Symmetric Dual-Domain Prototype Adaptation for Few-Shot Image-Based Malware Classification

Abstract

Image-based malware classification converts binary software into visual representations, enabling deep visual models to be used for malware family recognition. However, reliable family-level annotation remains labor-intensive and expert-dependent, making it difficult to build large-scale, labeled malware-image datasets, especially for newly emerging families. To address this low-label setting, this paper proposes a dual-domain prototype adaptation (DDPA) framework for few-shot image-based malware family classification. DDPA is built on two frozen feature encoders obtained from asymmetric data conditions: a supervised encoder pretrained on large-scale labeled natural images to capture general visual representations, and a self-supervised contrastive encoder pretrained on unlabeled malware images to capture malware-domain representations. During downstream adaptation, the two domains are handled in a structurally symmetric manner to construct dual-domain prototypes for few-shot malware family prediction without training a task-specific classifier. Experiments on the ImageNet, Maldeb, and Malimg datasets validate the effectiveness of DDPA for few-shot malware family classification. Under the strict five-shot setting, DDPA achieves a Macro-F1 of 91.92% in a training-free manner, exceeding the strongest gradient-based and single-domain prototype baselines by 1.62 and 4.48 percentage points, respectively. Further analysis shows that the two prototype spaces derived from asymmetric data domains provide distinct yet complementary evidence under the symmetric downstream decision rule.

1. Introduction

Image-based malware analysis converts binary malware samples into grayscale or visual representations, thereby allowing mature deep learning techniques from computer vision to be introduced into malware detection and family classification [1,2,3]. However, unlike general image classification, reliable malware family annotation is not only labor-intensive but also expert-dependent, making large-scale, labeled datasets difficult to obtain [4,5,6,7]. This data condition makes self-supervised learning a natural solution, which can learn transferable representations from unlabeled malware images and then provide useful feature encoders for downstream classification tasks [8,9,10,11]. At the same time, real-world security monitoring often requires recognizing newly emerging malware families from only a few verified samples, where conventional fully supervised training is difficult to apply [12,13]. Prototype-based few-shot learning is well suited to this low-label scenario. It transfers decision ability from a small support set to unseen query samples by constructing class-level prototypes directly from limited labeled examples, enabling efficient malware family recognition without requiring a fully supervised downstream classifier [12,14,15].

Recent studies have shown that image-based representation learning, self-supervised pretraining, and prototype-based few-shot adaptation can substantially improve label-efficient malware family classification [12,15,16,17,18]. Nevertheless, most existing methods still make downstream decisions based on malware-image representations. When general visual representations from large-scale datasets such as ImageNet [19] are used, they are usually adopted as pretrained initializations or as standalone feature sources. Less attention has been paid to using them as a balanced counterpart to malware-domain representations in a dual-domain decision process.

Motivated by this observation, this paper proposes a dual-domain prototype adaptation (DDPA) framework for few-shot image-based malware family classification, aiming to study how two domains with asymmetric data conditions can be organized through a structurally symmetric prototype mechanism. Specifically, DDPA prepares two encoders with different pretraining paradigms: a supervised encoder for extracting general visual-domain representations from large-scale labeled natural images, and a self-supervised contrastive encoder for extracting malware-domain representations from unlabeled malware images. During downstream few-shot adaptation, both encoders are frozen, and a small support set is used to construct class prototypes in the two feature spaces without any parameter update. For an unseen query sample, DDPA computes its cosine similarity to the visual-domain and malware-domain prototypes, fuses the two score vectors, and predicts the malware family according to the fused dual-domain score. This design avoids task-specific classifier training while providing a clear setting for examining whether symmetrically constructed prototype spaces can exploit complementary evidence from asymmetric data domains.

To verify the effectiveness and mechanism of the proposed framework, experiments are conducted on the ImageNet [19], Maldeb [20], and Malimg [21] datasets under few-shot malware family classification settings. The evaluation first examines whether DDPA, as a training-free dual-domain adaptation method, can achieve competitive or superior classification performance compared with representative gradient-based and single-domain prototype baselines. The performance–cost trade-off is then analyzed by measuring adaptation time, peak GPU memory, trainable parameters, and gradient steps across different adaptation paradigms. Beyond overall performance, the analysis further investigates how prototypes derived from two asymmetric data domains, i.e., general visual images and malware images, behave under a symmetric downstream prototype rule. The results show that DDPA provides strong few-shot recognition performance, while the class-level and sample-level analyses further reveal that the two prototype spaces offer distinct and complementary evidence for malware family prediction.

The main contributions are summarized as follows:

• A dual-domain prototype modeling perspective is introduced for few-shot image-based malware family classification. Supervised general visual representations and self-supervised malware-domain representations are organized as two frozen prototype spaces, rather than being used only as initialization sources or isolated single-domain features. This formulation connects asymmetric data conditions with a structurally symmetric downstream decision process.
• A training-free DDPA framework is proposed to implement this perspective. Class prototypes are constructed in the general visual and malware-domain feature spaces from the same support set, prototype-based similarity scores are computed in both domains, and the two score vectors are fused for query prediction.
• A systematic experimental analysis is conducted from both effectiveness and mechanism perspectives. DDPA is compared with representative gradient-based and single-domain prototype baselines across different shot budgets, and its deployment cost is evaluated in terms of adaptation time, peak GPU memory, trainable parameters, and gradient steps. In addition, support–query generalization behavior and class-level and sample-level dual-domain complementarity are analyzed to explain when and why the two prototype spaces provide non-redundant evidence.

2. Related Work

2.1. Image-Based Malware Detection and Visual Representation Learning

Image-based malware detection converts binary software content into visual representations, allowing malware analysis to benefit from mature computer vision models. The seminal work of Nataraj et al. [21] showed that malware binaries can be visualized as grayscale images and that samples from the same family often exhibit visually similar textures and layouts. This observation motivated a line of deep visual malware classification methods. Representative studies then extended this idea from handcrafted visual similarity to deep visual representation learning: Kalash et al. [16] employed deep convolutional neural networks to learn discriminative malware-image features, Cui et al. [17] used deep learning to detect malicious code variants from visualized representations, and Rezende et al. [22] transferred an ImageNet-pretrained ResNet-50 to malware image classification, indicating that both domain-specific visual patterns and general visual priors can support malware family recognition. Recent studies have further explored more advanced and deployable visual backbones, including lightweight vision transformers for malware detection on edge devices [23] and masked self-supervised Swin Transformer frameworks for image-based malware classification [18]. At the same time, recent surveys have summarized the broader trend that deep learning has become a major direction for malware detection across desktop and mobile platforms [24].

These studies establish the value of visual representation learning for malware analysis, but most of them still treat image-based malware detection as a single-domain visual classification problem. In particular, ImageNet-derived representations are often used as initialization or as a standalone feature source, while their relationship with malware-domain representations is rarely examined at the prototype-space level. In contrast to this line of work, this study treats the supervised ImageNet-derived representation as one frozen prototype space and studies how it can complement a malware-domain prototype space learned from unlabeled malware images.

2.2. Self-Supervised and Label-Efficient Malware Representation Learning

Self-supervised learning provides an effective way to exploit large-scale unlabeled data, which is especially relevant to malware analysis because reliable family-level labels are costly to obtain. In computer vision, contrastive learning frameworks such as SimCLR [25] and MoCo [26] demonstrated that useful representations can be learned by enforcing consistency between different views of the same instance without manual labels. This idea has been introduced into malware analysis in recent years. EVOLIoT [27] applied self-supervised contrastive learning to evolving IoT malware variants, while MalSSL [20] explored self-supervised learning for accurate and label-efficient malware classification using image representations. MalSort [18] further showed that masked self-supervised learning with transformer-based visual backbones can improve image-based malware classification when labeled samples are expensive.

