision Transformer (ViT) to capture complementary spatial, frequency-domain, and global relational features in malware images. The wavelet-based CNN captures multi-scale frequency information that helps distinguish closely related families, while the ViT branch models long-range dependencies across the image. Evaluated on the Malimg dataset, ThreatVisionAI achieves 98.01% accuracy and a weighted F1 score of 0.9742, with wavelet-domain features providing measurable gains on minority and visually similar families. These results confirm that frequency-aware and transformer-based representations improve image-based malware family classification.