# A Multimodal Framework for Advanced Cybersecurity Threat Detection Using GAN-Driven Data Synthesis
## 3 Proposed Methodology
### Fusion Output and Decision Logic  
The Fusion and Decision Logic constitutes one important layer for the final decision that has been extracted from the suggested pipeline. When both malware image and tabular data are available for the same input instance, their respective predictions are merged at the decision level using a confidence-weighted averaging strategy. This method calculates the final threat classification by averaging the probability score outputs extracted by the two branches, the image-based and tabular-based, and assigning greater weight to predictions made with higher classifier confidence. This strategy provides a balanced and probabilistic fusion mechanism that accommodates uncertainty in individual predictions, rather than relying on fixed thresholds or rigorous logic.  
This probabilistic fusion ensures that threats indicated with high certainty in one modality are properly weighed even when the other modality shows uncertainty. By prioritizing average confidence scores, the system mitigates false positives from noisy  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Classifier** & **Key Parameters** & **Value(s)** \\ \hline KNN & Number of Neighbors (k) & 5 \\ SVC & Kernel Type & RBF \\ RF & Number of Trees, Max Depth & 100 trees, depth = 15 \\ DT & Max Depth, Split Criterion & Depth = 10, Gini Index \\ SGD & Loss Function, Learning Rate & Hinge, 0.01 \\ \hline \hline \end{tabular}
\end{table}
Table 6: Configuration Summary of Soft-Voting Ensemble Classifiers.  
inputs, while strengthening the decision boundary in ambiguous cases. Also, this approach balances sensitivity and accuracy while preserving real-time operability.  
In cases where only one input modality is available, because of possible sensor limitations, missing data, or partial logs, the available branch processes the input independently and provides the final prediction. The fusion module is bypassed in such cases, and the system adjusts seamlessly to maintain functional reliability under partial input conditions.  
Moreover, several alternative methods can be applied at the decision-level fusion stage of multimodal threat detection systems, including:  
* **Majority Voting:** Combines binary predictions from multiple branches and selects the majority class as the final decision [40]
* **Confidence-Weighted Averaging:** Averages probability scores from each branch, giving higher influence to more confident predictions [41; 42]
* **Bayesian Inference:** Models each branch as a probabilistic source and uses posterior distributions to infer the most likely class [43]
* **Dempster-Shafer Theory:** Applies evidence theory to combine beliefs from different branches, accounting for uncertainty and conflict [44]
* **Rule-Based Method:** Applies logical rules (e.g., OR) to combine binary decisions from multiple branches [45]  
During the experimental section of this study in Section 4, we focus on evaluating three representative fusion methods: the Rule-Based (Boolean) approach for simplicity and explainability, Majority Voting for ensemble-orientation consensus, and Confidence-Weighted Averaging to incorporate probabilistic certainty in decision-making. These methods are benchmarked and compared to identify the most effective strategy for robust multimodal threat detection within the Fusion layer.