Unlike studies that mainly use self-supervised learning to obtain a malware-domain encoder for downstream classifier training or single-domain classification, this study focuses on how such representations can be used as a frozen prototype space under strict few-shot supervision. The self-supervised malware-domain prototype space is not used in isolation; instead, it is paired with a supervised general visual prototype space and combined through training-free score fusion. In this way, the proposed method keeps the advantage of learning from unlabeled malware images while further examining whether malware-domain representations and general visual representations can provide complementary evidence for low-label malware family recognition.

2.3. Few-Shot and Prototype-Based Malware Family Classification

Few-shot learning aims to recognize new classes from only a few labeled examples, and prototypical networks provide a simple and influential solution by representing each class with a prototype in an embedding space [14]. This paradigm is well aligned with malware family recognition, where newly observed families may have only a small number of verified samples. General few-shot learning research has also emphasized the importance of adapting to open and dynamic environments [28]. In malware analysis, Conti et al. [12] investigated few-shot malware classification for unknown family recognition using malware feature visualization. More recent studies have extended prototype-based malware recognition with graph-based sample adaptation [15], Android malware image representations [29], and multimodal dynamic prototype modeling [30]. These works show that few-shot and prototype-based learning have become an active direction for malware family classification.

However, existing few-shot malware classification methods usually rely on a single feature space, task-specific adaptation modules, graph propagation, or multimodal prototype mechanisms. Comparatively less attention has been paid to a structurally symmetric dual-domain prototype design in which two frozen encoders are obtained from different data conditions and then used under the same downstream prototype rule. Moreover, few studies jointly analyze performance, deployment cost, support–query generalization behavior, and class-level or sample-level complementarity. The framework proposed in this study is designed to fill this gap by using two frozen prototype spaces, training-free score fusion, and a systematic experimental analysis of when and why the two domains provide non-redundant evidence.

3. Methods

3.1. Problem Formulation and Overall Framework

This study considers image-based few-shot malware family classification. Given a C-way K-shot task, the support set is defined as

$$S=\{(x_i,y_i)\mid i\in \{1,\dots ,C\times K\}\},$$

(1)

where $x_i$ denotes an image-based malware sample and $y_i\in \{1,\dots ,C\}$ denotes its family label. For each family, only K labeled samples are available. The query set is defined as

$$Q=\{x_j\mid j\in \{1,\dots ,N_q\},x_j\notin \{x_i\mid (x_i,y_i)\in S\}\},$$

(2)

where the labels of query samples are inaccessible during prediction and are used only for evaluation. The goal is to predict the family label of each query sample by using only the limited labeled information in the support set.

To address this problem, we propose a dual-domain prototype adaptation (DDPA) framework, as illustrated in Figure 1. The framework is motivated by a practical difference between the two data domains used in this study. In the general visual domain, large-scale labeled image datasets such as ImageNet are readily available, making supervised pretraining a natural choice for learning transferable visual patterns. In contrast, large-scale malware-image collections are usually much easier to obtain than reliable family-level annotations, because accurate malware labeling often requires expert analysis. Therefore, DDPA uses two training paradigms that match the characteristics of the corresponding data sources: a supervised ImageNet-pretrained encoder is used to capture general visual-domain representations, while a self-supervised contrastive encoder pretrained on unlabeled Maldeb samples is used to capture malware-domain representations. Both encoders are then frozen and introduced into the downstream few-shot task.

Figure 1. Overall framework of the proposed DDPA method. The framework first prepares two frozen encoders from asymmetric data conditions, then performs symmetric dual-domain prototype modeling on a C-way K-shot support set, and finally applies training-free score fusion for query prediction.

Given the same support set, DDPA constructs class prototypes in two independent feature spaces and combines the two prototype-based similarity scores for prediction. As illustrated in Figure 1, the overall process contains three stages: asymmetric-domain encoder preparation, symmetric few-shot dual-domain prototype modeling, and training-free dual-domain score fusion. This design separates representation learning from downstream task adaptation: large-scale labeled natural images and unlabeled malware images are used before deployment, while only a few labeled malware samples are required when adapting to a new few-shot classification task.

The key design principle is to treat the two domains in a structurally symmetric manner during downstream adaptation. Both domains receive the same support samples, use the same prototype construction rule, and produce class-level similarity scores with the same decision format. This symmetric construction avoids assigning an a priori preference to either domain. At the same time, the two domains may provide asymmetric evidence for different malware families and query samples. DDPA therefore aims to preserve the stability of two frozen prototype spaces while allowing their complementary evidence to contribute to the final decision.

3.2. Dual-Domain Frozen Feature Encoders

DDPA relies on two frozen feature encoders whose training paradigms match the data characteristics of two different domains. In the general visual domain, large-scale labeled image datasets are readily available, making supervised pretraining a reliable way to learn transferable visual representations. In the image-based malware domain, however, large collections of software samples can be converted into images, but accurate family-level labels are much more difficult and costly to obtain. This asymmetry in label availability motivates the use of supervised learning for the general visual encoder and self-supervised learning for the malware-domain encoder. Mathematically, the two encoders are denoted by $f^{\mathrm{vis}}:\mathcal{X}\to {\mathbb{R}}^{512}$ and $f^{\mathrm{mal}}:\mathcal{X}\to {\mathbb{R}}^{512}$, where $\mathcal{X}$ is the malware-image input space.

The first encoder, denoted by $f^{\mathrm{vis}}$, is a general visual-domain encoder obtained from supervised pretraining on ImageNet. Although image-based malware samples differ from natural images in semantic content, they still contain visual patterns such as local textures, edges, contours, and coarse structural layouts. A supervised ImageNet-pretrained encoder can therefore provide general visual priors for representing these low-level and mid-level patterns, which may remain useful after malware binaries are mapped into image form.

The second encoder, denoted by $f^{\mathrm{mal}}$, is a malware-domain encoder pretrained on Maldeb using SimCLR-based self-supervised contrastive learning. This choice reflects the data condition of malware analysis: unlabeled malware-image samples are easier to collect at scale than reliably labeled family samples. By learning from different augmented views of malware images without using family labels, the malware-domain encoder is encouraged to capture representation patterns associated with binary-structure images. Thus, the two encoders provide complementary sources of knowledge: one from supervised general visual data and the other from self-supervised malware-domain data.

After pretraining, the final classification layer is removed from each encoder, and the remaining backbone is used as a frozen feature extractor. For an input malware image x, the two normalized feature vectors are defined as

$${\mathbf{z}}^{\mathrm{vis}}\left(x\right)={\displaystyle \frac{f^{\mathrm{vis}}\left(x\right)}{{∥f^{\mathrm{vis}}\left(x\right)∥}_2}},$$

(3)

$${\mathbf{z}}^{\mathrm{mal}}\left(x\right)={\displaystyle \frac{f^{\mathrm{mal}}\left(x\right)}{{∥f^{\mathrm{mal}}\left(x\right)∥}_2}}.$$

(4)

Here, ${\parallel ·\parallel }_2$ denotes the Euclidean norm, and both feature vectors are 512-dimensional in this study. The $L_2$ normalization makes cosine similarity equivalent to the inner product, which provides a stable basis for prototype comparison in the following steps. During downstream few-shot adaptation, both encoders remain frozen and no gradient update is applied to either feature extractor.

