{"id":"https://openalex.org/W7204460262","doi":"https://doi.org/10.21203/rs.3.rs-10549516/v1","title":"Tri-Modal Contrastive Binary Analysis via Opcode Transformers, Control Flow Graph Isomorphism Networks, and System Call Embeddings: A Systematic Review of Zero-Day Malware Detection Frameworks","display_name":"Tri-Modal Contrastive Binary Analysis via Opcode Transformers, Control Flow Graph Isomorphism Networks, and System Call Embeddings: A Systematic Review of Zero-Day Malware Detection Frameworks","publication_year":2026,"publication_date":"2026-08-27","ids":{"openalex":"https://openalex.org/W7204460262","doi":"https://doi.org/10.21203/rs.3.rs-10549516/v1"},"language":"en","primary_location":{"id":"doi:10.21203/rs.3.rs-10549516/v1","doi":"https://doi.org/10.21203/rs.3.rs-10549516/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-10549516/v1","pdf_url":"https://www.researchsquare.com/article/rs-10549516/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://www.researchsquare.com/article/rs-10549516/latest.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5054732598","display_name":"Harish Parshuram Bhabad","orcid":"https://orcid.org/0009-0008-2849-7027","observed_orcids":["https://orcid.org/0009-0008-2849-7027"]},"institutions":[{"id":"https://openalex.org/I4405263547","display_name":"Sandip Institute of Technology & Research Centre","ror":"https://ror.org/02ktpzh13","country_code":"IN","type":"education","lineage":["https://openalex.org/I2802982682","https://openalex.org/I4405263547"]}],"countries":["IN"],"is_corresponding":true,"raw_author_name":"Harish Parshuram Bhabad","raw_affiliation_strings":["Sandip Institute of Technology & Research Centre"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sandip Institute of Technology & Research Centre","institution_ids":["https://openalex.org/I4405263547"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5148425931","display_name":"Atmeshkumar Subhashbhai Patel","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4405263547","display_name":"Sandip Institute of Technology & Research Centre","ror":"https://ror.org/02ktpzh13","country_code":"IN","type":"education","lineage":["https://openalex.org/I2802982682","https://openalex.org/I4405263547"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Atmeshkumar Subhashbhai Patel","raw_affiliation_strings":["Sandip Institute of Technology & Research Centre"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sandip Institute of Technology & Research Centre","institution_ids":["https://openalex.org/I4405263547"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137036779","display_name":"Vijay M. Rakhade","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4405263547","display_name":"Sandip Institute of Technology & Research Centre","ror":"https://ror.org/02ktpzh13","country_code":"IN","type":"education","lineage":["https://openalex.org/I2802982682","https://openalex.org/I4405263547"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Vijay M. Rakhade","raw_affiliation_strings":["Sandip Institute of Technology & Research Centre"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sandip Institute of Technology & Research Centre","institution_ids":["https://openalex.org/I4405263547"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130381172","display_name":"Rupesh Kohli","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4405263547","display_name":"Sandip Institute of Technology & Research Centre","ror":"https://ror.org/02ktpzh13","country_code":"IN","type":"education","lineage":["https://openalex.org/I2802982682","https://openalex.org/I4405263547"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Rupesh Kohli","raw_affiliation_strings":["Sandip Institute of Technology & Research Centre"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sandip Institute of Technology & Research Centre","institution_ids":["https://openalex.org/I4405263547"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5040480122","display_name":"Nandini S. Patil","orcid":"https://orcid.org/0000-0002-8606-5774","observed_orcids":["https://orcid.org/0000-0002-8606-5774"]},"institutions":[{"id":"https://openalex.org/I4405263547","display_name":"Sandip Institute of Technology & Research Centre","ror":"https://ror.org/02ktpzh13","country_code":"IN","type":"education","lineage":["https://openalex.org/I2802982682","https://openalex.org/I4405263547"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Nandini S. Patil","raw_affiliation_strings":["Sandip Institute of Technology & Research Centre"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sandip Institute of Technology & Research Centre","institution_ids":["https://openalex.org/I4405263547"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5054732598"],"corresponding_institution_ids":["https://openalex.org/I4405263547"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.00039999998989515007,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/zero-day-malware-detection","display_name":"zero-day malware detection","score":1.0},{"id":"https://openalex.org/keywords/multimodal-representation-learning","display_name":"multimodal representation learning","score":0.6119999885559082},{"id":"https://openalex.org/keywords/contrastive-learning","display_name":"contrastive