Tri-Modal Contrastive Binary Analysis via Opcode Transformers, Control Flow Graph Isomorphism Networks, and System Call Embeddings: A Systematic Review of Zero-Day Malware Detection Frameworks
Year: 2026
Type: preprint
Study design: Systematic Review
Abstract: Identifying zero-day malware variants and reverse-engineering compiled binaries requires robust code similarity analysis. Legacy inspection pipelines evaluate software through isolated feature streams---such as disassembly byte flows, control-flow graphs, or dynamic execution logs. Unimodal analysis fails when attackers apply UPX packing, instruction substitution, control-flow flattening, or sandbox-stalling logic. To overcome single-perspective blind spots, recent security systems adopt Multi-Modal Binary Similarity Analysis (MMBSA), embedding static syntax, structural graphs, and runtime behavior into unified neural latent spaces. Guided by the PRISMA 2020 framework, this systematic review synthesizes 15 primary benchmark frameworks and over 50 core papers published from 2020 through 2026. We construct a three-axis taxonomy organizing existing systems by feature ingestion streams, neural fusion strategies, and downstream tasks. In addition, we detail the mathematical mechanics of Tri-Modal Contrastive Representation Alignment. This framework aligns NLP Transformers (assembly opcodes), Graph Isomorphism Networks (topological control-flow graphs), and Bidirectional LSTMs (runtime syscall sequences) using pairwise InfoNCE loss and Volumetric Gramian Representation Alignment Measures (GRAM). Empirical evidence shows that attention-gated fusion maintains high detection accuracy (>98.5%) even under severe single-channel obfuscation. We conclude by identifying practical deployment bottlenecks---such as cross-ISA instruction drift and GPU memory limits on large graphs---and outlining targeted paths for production-grade threat intelligence systems.
Source: Research Square
Institution: Sandip Institute of Technology & Research Centre
Language: English
Subfield: Software
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7204460262