3.3. Symmetric Dual-Domain Prototype Modeling

3.3.1. Symmetric Prototype Construction in Two Feature Spaces

Given the support set S, DDPA constructs one class prototype for each malware family in each feature space. For class c, let

$$S_c=\{x_i\mid y_i=c\}$$

(5)

denote the support samples belonging to class c. In the general visual feature space, the prototype of class c is computed by averaging the normalized support features and then normalizing the resulting vector:

$${\mathbf{p}}_c^{\mathrm{vis}}={\displaystyle \frac{\frac{1}{|S_c|}{\sum }_{x_i\in S_c}{\mathbf{z}}^{\mathrm{vis}}\left(x_i\right)}{{∥\frac{1}{|S_c|}{\sum }_{x_i\in S_c}{\mathbf{z}}^{\mathrm{vis}}\left(x_i\right)∥}_2}}.$$

(6)

Similarly, in the malware-domain feature space, the prototype of class c is defined as

$${\mathbf{p}}_c^{\mathrm{mal}}={\displaystyle \frac{\frac{1}{|S_c|}{\sum }_{x_i\in S_c}{\mathbf{z}}^{\mathrm{mal}}\left(x_i\right)}{{∥\frac{1}{|S_c|}{\sum }_{x_i\in S_c}{\mathbf{z}}^{\mathrm{mal}}\left(x_i\right)∥}_2}}.$$

(7)

Although each support feature is already $L_2$-normalized, the average of multiple unit vectors is not necessarily unit-norm. The outer $L_2$ normalization therefore maps each class prototype back to the same unit hypersphere as the query features.

This construction is symmetric across the two domains. The same support set, the same averaging rule, and the same normalization operation are used in both feature spaces. The only difference lies in the encoder that maps the malware image into the corresponding representation space. This design is important because it ensures that the two domains are compared and fused under a balanced protocol, rather than being affected by different classifier structures or different adaptation procedures.

3.3.2. Dual-Domain Score Fusion and Prediction

For a query sample $x_q$, DDPA first computes its cosine similarity to each class prototype in the two feature spaces. Since both query features and class prototypes are $L_2$-normalized, the similarity scores can be written as

$$s_c^{\mathrm{vis}}\left(x_q\right)={\mathbf{z}}^{\mathrm{vis}}{\left(x_q\right)}^{\top }{\mathbf{p}}_c^{\mathrm{vis}},$$

(8)

$$s_c^{\mathrm{mal}}\left(x_q\right)={\mathbf{z}}^{\mathrm{mal}}{\left(x_q\right)}^{\top }{\mathbf{p}}_c^{\mathrm{mal}}.$$

(9)

Here, $s_c^{\mathrm{vis}}\left(x_q\right)$ measures the evidence that $x_q$ belongs to class c in the general visual space, while $s_c^{\mathrm{mal}}\left(x_q\right)$ measures the corresponding evidence in the malware-domain space. Because both vectors in each inner product are unit-normalized, ${\mathbf{z}}^{\top }\mathbf{p}$ is mathematically equivalent to $cos\left(\theta \right)$, where $\theta$ is the angle between the query feature and the corresponding class prototype.

The final dual-domain score is obtained by equal-weight score-level fusion:

$$s_c^{\mathrm{dual}}\left(x_q\right)={\displaystyle \frac{1}{2}}{s}_c^{\mathrm{vis}}\left(x_q\right)+{\displaystyle \frac{1}{2}}{s}_c^{\mathrm{mal}}\left(x_q\right).$$

(10)

The scalar $s_c^{\mathrm{dual}}\left(x_q\right)$ represents the fused prototype evidence for assigning query sample $x_q$ to class c. Since $s_c^{\mathrm{vis}}\left(x_q\right)$ and $s_c^{\mathrm{mal}}\left(x_q\right)$ are cosine similarities in $[-1,1]$, the fused score also satisfies $s_c^{\mathrm{dual}}\left(x_q\right)\in [-1,1]$. The predicted label is then assigned based on the maximum fused score:

$${\widehat{y}}_q=arg\underset{c\in \{1,\dots ,C\}}{max}{s}_c^{\mathrm{dual}}\left(x_q\right).$$

(11)

This argmax rule follows the standard prototype-based decision principle: the class with the largest fused score is treated as the class whose dual-domain prototypes provide the strongest evidence for the query sample. It therefore converts the fused similarity scores into a deterministic label prediction without introducing an additional trainable classifier or query-dependent threshold. If multiple classes obtain the same maximum fused score, the class with the smallest index is selected as a deterministic tie-breaking rule.

This fusion rule is deliberately simple. It does not introduce an additional trainable classifier, nor does it require query labels or task-specific parameter optimization. Instead, it asks whether two symmetrically constructed prototype spaces can provide complementary evidence under a fixed and transparent decision rule. This makes the subsequent empirical analysis easier to interpret: if DDPA improves over both single-domain prototypes, the gain can be attributed to the complementary information contained in the two feature spaces rather than to an additional optimization module. A nonlinear score pooling rule would introduce an additional transformation of the two cosine-similarity scores, whereas the fixed linear rule keeps the contribution of each prototype space directly interpretable. The sensitivity of this fixed operating point is further examined in Section 4.6.

3.4. Training-Free Symmetric Dual-Domain Adaptation

The downstream adaptation stage of DDPA is designed around two principles: training-free deployment and symmetric dual-domain decision making. The first principle addresses the deployment requirement of few-shot malware detection. After receiving a support set, DDPA only extracts frozen features, constructs class prototypes, computes prototype similarities, and fuses the two score vectors. It does not update the visual encoder or the malware-domain encoder, does not train an additional classification head, and does not perform backpropagation or optimizer steps. Therefore, the number of trainable parameters and the number of gradient steps during task adaptation are both zero.

This training-free property is important in low-label security monitoring scenarios. When a newly observed malware family has only a few verified samples, gradient-based adaptation may fit the limited support set but introduce additional time, memory, and optimization cost. In contrast, DDPA keeps representation learning and task adaptation separated. Large-scale data are used only before deployment to obtain frozen encoders, while a new few-shot task requires only support-side feature aggregation and prototype-based inference. For a C-way K-shot task with feature dimension d, DDPA constructs C prototypes in each of the two domains, leading to a prototype storage cost proportional to $2Cd$. For each query sample, prediction requires computing similarities to C prototypes in the visual feature space and C prototypes in the malware-domain feature space, followed by a lightweight score fusion step. Thus, compared with a single-domain prototype classifier, DDPA mainly introduces a small constant-factor increase, while still avoiding the much higher cost of downstream gradient optimization.

The second principle concerns how DDPA handles two domains with different data characteristics. The general visual domain and the image-based malware domain are not symmetric in terms of data availability: large-scale labeled natural images are readily available, whereas malware-image samples are easier to collect at scale than to label reliably at the family level. DDPA therefore does not force the two domains to share the same pretraining paradigm. Instead, it learns domain-specific frozen encoders according to the available supervision in each domain: supervised pretraining for the general visual encoder and self-supervised contrastive pretraining for the malware-domain encoder.

Although the two encoders are obtained from asymmetric data conditions, DDPA imposes symmetry at the downstream adaptation stage. Both domains receive the same support samples, use the same prototype construction rule, adopt the same cosine-similarity decision form, and contribute to the final prediction through the same score-level fusion rule. This design gives neither domain a structural advantage before prediction. If the two domains agree on an easy sample, the fused decision remains stable; if they provide different evidence on a difficult sample, the fused score can act as a training-free arbitration mechanism. In this sense, DDPA uses symmetric prototype modeling to exploit potentially asymmetric domain evidence.

These two design principles lead to empirical questions that are examined in the following experimental section. First, the few-shot performance comparison evaluates whether training-free dual-domain adaptation can remain competitive with gradient-based adaptation under different shot budgets. Second, the deployment-cost analysis tests whether the absence of downstream training leads to a better performance–cost trade-off. Third, the support–query gap analysis examines why gradient-based adaptation may not always convert support-set fitting into query-set generalization under strict few-shot supervision. Finally, the class-level and sample-level complementarity analyses verify whether the two symmetrically constructed prototype spaces provide non-redundant evidence for malware family prediction.

