# A Structured State Space Sequence Model for Multi-Class Classification of Malware

arXiv: https://arxiv.org/abs/2610.01893 · HTML: https://mlsanity.com/paper/2610.01893/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 5 of its 23 references that are in the map.
- First posted on arXiv 1 Oct 2026.

## Builds on (most cited first, 5 of 5)

- [Mamba: Linear-Time Sequence Modeling with Selective State Spaces](https://mlsanity.com/paper/2312.00752/) (2023)
- [Malware Classification Using Long Short-Term Memory Models](https://mlsanity.com/paper/2103.02746/) (2021)
- [A Transformer-Based Framework for Payload Malware Detection and Classification](https://mlsanity.com/paper/2403.18223/) (2024)
- [OpCode-Based Malware Classification Using Machine Learning and Deep Learning Techniques](https://mlsanity.com/paper/2504.13408/) (2025)
- [Signal-Based Malware Classification Using 1D CNNs](https://mlsanity.com/paper/2509.06548/) (2025)

## Abstract (arXiv)

By 2030, Internet of Things (IoT) devices are projected to reach 40 billion, with fast-paced technological advancements in fields such as industry, healthcare, agriculture, automobiles, and building/home automation systems. This expansion has created a large attack surface for cybercrime, as the majority of these devices open the door for cybercriminals to exploit vulnerabilities, as they lack adequate built-in security. Cybercriminals launch malware attacks to compromise systems or steal sensitive data, and once a system is compromised, a ransom is typically demanded for its release. Current cybersecurity measures in place are being outpaced by the rapid growth of the IoT, which is accompanied by a subsequent growth in malware variants being created per day. Recognizing this pitfall, this research examines and proposes a novel approach to malware detection and classification to safeguard devices from further attacks and make IoT systems more robust and secure. The framework proposed utilizes a Structured State Space Sequence (S4) model, which discretizes sequences of malware samples in a sequence and captures long-range dependencies, essentially identifying the "cause" and "effect" hidden within malware execution flow. This study presents two novel contributions: the first empirical application of the S4 model for malware analysis, and a comprehensive comparison of its performance against other deep learning architectures, laying the stepping stone for future research in this new paradigm.