learning","score":0.7279999852180481},{"id":"https://openalex.org/keywords/infonce-loss","display_name":"InfoNCE loss","score":0.921999990940094},{"id":"https://openalex.org/keywords/code-obfuscation","display_name":"code obfuscation","score":0.7329999804496765},{"id":"https://openalex.org/keywords/binary-reverse-engineering","display_name":"binary reverse engineering","score":0.48399999737739563},{"id":"https://openalex.org/keywords/attention-based-fusion","display_name":"attention fusion","score":0.375},{"id":"https://openalex.org/keywords/threat-intelligence","display_name":"threat intelligence","score":0.3630000054836273}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8197000026702881},{"id":"https://openalex.org/C52173422","wikidata":"https://www.wikidata.org/wiki/Q766483","display_name":"Opcode","level":2,"score":0.6586999893188477},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5001999735832214},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.4616999924182892},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4237000048160553},{"id":"https://openalex.org/C27458966","wikidata":"https://www.wikidata.org/wiki/Q1187693","display_name":"Control flow graph","level":2,"score":0.40869998931884766},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3756999969482422},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3732999861240387},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.364300012588501},{"id":"https://openalex.org/C184898388","wikidata":"https://www.wikidata.org/wiki/Q1435712","display_name":"Pairwise comparison","level":2,"score":0.35670000314712524},{"id":"https://openalex.org/C160191386","wikidata":"https://www.wikidata.org/wiki/Q868299","display_name":"Control flow","level":2,"score":0.35530000925064087},{"id":"https://openalex.org/C63435697","wikidata":"https://www.wikidata.org/wiki/Q864135","display_name":"Binary code","level":3,"score":0.35359999537467957},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.3499000072479248},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.3409999907016754},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.323199987411499},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.32260000705718994},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.32019999623298645},{"id":"https://openalex.org/C66322947","wikidata":"https://www.wikidata.org/wiki/Q11658","display_name":"Transformer","level":3,"score":0.3165999948978424},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.3068000078201294},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.3050000071525574},{"id":"https://openalex.org/C86251818","wikidata":"https://www.wikidata.org/wiki/Q816754","display_name":"Benchmarking","level":2,"score":0.30250000953674316},{"id":"https://openalex.org/C43364308","wikidata":"https://www.wikidata.org/wiki/Q8799","display_name":"Byte","level":2,"score":0.30070000886917114},{"id":"https://openalex.org/C61665672","wikidata":"https://www.wikidata.org/wiki/Q303100","display_name":"Graph isomorphism","level":4,"score":0.29760000109672546},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.29589998722076416},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.29429998993873596},{"id":"https://openalex.org/C131992880","wikidata":"https://www.wikidata.org/wiki/Q2528185","display_name":"Subgraph isomorphism problem","level":3,"score":0.28610000014305115},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.28519999980926514},{"id":"https://openalex.org/C55282118","wikidata":"https://www.wikidata.org/wiki/Q252683","display_name":"Snapshot (computer storage)","level":2,"score":0.28439998626708984},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.2822999954223633},{"id":"https://openalex.org/C141141315","wikidata":"https://www.wikidata.org/wiki/Q2379942","display_name":"Guard (computer science)","level":2,"score":0.2808000147342682},{"id":"https://openalex.org/C119024030","wikidata":"https://www.wikidata.org/wiki/Q759899","display_name":"Call stack","level":3,"score":0.2694000005722046},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.26460000872612},{"id":"https://openalex.org/C157657479","wikidata":"https://www.wikidata.org/wiki/Q2367247","display_name":"Closed captioning","level":3,"score":0.2587999999523163},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.2565000057220459}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.21203/rs.3.rs-10549516/v1","doi":"https://doi.org/10.21203/rs.3.rs-10549516/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-10549516/v1","pdf_url":"https://www.researchsquare.com/article/rs-10549516/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"}],"best_oa_location":{"id":"doi:10.21203/rs.3.rs-10549516/v1","doi":"https://doi.org/10.21203/rs.3.rs-10549516/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-10549516/v1","pdf_url":"https://www.researchsquare.com/article/rs-10549516/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"sustainable_development_goals":[],"study_designs":[{"id":"https://openalex.org/study-designs/systematic-review","display_name":"Systematic