4. Experiments and Analysis

4.1. Experimental Setup

4.1.1. Datasets and Feature Encoders

Three public datasets are used in this study, and each dataset has a clearly separated role. ImageNet [19], a large-scale natural image dataset containing over 1.2 million labeled images from 1000 categories, is used to provide the supervised general visual encoder. This encoder captures generic low-level and mid-level visual patterns, such as edges, textures, and shape-related structures. Maldeb [20], a malware-image dataset containing 20,854 benign and malicious software samples converted into image representations, is used as an unlabeled malware-image corpus for self-supervised contrastive pretraining. From these dataset, the malware-domain encoder learns representation patterns related to binary-structure images. Malimg [21], a labeled malware-image dataset containing 9339 malware samples from 25 families, is used only for downstream few-shot family classification. The split used in this study contains 7459 training samples, 923 validation samples, and 957 test samples. In the downstream evaluation, we construct C-way K-shot malware family classification tasks on Malimg, where $K\in \{1,5,10,20\}$. For each task, K labeled samples from each family are sampled from the training split as the support set, and the validation split is used as the query set. The test split is not used in the main experiments. The same sampled support sets are shared by all methods in each repetition to ensure a fair comparison. Results are reported as mean ± standard deviation over 20 repeated few-shot tasks.

Maldeb and Malimg are therefore used as released image-based malware datasets rather than raw binary corpora processed by an additional conversion module in the experimental pipeline. In the common malware-image representation adopted by such datasets, binary bytes are interpreted as unsigned 8-bit grayscale pixel intensities and arranged row by row into a two-dimensional image. The image width follows the dataset construction protocol, and the height depends on the file length. The released grayscale PNG images are loaded directly in the implementation. During Maldeb pretraining, images are converted to RGB for ResNet-18 compatibility and then processed with stochastic augmentations for SimCLR pretraining [25], including random resized cropping, Gaussian blur, and random affine transformation. During Malimg downstream evaluation, the ImageNet-based and MalSim-based encoders follow an identical deterministic input pipeline, in which each image is converted to RGB, resized to $128\times 128$, transformed into a tensor, and normalized using the ImageNet mean and standard deviation. These operations standardize the released malware images for feature extraction and do not define a new binary-to-image mapping. DDPA operates on the resulting image representations through dual-domain prototype adaptation.

All feature encoders are based on ResNet-18 [31] to avoid introducing differences caused by backbone capacity. The ImgNet-based variants use the ImageNet-supervised encoder, whereas the MalSim-based variants use the malware-domain encoder pretrained by SimCLR on Maldeb. After pretraining, the final classification layer is removed and the backbone is used as a feature extractor. Each input image is mapped to a 512-dimensional feature vector, followed by $L_2$ normalization before prototype construction or classifier training. For training-free prototype methods, no model parameter is updated during downstream task adaptation. For gradient-based adaptation methods, linear probing updates only the classification head, while full fine-tuning updates the entire backbone.

4.1.2. Evaluation Metrics

Classification performance is evaluated using Macro-F1. For a query set with ground-truth labels $y_n$ and predictions ${\widehat{y}}_n$, the class-wise counts are defined as

$$\begin{array}{cc}\hfill T{P}_c& ={\displaystyle \sum _{n=1}^{N_q}}\mathbb{I}({\widehat{y}}_n=c\wedge y_n=c),\hfill \end{array}$$

(12)

$$\begin{array}{cc}\hfill F{P}_c& ={\displaystyle \sum _{n=1}^{N_q}}\mathbb{I}({\widehat{y}}_n=c\wedge y_n\ne c),\hfill \end{array}$$

(13)

$$\begin{array}{cc}\hfill F{N}_c& ={\displaystyle \sum _{n=1}^{N_q}}\mathbb{I}({\widehat{y}}_n\ne c\wedge y_n=c).\hfill \end{array}$$

(14)

For each class c, its precision, recall, and F1 score are computed as

$${\mathrm{Precision}}_c={\displaystyle \frac{T{P}_c}{T{P}_c+F{P}_c+ϵ}},{\mathrm{Recall}}_c={\displaystyle \frac{T{P}_c}{T{P}_c+F{N}_c+ϵ}},$$

(15)

$$F{1}_c={\displaystyle \frac{2·{\mathrm{Precision}}_c·{\mathrm{Recall}}_c}{{\mathrm{Precision}}_c+{\mathrm{Recall}}_c+ϵ}}.$$

(16)

Here, $\mathbb{I}(·)$ is the indicator function and $ϵ$ is a small constant used only to avoid division by zero. Macro-F1 is then obtained by averaging the class-wise F1 scores:

$$\mathrm{Macro-}\mathrm{F}1={\displaystyle \frac{1}{C}}{\displaystyle \sum _{c=1}^C}F{1}_c.$$

(17)

In this metric definition, C denotes the number of classes in the current C-way few-shot task. Because malware family datasets are often imbalanced, Macro-F1 gives each family equal weight. Therefore, Macro-F1 is used as the primary metric in the following analysis. As a complementary balanced metric, the Matthews Correlation Coefficient (MCC) is also reported in the representative deployment-cost comparison. Let $M\in {\mathbb{R}}^{C\times C}$ denote the multiclass confusion matrix, where $M_{ij}$ is the number of samples whose true class is i and predicted class is j. With $t_k={\sum }_j{M}_{kj}$, $p_k={\sum }_i{M}_{ik}$, $c={\sum }_k{M}_{kk}$, and $s={\sum }_i{\sum }_j{M}_{ij}$, MCC is computed as

$$\mathrm{MCC}={\displaystyle \frac{cs-{\sum }_{k=1}^C{p}_k{t}_k}{\sqrt{\left(s^2-{\sum }_{k=1}^C{p}_k^2\right)\left(s^2-{\sum }_{k=1}^C{t}_k^2\right)}}}.$$

(18)

This metric summarizes the agreement between predicted and true labels and provides an additional check that is sensitive to class imbalance.

In addition to classification performance, we evaluate the deployment cost of task adaptation. Four cost indicators are considered: adaptation time, peak GPU memory, trainable parameters, and gradient steps. Adaptation time measures the wall-clock cost from the moment task-specific support and query features are available in memory to the point at which the method completes adaptation and validation-query prediction. For training-free prototype methods, this interval covers support-side prototype construction and scoring of the validation queries in the fixed feature space. For linear probing and full fine-tuning, the same interval additionally covers the task-specific optimization process, including backpropagation and optimizer updates. Because millisecond-level timing is sensitive to system scheduling and hardware state, adaptation time is reported as the median [interquartile range (IQR)] in the deployment-cost analysis. Peak GPU memory records the maximum GPU memory observed during task adaptation. Trainable parameters and gradient steps measure how much downstream optimization is required by each method.

4.1.3. Experimental Design and Environment

The experiments are organized to answer a sequence of questions. Section 4.2 first compares DDPA with representative adaptation paradigms under $K=\{1,5,10,20\}$, in order to evaluate whether training-free dual-domain adaptation remains competitive when only a few labeled samples are available. Based on the observed performance trend, Section 4.3 further focuses on the representative 5-shot setting and analyzes the trade-off between detection performance and adaptation cost. Section 4.4 then examines the support–query generalization gap of gradient-based adaptation, explaining why additional parameter updates do not always translate into proportional query-set gains under strict few-shot constraints. Section 4.5 analyzes the dual-domain prototype spaces at both class and sample levels, clarifying how the general visual domain and the malware-specific domain provide complementary evidence for DDPA. Finally, Section 4.6 examines the sensitivity of DDPA to the fixed score-fusion weight, in order to assess whether the equal-weight rule provides a stable training-free operating point.

All experiments are conducted on a unified hardware and software platform. The hardware platform consists of an Intel Core Ultra 7 270K CPU and a single NVIDIA RTX 5090 GPU. The software environment is based on Ubuntu 24.04, Python 3.13.13, PyTorch 2.12.0, Torchvision 0.27.0, and CUDA 13.0-enabled GPU acceleration. This unified environment is used for all methods to ensure that performance and cost comparisons are measured under consistent experimental conditions. Deployment-cost values, especially adaptation time and peak GPU memory, are hardware-dependent and should be interpreted under this platform.

