## 1 Introduction  
Malware producers are ever more motivated to create new variants of malware, in order to gain profits from unauthorized information stealth. According to the malware detection agency AV Test ([[https://www.av-test.org/en/statistics/malware/](https://www.av-test.org/en/statistics/malware/)]([https://www.av-test.org/en/statistics/malware/](https://www.av-test.org/en/statistics/malware/)) (accessed on 1 July 2021)), 100 million new variants of malware were generated from January to October 2020, which translates as roughly three thousand new malware daily. In particular, we have witnessed the fast growth of mobile-based malware. An NTSC report published in 2020 ([[https://www.ntsc.org/assets/pdfs/cyber-security-report-2020.pdf](https://www.ntsc.org/assets/pdfs/cyber-security-report-2020.pdf)]([https://www.ntsc.org/assets/pdfs/cyber-security-report-2020.pdf](https://www.ntsc.org/assets/pdfs/cyber-security-report-2020.pdf)) (accessed on 15 June 2021)) reported that 27% of organizations globally have been impacted by malware attacks sent via Android mobile devices. In recent times, we have seen malware producers employ techniques such as obfuscation [1, 2, 3] and repackaging [4, 5, 6], mostly through the change of static features [7, 8, 9], to avoid detection. In response to the trend in the growth of mobile-based malware attacks, numerous Artificial Intelligence (AI)-based defense techniques have been proposed [10, 11, 12, 13, 14, 15]. We argue that there are two main issues to be addressed in the existing state-of-the-art of AI-based mobile malware attack defense. The first issue is that most of the existing research tends to focus on learning from common semantic information about the generic features of malware families, and building feature embeddings [16; 17; 18]. In this context, 'feature embedding' means the features contained in a malware binary sample, which provide important clues as to whether the malware image--generated from the hexdump utility that displays the contents of binary files in hexadecimal, from which feature embedding is created--is malicious or not: if malicious, what type of malware family it belongs to is assessed, to build the right set of response strategies. These existing works often treat the fraction of the code changed by the obfuscation and repackaging as a type of noise [19], and thus tend to ignore the effect of the modification: this is largely because the code changed by the obfuscation and repackaging techniques displays a similar appearance when malware visualization techniques are applied [20; 21; 22]. Using common semantic information as data input points to be fed into a deep neural network cannot capture the unique characteristics of each malware family signature: thus, they will not be able to accurately classify many variants arising from the same malware family [10; 23; 24; 25], especially if an obfuscation technique is applied. The second issue with the existing approaches is the demand for large data input, with which to find more relevant correlations across the features: such input is unable to detect and classify malware families trained with a limited number of samples (e.g., newly emerging variants of malware) [26]. To address these two important issues, we propose a novel task-aware few-shot-learning based Siamese neural network, capable of detecting obfuscated malware variants belonging to the same malware family, even if only a small number of training samples are available. The contributions of our proposed model are as follows:  
* Our task-aware meta-learner network combines entropy attributes with image-based features for malware detection and classification.