Review"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7204460262.pdf","grobid_xml":"https://content.openalex.org/works/W7204460262.grobid-xml"},"referenced_works_count":58,"referenced_works":["https://openalex.org/W2727121960","https://openalex.org/W2909482470","https://openalex.org/W2921423961","https://openalex.org/W2969904462","https://openalex.org/W3007192161","https://openalex.org/W3010881140","https://openalex.org/W3092126821","https://openalex.org/W3108671495","https://openalex.org/W3109757793","https://openalex.org/W3122748539","https://openalex.org/W3129442285","https://openalex.org/W3134215180","https://openalex.org/W3161355202","https://openalex.org/W3185475590","https://openalex.org/W3199224805","https://openalex.org/W3203322735","https://openalex.org/W4200050214","https://openalex.org/W4200493858","https://openalex.org/W4205737303","https://openalex.org/W4205755139","https://openalex.org/W4238979297","https://openalex.org/W4240086558","https://openalex.org/W4293106276","https://openalex.org/W4318811674","https://openalex.org/W4319025240","https://openalex.org/W4365512282","https://openalex.org/W4366203278","https://openalex.org/W4389580099","https://openalex.org/W4391303630","https://openalex.org/W4393276298","https://openalex.org/W4393337521","https://openalex.org/W4394994826","https://openalex.org/W4399459127","https://openalex.org/W4400578242","https://openalex.org/W4400615360","https://openalex.org/W4404036959","https://openalex.org/W4407518214","https://openalex.org/W4407951186","https://openalex.org/W4408398975","https://openalex.org/W4410249065","https://openalex.org/W4410295942","https://openalex.org/W4412623955","https://openalex.org/W4414271388","https://openalex.org/W4414743566","https://openalex.org/W4415376369","https://openalex.org/W4415883751","https://openalex.org/W4416534002","https://openalex.org/W7108077559","https://openalex.org/W7117158736","https://openalex.org/W7128505394","https://openalex.org/W7131797804","https://openalex.org/W7148938879","https://openalex.org/W7160430514","https://openalex.org/W7161229965","https://openalex.org/W7167889047","https://openalex.org/W7169725973","https://openalex.org/W7170149390","https://openalex.org/W7171699718"],"related_works":["https://openalex.org/W7220423630","https://openalex.org/W7221357137","https://openalex.org/W7131134623","https://openalex.org/W2901737544","https://openalex.org/W7162469930","https://openalex.org/W7214744115","https://openalex.org/W7171865457","https://openalex.org/W7163323697","https://openalex.org/W7087565185","https://openalex.org/W7205013467"],"abstract_inverted_index":{"Abstract":[0],"Identifying":[1],"zero-day":[2],"malware":[3],"variants":[4],"and":[5,67,89,114,142,152,186],"reverse-engineering":[6],"compiled":[7],"binaries":[8],"requires":[9],"robust":[10],"code":[11],"similarity":[12],"analysis.":[13],"Legacy":[14],"inspection":[15],"pipelines":[16],"evaluate":[17],"software":[18],"through":[19,97],"isolated":[20],"feature":[21,108],"streams---such":[22],"as":[23,182],"disassembly":[24],"byte":[25],"flows,":[26],"control-flow":[27,43,140],"graphs,":[28,66],"or":[29,45],"dynamic":[30],"execution":[31],"logs.":[32],"Unimodal":[33],"analysis":[34],"fails":[35],"when":[36],"attackers":[37],"apply":[38],"UPX":[39],"packing,":[40],"instruction":[41,184],"substitution,":[42],"flattening,":[44],"sandbox-stalling":[46],"logic.":[47],"To":[48],"overcome":[49],"single-perspective":[50],"blind":[51],"spots,":[52],"recent":[53],"security":[54],"systems":[55,106],"adopt":[56],"Multi-Modal":[57],"Binary":[58],"Similarity":[59],"Analysis":[60],"(MMBSA),":[61],"embedding":[62],"static":[63],"syntax,":[64],"structural":[65],"runtime":[68],"behavior":[69],"into":[70],"unified":[71],"neural":[72,111],"latent":[73],"spaces.":[74],"Guided":[75],"by":[76,107,177],"the":[77,121],"PRISMA":[78],"2020":[79,96],"framework,":[80],"this":[81],"systematic":[82],"review":[83],"synthesizes":[84],"15":[85],"primary":[86],"benchmark":[87],"frameworks":[88],"over":[90],"50":[91],"core":[92],"papers":[93],"published":[94],"from":[95],"2026.":[98],"We":[99,175],"construct":[100],"a":[101],"three-axis":[102],"taxonomy":[103],"organizing":[104],"existing":[105],"ingestion":[109],"streams,":[110],"fusion":[112,164],"strategies,":[113],"downstream":[115],"tasks.":[116],"In":[117],"addition,":[118],"we":[119],"detail":[120],"mathematical":[122],"mechanics":[123],"of":[124],"Tri-Modal":[125],"Contrastive":[126],"Representation":[127,155],"Alignment.":[128],"This":[129],"framework":[130],"aligns":[131],"NLP":[132],"Transformers":[133],"(assembly":[134],"opcodes),":[135],"Graph":[136],"Isomorphism":[137],"Networks":[138],"(topological":[139],"graphs),":[141],"Bidirectional":[143],"LSTMs":[144],"(runtime":[145],"syscall":[146],"sequences)":[147],"using":[148],"pairwise":[149],"InfoNCE":[150],"loss":[151],"Volumetric":[153],"Gramian":[154],"Alignment":[156],"Measures":[157],"(GRAM).":[158],"Empirical":[159],"evidence":[160],"shows":[161],"that":[162],"attention-gated":[163],"maintains":[165],"high":[166],"detection":[167],"accuracy":[168],"(>98.5%)":[169],"even":[170],"under":[171],"severe":[172],"single-channel":[173],"obfuscation.":[174],"conclude":[176],"identifying":[178],"practical":[179],"deployment":[180],"bottlenecks---such":[181],"cross-ISA":[183],"drift":[185],"GPU":[187],"memory":[188],"limits":[189],"on":[190],"large":[191],"graphs---and":[192],"outlining":[193],"targeted":[194],"paths":[195],"for":[196],"production-grade":[197],"threat":[198],"intelligence":[199],"systems.":[200]},"counts_by_year":[],"updated_date":"2026-11-12T12:28:57.059296","created_date":"2026-08-28T00:00:00"}