4.2. Few-Shot Performance Across Adaptation Paradigms

To evaluate whether the proposed training-free dual-domain adaptation can remain competitive when a limited number of labeled samples is available, we compare DDPA with representative few-shot adaptation methods under $K=\{1,5,10,20\}$ shots per class. The baseline set is chosen to isolate the two design factors most relevant to DDPA, namely whether downstream adaptation requires parameter updates and whether prototype evidence is taken from one or two feature domains. Accordingly, the compared methods cover two major adaptation paradigms. The first paradigm is gradient-based adaptation, where model parameters are updated using the support set. Linear probing (LP) freezes the feature encoder and trains only a linear classification head, while full fine-tuning (FT) updates the entire backbone network. For each gradient-based paradigm, two encoder initializations are evaluated: ImgNet-based variants use the ImageNet-pretrained visual encoder, and MalSim-based variants use the malware-domain encoder pretrained by SimCLR on Maldeb. The second paradigm is training-free adaptation. ImgNet-Proto and MalSim-Proto construct class prototypes in a single feature space without any parameter update, while DDPA further combines the two frozen prototype classifiers through equal-weight score-level fusion. This setting enables a controlled comparison between trainable adaptation, single-domain training-free prototypes, and the proposed dual-domain prototype fusion.

Table 1 reports the Macro-F1 scores of all methods under different shot settings. Each column corresponds to one few-shot setting, and each row corresponds to one adaptation method. The best result in each column is highlighted in bold. DDPA achieves the best Macro-F1 under $K=1$ and $K=5$, showing that dual-domain training-free adaptation is particularly effective when labeled samples are highly limited. Specifically, DDPA improves the best non-DDPA method by 5.72 percentage points under 1-shot and 1.62 percentage points under 5-shot. Under 10-shot and 20-shot, ImgNet-FT obtains the highest Macro-F1 scores of 93.13% and 93.83%, respectively, while DDPA remains close with gaps of 0.66 and 0.51 percentage points. This result indicates that full fine-tuning becomes more competitive when more labeled support samples are available, whereas DDPA provides stronger performance in stricter low-shot regimes without downstream gradient optimization.

Table 1. Few-shot Macro-F1 comparison under different adaptation paradigms. Values are reported as mean ± standard deviation over repeated few-shot tasks. The best result in each column is highlighted in bold.

Method	$\mathit{K}=1$	$\mathit{K}=5$	$\mathit{K}=10$	$\mathit{K}=20$
ImgNet-LP	$73.70\pm 4.51$	$81.10\pm 2.44$	$84.77\pm 3.15$	$86.77\pm 3.01$
MalSim-LP	$74.89\pm 4.36$	$81.98\pm 2.33$	$83.65\pm 2.11$	$84.88\pm 2.19$
ImgNet-FT	$80.33\pm 4.00$	$90.30\pm 1.78$	$\mathbf{93.13}\pm \mathbf{0.79}$	$\mathbf{93.83}\pm \mathbf{0.98}$
MalSim-FT	$79.19\pm 2.72$	$86.49\pm 1.97$	$88.62\pm 1.87$	$89.84\pm 1.96$
ImgNet-Proto	$78.77\pm 4.16$	$87.44\pm 2.04$	$89.25\pm 1.64$	$90.22\pm 0.94$
MalSim-Proto	$80.46\pm 2.02$	$87.24\pm 2.47$	$88.79\pm 1.67$	$89.83\pm 1.55$
DDPA (ours)	$\mathbf{86.18}\pm \mathbf{3.04}$	$\mathbf{91.92}\pm \mathbf{1.50}$	$92.47\pm 1.34$	$93.32\pm 0.86$

The performance trend across different support sizes is more clearly shown in Figure 2. As K increases from 1 to 5, most methods exhibit a clear performance jump, indicating that adding a small number of labeled samples substantially improves the reliability of class prototypes or trained classifiers. However, the gains become smaller when K further increases from 5 to 10 and then to 20. This trend suggests that 5-shot provides a strong label-efficiency point for this task: it uses far fewer labeled samples than the 10-shot and 20-shot settings, while already reaching a Macro-F1 level close to the higher-shot regimes. For DDPA, Macro-F1 increases from 86.18% at 1-shot to 91.92% at 5-shot, and then rises more gradually to 92.47% and 93.32% at 10-shot and 20-shot, respectively. The same figure also shows that ImgNet-FT continues to benefit from larger support sets and becomes the strongest method under 10-shot and 20-shot settings.

Figure 2. Macro-F1 trends of different adaptation methods under $K=\{1,5,10,20\}$ shots per class. The shaded region highlights the 5-shot setting selected for detailed analysis in this study.

Overall, these results show that DDPA is effective for few-shot image-based malware classification, especially when the number of labeled samples is severely limited. The 5-shot setting offers a practical balance between annotation cost and detection performance, as it achieves a substantial improvement over 1-shot while approaching the performance of higher-shot settings. Therefore, the next subsection further focuses on the 5-shot scenario to analyze the trade-off between detection performance and adaptation cost across different adaptation paradigms.

4.3. Deployment Cost of Task Adaptation

This subsection further evaluates the performance–cost trade-off of different adaptation methods under the representative 5-shot setting, which remains strictly few-shot while providing a better balance between detection performance and label cost than the 1-shot, 10-shot, and 20-shot settings. Table 2 reports both detection performance and adaptation cost, including Macro-F1, adaptation time, peak GPU memory, trainable parameters, and gradient steps. Macro-F1 is the primary performance metric, and MCC is included as a complementary balanced metric following the definitions in Section 4.1. Both metrics are reported as mean ± standard deviation, while adaptation time follows the measurement window and median [IQR] format defined in Section 4.1.

Table 2. Performance and deployment cost under the 5-shot setting. The best values for Macro-F1 and MCC, as well as the proposed method name, are shown in bold.

Method	Macro-F1 (%)	MCC	Adapt. Time (ms)	Peak GPU (MB)	Trainable Params (M)	Gradient Steps
ImgNet-LP	$81.10\pm 2.44$	$0.814\pm 0.044$	$245.57\left[17.27\right]$	$66.2$	$0.013$	200
MalSim-LP	$81.98\pm 2.33$	$0.817\pm 0.064$	$241.85\left[20.91\right]$	$66.2$	$0.013$	200
ImgNet-FT	$90.30\pm 1.78$	$\mathbf{0.953}\pm \mathbf{0.012}$	10,428.37 $\left[159.24\right]$	$1902.5$	$11.19$	200
MalSim-FT	$86.49\pm 1.97$	$0.886\pm 0.047$	10,487.62 $\left[198.81\right]$	$523.4$	$11.19$	200
ImgNet-Proto	$87.44\pm 2.04$	$0.891\pm 0.039$	$0.83\left[0.78\right]$	$64.0$	0	0
MalSim-Proto	$87.24\pm 2.47$	$0.891\pm 0.039$	$0.78\left[0.47\right]$	$64.0$	0	0
DDPA	$\mathbf{91.92}\pm \mathbf{1.50}$	$0.941\pm 0.031$	$1.40\left[1.20\right]$	$64.0$	0	0

The first four rows in Table 2 correspond to gradient-based adaptation. The two methods with the “-LP” suffix denote linear probing, where the feature encoder is frozen and only a lightweight linear classification head is trained on the support set. As a result, ImgNet-LP and MalSim-LP require approximately 242–246 ms for task adaptation with 12,825 trainable parameters and 200 gradient steps. The two methods with the “-FT” suffix denote full fine-tuning, where the entire backbone network is updated using the support set. This strategy is much more expensive: ImgNet-FT and MalSim-FT require about 10.4 s for task adaptation and 11.19 million trainable parameters.

