F low M al T rans: Unsupervised Binary Code Translation for Malware Detection Using Flow-Adapter Architecture (2025)

Abstract: Applying deep learning to malware detection has drawn great attention due to its notable performance. With the increasing prevalence of cyberattacks targeting IoT devices, there is a parallel rise in the development of malware across various Instruction Set Architectures (ISAs). It is thus important to extend malware detection capacity to multiple ISAs. However, training a deep learning-based malware detection model usually requires a large number of labeled malware samples. The process of collecting and labeling sufficient malware samples to build datasets for each ISA is labor-intensive and time-consuming. To reduce the burden of data collection, we propose to leverage the ideas of Neural Machine Translation (NMT) and Normalizing Flows (NFs) for malware detection. Specifically, when dealing with malware in a certain ISA, we translate it to an ISA with sufficient malware samples (like X86-64). This allows us to apply a model trained on one ISA to analyze malware from another ISA. Our approach reduces the data collection effort by enabling malware detection across multiple ISAs using a model trained on a single ISA.

## introduction malware is defined as software intended to damage computers or associated systems @xcite . in recent years, many malware detection tools have been developed @xcite , and their success largely depends on the underlying techniques. signature-based detection identifies malware by matching patterns from known malware families @xcite , but it often fails to detect altered or novel malware. in contrast, behavior-based detection analyzes program execution to identify suspicious behavior @xcite , yet this method lacks scalability. the use of deep learning methods like lstm and cnns in malware detection has garnered significant interest because of their strong performance @xcite . however, there are two major challenges that hinder the broader adoption of deep learning in this domain. challenges. malware infects a broad range of instruction set architectures (isas). with the rise in cyberattacks on iot devices and computer systems @xcite @xcite @xcite @xcite , malware has begun targeting an increasing number of isas @xcite . hence, it is essential to enable malware detection across isas. currently, there are numerous isas available @xcite . due to this wide variety, training one model for each isa demands substantial time and effort. in addition, deep learning models rely heavily on having enough malware samples during training, which is problematic for low-resource isas where such data is limited. our approach. malware is generally closedsource whose original source code is typically inaccessible. what is available is the binary form of the malware. once disassembled, this binary can be represented in assembly language. based on this observation, we propose leveraging neural machine translation (nmt) techniques @xcite to facilitate malware analysis. when handling a binary in a given isa (referred to as the source isa), we translate it to an isa with rich malware samples, such as x86-64, which we refer to as the target isa. once translated, we use a model trained on the target isa to test the translated code. this approach facilitates malware detection across multiple isas using a model trained exclusively on the target isa, eliminating the need for extensive malware samples in other isas. in order to capture isa-specific syntax and semantic information, we leverage normalizing flows (nfs), a class of invertible transformations that models complex distributions while maintaining tractability. traditional translation models often struggle with capturing complex dependencies and handling the variation in data distributions. nfs address this challenge by modeling complex, highdimensional distributions through invertible transformations, enabling more efficient learning of intricate relationships between source and target data. by doing so, we ensure a smooth and structured mapping between isas, leading to more precise and reliable translations. furthermore, normalizing flows enable efficient sampling and density estimation, which improves the adaptability of our model to unseen binaries and enhances generalization across different architectures. we design flowmaltrans, which is a flowadapter-based unsupervised binary code translation architecture. this design allows for robust feature alignment between different isas, improving translation fidelity and ultimately enhancing malware detection across isas. to bridge the gap between the latent space of the source and target isa, flowmaltrans learns an invertible transformation of binary representations from one isa to another, facilitating robust feature alignment across different isas and enhancing translation fidelity. flowmaltrans operates in a completely unsupervised manner, eliminating the need for parallel datasets. notably, the training of flowmaltrans does not require any malware samples and relies only on binaries compiled from the abundance of opensource programs. despite never encountering any malware samples during training, flowmaltrans is still capable of translating malware across isas with high translation quality. results. we have implemented flowmaltrans, and evaluated its performance on seven isas, including x86-64, i386, arm32, arm64, mips32, ppc32 and m68k. flowmaltrans achieves higher bleu score than the baseline method unsuperbintrans @xcite . furthermore, we apply flowmaltrans to the malware detection task and achieve exceptional results, highlighting its superior translation quality, which enables highly effective malware detection across isas. below we highlight our contributions: ## model design we present the design and training of flowmaltrans. notably, training flowmaltrans requires only mono-architecture datasets for each isa, without the need for any malware samples. ## conclusion and future work we proposed flowmaltrans, a flow-adapterbased unsupervised binary code translation model. flowmaltrans incorporates normalizing flows (nfs) to model the basic block-level representations, enhancing its code translation capability. we train flowmaltrans to translate binaries from other isas to x86-64, and reuse a malware detection model trained on x86-64 to test the translated code. our approach effectively reduces the burden of data collection and achieves better malware detection across isas than prior state of the arts. large language models (llms) show extraordinary capability at coding tasks and are widely utilized @xcite @xcite . we leave using llm for binary code translation as future work.