In contrast to the gradient-based methods, the last three rows report training-free prototype adaptation. With no parameter updates during task adaptation, they require zero trainable parameters and zero gradient steps. The two single-domain prototype baselines require less than 1 ms of median adaptation time, but their Macro-F1 scores remain at 87.44% and 87.24%, respectively. DDPA introduces a small additional cost because it constructs and combines two prototype classifiers, yet its median adaptation time remains only 1.40 ms. In return, DDPA achieves the highest Macro-F1 of 91.92%, outperforming both single-domain prototypes and all gradient-based methods in class-balanced performance. The supplementary MCC column provides a consistent but more nuanced view. ImgNet-FT obtains the highest MCC of 0.953, while DDPA remains close at 0.941 and achieves the highest MCC among training-free methods, indicating that its favorable Macro-F1 is obtained without sacrificing balanced prediction reliability.

Figure 3 plots Macro-F1, the primary performance metric defined in Section 4.1, against four deployment-related cost dimensions: adaptation time, peak GPU memory, trainable parameters, and gradient steps. Logarithmic scaling is used for cost dimensions that span several orders of magnitude; for zero-cost quantities such as trainable parameters and gradient steps, training-free methods are placed at one on the log axis and explicitly marked as the zero-training group. In these plots, methods closer to the upper-left region provide stronger detection performance with lower adaptation cost.

Figure 3. Performance–cost comparison under the 5-shot setting. Macro-F1 is plotted against adaptation time, peak GPU memory, trainable parameters, and gradient steps.

As shown in Figure 3, DDPA consistently lies in a favorable region of the performance–cost space. In the adaptation-time view, DDPA is much closer to the low-cost training-free methods than to FT, while achieving the highest Macro-F1. In the parameter and gradient-step views, DDPA remains on the zero-training side, in contrast to LP and FT methods that require parameter updates. The memory view further shows that GPU memory consumption is hardware-dependent and differs substantially across adaptation paradigms. These observations support the use of DDPA as a lightweight task adaptation method for security monitoring scenarios where fast response and low computational overhead are important.

Given the favorable adaptation-cost profile shown in Table 2 and Figure 3, an additional query-side timing analysis is included to characterize the training-free prototype methods more rigorously. This analysis asks how much time is required to classify a newly supplied malware image after the 5-shot prototypes have been fixed. Table 3 reports this per-image prediction time for the three training-free prototype methods, measured over 923 Malimg validation queries with batch size 1. The measurement starts from the raw validation image and includes image preprocessing, frozen feature extraction, prototype scoring, and final prediction.

Table 3. Prediction time from raw validation images for training-free prototype methods under the 5-shot setting.

Method	Compute-Only Time (ms)	File-I/O-Included Time (ms)	Prediction Path
ImgNet-Proto	$1.63\left[0.85\right]$	$9.89\left[8.57\right]$	ImgNet backbone.
MalSim-Proto	$1.56\left[0.40\right]$	$9.79\left[8.55\right]$	MalSim backbone.
DDPA	$5.52\left[2.86\right]$	$13.87\left[8.08\right]$	Dual-backbone fusion.

All values in Table 3 are reported as the median [IQR] using fixed $K=5$ prototypes. As expected, DDPA requires more per-image prediction time than the two single-domain prototypes because it evaluates both frozen feature spaces before score fusion. Even with this dual-backbone path, the compute-only prediction time remains at the millisecond level, with a median of 5.52 ms. This supplementary view clarifies the query-side cost of prototype methods without replacing the adaptation-time comparison used in Table 2 and Figure 3.

Overall, the 5-shot deployment analysis shows that DDPA provides a strong balance between detection performance and adaptation cost. It improves over single-domain training-free prototypes while avoiding the parameter and gradient costs of LP and FT. These results also raise two important questions: why gradient-based adaptation does not always bring a proportional performance gain under strict few-shot constraints, and why combining two frozen prototype spaces is more effective than using either domain alone. The following two subsections address these questions by analyzing the generalization behavior of gradient-based adaptation and the complementarity of the two prototype spaces.

4.4. Generalization Behavior of Gradient-Based Adaptation

The deployment analysis in Section 4.3 shows that gradient-based adaptation methods, including linear probing (LP) and full fine-tuning (FT), introduce additional trainable parameters, gradient steps, and adaptation time. However, the resulting Macro-F1 gains are not always proportional to this additional cost under strict few-shot supervision. This raises a natural question: do these gradient updates learn transferable decision boundaries from the limited support set, or do they mainly improve support-set fitting? To answer this question, this subsection analyzes the support–query generalization gap of linear probing and full fine-tuning across different shot budgets.

Table 4 reports the support–query Macro-F1 gap of the four gradient-based methods under $K=\{1,5,10,20\}$. Unlike Table 1, which reports query-set classification performance, this diagnostic table focuses only on the difference between support-set fitting and query-set generalization. The gap is computed as support-set Macro-F1 minus query-set Macro-F1, in percentage points. A positive gap indicates that a method fits the observed support samples better than it generalizes to unseen query samples, which is especially relevant when only one or a few labeled samples are available for each family.

Table 4. Support–query Macro-F1 gap of gradient-based adaptation under different shot budgets. Values are reported as mean ± standard deviation over repeated few-shot tasks. The gap is computed as Macro-F1 on the support set minus Macro-F1 on the query set, in percentage points (pp).

Method	$\mathit{K}=1$	$\mathit{K}=5$	$\mathit{K}=10$	$\mathit{K}=20$
ImgNet-LP	$21.22\pm 4.75$	$11.75\pm 2.89$	$7.16\pm 2.36$	$5.32\pm 1.79$
MalSim-LP	$18.44\pm 3.06$	$6.76\pm 2.97$	$4.95\pm 2.15$	$4.22\pm 1.92$
ImgNet-FT	$19.61\pm 4.02$	$9.07\pm 1.60$	$6.89\pm 0.76$	$6.04\pm 0.87$
MalSim-FT	$15.49\pm 2.70$	$8.18\pm 1.97$	$6.04\pm 1.86$	$5.21\pm 1.67$

The gap is most evident under the 1-shot setting. ImgNet-LP shows a support–query gap of 21.22 percentage points, and MalSim-LP shows a gap of 18.44 percentage points. For full fine-tuning, ImgNet-FT and MalSim-FT show gaps of 19.61 and 15.49 percentage points, respectively. These results indicate that, in the extreme 1-shot regime, gradient updates largely improve fitting to the observed support samples, but this improvement is not fully transferred to unseen query samples.

The gap decreases as the shot budget increases, which is important for a balanced interpretation of gradient-based adaptation. From 1 to shot to 20-shot, the support–query gap drops from 21.22 to 5.32 percentage points for ImgNet-LP, from 18.44 to 4.22 percentage points for MalSim-LP, from 19.61 to 6.04 percentage points for ImgNet-FT, and from 15.49 to 5.21 percentage points for MalSim-FT. This trend shows that gradient-based adaptation is not inherently ineffective; rather, it needs a sufficiently large support set to convert parameter updates into stable query-set generalization. This observation is also consistent with the result in Section 4.2, where ImgNet-FT becomes the strongest method under the 10-shot and 20-shot settings.

Figure 4 further visualizes the support–query generalization gap across shot budgets. For each gradient-based variant, the gray points represent the gap measured in individual repeated few-shot tasks, the colored line shows the mean trend, and the shaded band reflects the variability across repetitions. Compared with the detailed numerical values in Table 4, this visualization makes two patterns more evident. First, all four variants show a large support–query gap under the 1-shot setting, followed by a clear reduction when K increases from 1 to 5. Second, both the mean gap and the dispersion band become narrower as more support samples are available, indicating that gradient-based adaptation becomes not only more accurate but also more stable when the support set is less sparse. After 5-shot, the gap continues to decrease toward 10-shot and 20-shot, but the marginal reduction becomes smaller.

Figure 4. Support–query Macro-F1 gap of gradient-based adaptation across different shot budgets. Gray points denote individual repeated-task measurements, colored lines show the mean gap, and shaded bands indicate the variability across repeated few-shot tasks.

This trend is consistent across both adaptation strategies and feature domains. From the adaptation perspective, the linear probing variants and the full fine-tuning variants exhibit similar gap-reduction patterns, suggesting that the support–query gap is not an isolated issue of a particular optimization strategy. From the feature-domain perspective, ImageNet-initialized and MalSim-initialized variants differ in their absolute gap values, but both follow the same overall pattern: a large and unstable gap under very low-shot supervision, followed by gradual convergence as K increases. This suggests that the phenomenon is not caused solely by a specific encoder, but is closely related to performing gradient-based optimization on a very small support set.

Overall, this analysis explains why the higher deployment cost of gradient-based adaptation does not always lead to a proportional gain in few-shot malware detection. Linear probing and full fine-tuning can fit the support set effectively, but under strict low-shot supervision, a clear support–query gap remains. As more labeled support samples are provided, this gap decreases and gradient-based adaptation becomes more reliable; however, requiring more labeled malware samples conflicts with the goal of few-shot security monitoring, where newly observed families often have only a few verified samples. This supports the motivation for a training-free adaptation strategy such as DDPA, which avoids downstream parameter updates and reduces the risk of support-set memorization in low-label monitoring scenarios.

4.5. Complementarity of Dual-Domain Prototype Spaces

The preceding Section 4.2 has shown that DDPA is particularly effective under stricter low-shot settings in image-based malware detection. This subsection further examines where this improvement comes from. In particular, we analyze the complementarity and dependency between the general visual prototype space and the malware-specific prototype space, with the aim of clarifying whether ImageNet-derived visual representations can provide useful and non-redundant evidence for malware-domain representations.

4.5.1. Statistical Complementarity at Class and Sample Levels

Figure 5 first examines the complementarity of the two prototype spaces at the malware family level. Figure 5a reports the per-class F1 scores of ImgNet-Proto and MalSim-Proto. The classes are ordered by the relative difference between the two single-domain prototypes: classes near the top are those where MalSim-Proto shows a larger advantage, whereas classes near the bottom are those where ImgNet-Proto is stronger. This ordering makes the domain-dependent behavior of the two prototype spaces easier to observe.

Figure 5. Class-level complementarity between the two single-domain prototype spaces. In (a), blue and green markers denote ImgNet-Proto and MalSim-Proto, respectively; the green and blue row shading indicates classes where MalSim-Proto and ImgNet-Proto perform better, respectively, while unshaded rows indicate comparable performance. In (b), teal and purple denote non-negative and negative DDPA gains, respectively; the vertical line marks zero gain, and the horizontal segments extend from zero to the corresponding gain values.

The results show that neither single-domain prototype space uniformly dominates the other. Instead, their performance is clearly family-dependent. MalSim-Proto performs better on 15 families, including Swizzor.gen!I, C2LOP.P, Swizzor.gen!E, and Wintrim.BX, whereas ImgNet-Proto performs better on 8 families, including Malex.gen!J, Alueron.gen!J, Agent.FYI, and Fakerean. The remaining 2 families show no clear difference between the two single-domain prototypes. These results indicate that the two prototype spaces capture different family-level evidence, and the advantageous families of the two domains do not completely overlap. Therefore, the main value of dual-domain fusion should not be expected to appear uniformly across all classes, but rather in those classes or samples where the two domains provide different discriminative evidence.

To evaluate whether DDPA improves beyond the better of the two single-domain prototypes, Figure 5b reports the per-class gain defined as

$$\Delta F{1}_c=F{1}_c^{\mathrm{dual}}-max\left(F{1}_c^{\mathrm{vis}},F{1}_c^{\mathrm{mal}}\right),$$

(19)

where $F{1}_c^{\mathrm{dual}}$ denotes the per-class F1 score of DDPA on class c, and $F{1}_c^{\mathrm{vis}}$ and $F{1}_c^{\mathrm{mal}}$ denote the per-class F1 scores of the general visual prototype and the malware-specific prototype, respectively. All three per-class F1 scores are computed on the same validation-query set under the same repeated 5-shot tasks. This is a stricter comparison than measuring the gain over a fixed single-domain baseline, because DDPA is compared with the stronger single-domain prototype for each class. A positive value therefore indicates that DDPA exceeds the best available single-domain decision for that family. As shown in Figure 5b, DDPA exceeds the stronger single-domain prototype on 13 families and ties it on 6 families. At the same time, it falls below the stronger single-domain prototype on 6 families, with clear negative cases such as Agent.FYI and Swizzor.gen!I. This result gives a more precise interpretation of the class-level behavior of DDPA: equal-weight dual-domain fusion is not an oracle-like per-family selector, and it does not guarantee improvement over the best single-domain prototype for every family. Rather, it provides a fixed and training-free fusion rule that can exploit complementary evidence in many families while still being affected by cases where one domain is clearly more reliable than the other.

Figure 6 further explains how the class-level differences observed in Figure 5 are converted into actual performance gains at the sample level. The central pie shows the prediction agreement between ImgNet-Proto and MalSim-Proto. The two single-domain prototypes make the same prediction on 15,730 samples, accounting for 85.2% of all predictions, and disagree on 2730 samples, accounting for 14.8%. This indicates that the two domains are not in broad conflict. Instead, they share a large stable region where their decisions are consistent, while still leaving a non-negligible disagreement region for dual-domain arbitration.

Figure 6. Sample-level analysis of prediction agreement, single-domain correctness, and DDPA behavior.

The middle ring further decomposes this stable region and the disagreement region. Among the agreement cases, 15,520 samples are correctly classified by both single-domain prototypes, while only 210 samples are incorrectly assigned to the same wrong class. This shows that when the two domains reach the same decision, the prediction is usually reliable. More importantly, the disagreement region contains asymmetric correctness patterns: 1125 samples are correctly classified only by ImgNet-Proto, 1170 samples are correctly classified only by MalSim-Proto, and 435 samples are misclassified by both prototypes but assigned to different wrong classes. These numbers provide sample-level evidence of complementarity, because the errors made by the two prototype spaces are not identical. Some samples can only be resolved by the general visual prototype, whereas others can only be resolved by the malware-specific prototype.

The outer arc focuses on the 2730 disagreement cases, which are the most informative samples for understanding the role of DDPA. Among these cases, DDPA correctly resolves 1978 samples and misses 752 samples. This corresponds to an effective resolution ratio of $1978/2730\approx 72.45\%$. This result indicates that the main gain of DDPA does not come from extensively changing the predictions on samples that both single-domain prototypes already classify consistently and correctly. Instead, the gain mainly comes from re-evaluating a high-value subset of disagreement cases, where the two domains provide competing evidence and a fused prototype decision can make a better judgment.

4.5.2. Qualitative Latent-Space Projection

The statistical results above indicate that the two prototype spaces differ at both class and sample levels, but they do not directly show how the frozen feature spaces are geometrically organized. To provide a qualitative view of this structure, UMAP projections [32] are computed from the frozen ImgNet and MalSim encoders after prototype construction. The resulting plots are therefore used to inspect whether the same validation-query samples occupy similar or different local neighborhoods in the two spaces, complementing the class-level and sample-level evidence in Section 4.5.1.

The representative families in the selected-family projection are chosen according to the 5-shot class-level complementarity patterns identified in Section 4.5.1. As summarized in Table 5, the selection covers four interpretable patterns: families where DDPA improves over the stronger single-domain prototype, families where the ImageNet-derived prototype is stronger, families where the malware-domain prototype is stronger, and stable families where both single-domain prototypes already perform well. This design links the qualitative projection back to the preceding statistics, so the selected view is interpreted as structural visualization rather than an independent performance test.

Table 5. Representative malware families used for the selected-family UMAP projection.

Selection Pattern	Malware Families	Selection Rationale
DDPA-gain cases	C2LOP.P, C2LOP.gen!g	DDPA exceeds the stronger single-domain prototype by the largest margins.
ImageNet-advantage cases	Agent.FYI, Autorun.K	The ImageNet-derived prototype is stronger than the malware-domain prototype, or DDPA does not exceed it.
MalSim-advantage cases	Swizzor.gen!I, Lolyda.AT	The malware-domain prototype is stronger than the ImageNet-derived prototype, or DDPA does not exceed it.
Agreement/stable cases	Lolyda.AA3, Adialer.C	Both single-domain prototypes are strong, and DDPA remains close to the stronger single-domain result.

Figure 7 shows the selected-family UMAP projections under the two frozen encoders, with Figure 7a corresponding to the ImgNet space and Figure 7b corresponding to the MalSim space. The same validation-query samples are used in both panels. Small circular markers denote query samples and star markers denote the 5-shot support prototypes projected together with the query samples. Several structural differences are visible. In the ImgNet space, C2LOP.P, C2LOP.gen!g, Swizzor.gen!I, and Adialer.C occupy nearby regions in the upper part of the panel, whereas Autorun.K, Agent.FYI, Lolyda.AT, and Lolyda.AA3 form more isolated clusters. In the MalSim space, the same families are reorganized into a different arrangement: Agent.FYI and Lolyda.AT move to well-separated upper regions, C2LOP.P and C2LOP.gen!g are placed on the right side with distinct prototype locations, and Autorun.K and Swizzor.gen!I become neighboring but still distinguishable middle-region clusters. Thus, the two encoders do not simply preserve the same family geometry with a different scale or rotation. The two spaces emphasize different local neighborhoods and different support–query prototype relations, which is consistent with the non-identical error patterns reported in Figure 6.

Figure 7. Qualitative UMAP projections of representative Malimg validation-query samples in the two frozen feature spaces.

Figure 8 extends this inspection from the selected families to all 25 Malimg families, with Figure 8a showing the frozen ImgNet space and Figure 8b showing the frozen MalSim space. Although the all-family view is denser, the colored family groups still occupy multiple compact or semi-compact regions across each space, rather than collapsing into a single mixed cloud. The two panels also arrange these regions differently: family groups that are close or partially overlapping in one space are not necessarily close in the other. This broader view strengthens the selected-family observation by showing that domain-dependent spatial organization is visible across the full validation-query set, while the selected-family projection in Figure 7 provides a more detailed view of representative complementarity patterns.

Figure 8. Exploratory all-family UMAP projections of Malimg validation-query samples in the frozen ImgNet and MalSim feature spaces.

Taken together, the statistical analyses and qualitative projections show that dual-domain complementarity in DDPA is not a simple feature-stacking effect, nor is it a uniform improvement over all classes. The two single-domain prototype spaces agree on most easy samples and provide different advantages on a smaller set of difficult or domain-sensitive samples. At the class level, DDPA improves over the stronger single-domain prototype for many families but also shows clear limitations when one domain is much more reliable. At the sample level, however, DDPA resolves a large proportion of single-domain disagreement cases. This explains why combining general visual prototypes with malware-specific prototypes can improve few-shot recognition while preserving a transparent and training-free decision rule.

4.6. Sensitivity Analysis of Fixed Score Fusion

The class-level complementarity analysis above shows that the two prototype spaces have different strengths across malware families. The symmetric fusion rule in DDPA is therefore not a per-family oracle selector. It applies the same dual-domain score combination even when one single-domain prototype is more reliable for a particular family. This raises a natural question of whether the symmetric equal-weight operating point is highly sensitive to the fusion weight. To examine this question, a fixed-weight sensitivity analysis is conducted under the same few-shot evaluation protocol.

For a query sample $x_q$, the fused score for class c is written as

$$s_c^{\left(\alpha \right)}\left(x_q\right)=\alpha s_c^{\mathrm{vis}}\left(x_q\right)+(1-\alpha )s_c^{\mathrm{mal}}\left(x_q\right),\alpha \in \{0.0,0.1,\dots ,1.0\}.$$

(20)

Here, $s_c^{\mathrm{vis}}\left(x_q\right)$ and $s_c^{\mathrm{mal}}\left(x_q\right)$ denote the visual-domain and malware-domain prototype scores for class c, respectively. The coefficient $\alpha$ controls the contribution of the visual-domain score, while $1-\alpha$ controls the contribution of the malware-domain score. Thus, $\alpha =0$ uses only the malware-domain prototype score, $\alpha =1$ uses only the visual-domain prototype score, and $\alpha =0.5$ recovers the symmetric equal-weight fusion rule used by DDPA. The analysis uses the same fixed 20 repeated few-shot tasks as the main experiments and covers $K=\{1,5,10,20\}$. For each shot budget, $\alpha$ is evaluated on the fixed grid in Equation (20), and no additional training, parameter update, or query-label tuning is introduced.

Table 6 provides a compact numerical summary of the fixed-weight evaluation. The columns $\alpha =0$, $\alpha =0.5$, and $\alpha =1$ correspond to the malware-domain endpoint, the symmetric DDPA rule, and the visual-domain endpoint, respectively. All Macro-F1 values are reported as mean ± standard deviation over 20 repeated few-shot tasks. The gap column is computed as the difference between the best result among the evaluated $\alpha$ values and the $\alpha =0.5$ result.

Table 6. Summary of fusion-weight sensitivity across different shot budgets K.

K	$\mathit{\alpha }=0$	$\mathit{\alpha }=0.5$	$\mathit{\alpha }=1$	Best $\mathit{\alpha }$	Best F1	Gap
1	$82.35\pm 1.90$	$86.18\pm 3.04$	$78.77\pm 4.16$	$0.4$	$86.20\pm 3.03$	$0.02$ pp
5	$87.24\pm 2.47$	$91.92\pm 1.50$	$87.44\pm 2.04$	$0.5$	$91.92\pm 1.50$	$0.00$ pp
10	$89.36\pm 1.25$	$92.47\pm 1.34$	$89.25\pm 1.64$	$0.7$	$92.95\pm 1.50$	$0.48$ pp
20	$90.11\pm 0.93$	$93.32\pm 0.86$	$90.22\pm 0.94$	$0.5$	$93.32\pm 0.86$	$0.00$ pp

In the representative 5-shot setting, $\alpha =0.5$ reaches $91.92\pm 1.50$ Macro-F1 and is the best $\alpha$ among the tested values. The same pattern appears under $K=20$, where the symmetric DDPA rule again attains the best result among the evaluated $\alpha$ values. Under $K=1$, the best $\alpha$ is $0.4$, but the improvement over $\alpha =0.5$ is only 0.02 pp. Under $K=10$, the best $\alpha$ is $0.7$ and improves over $\alpha =0.5$ by 0.48 pp; nevertheless, the $\alpha =0.5$ result remains clearly higher than both single-domain endpoints.

Figure 9 further shows the complete fixed-weight evaluation across the four shot budgets. In each panel, the solid curve gives the mean Macro-F1, the shaded band gives ±1 standard deviation, the dashed vertical line marks $\alpha =0.5$, and the diamond marker indicates the best $\alpha$ for that K. Across all settings, the Macro-F1 curve rises from the single-domain endpoints toward the middle range of $\alpha$ and then decreases near the opposite endpoint. This shape indicates that the performance gain of DDPA is not produced by one domain simply dominating the other. Instead, the visual-domain and malware-domain prototype scores both contribute useful evidence, and their combination is most effective in the central fusion range. The symmetric point $\alpha =0.5$ consistently lies in this high-performing region, even when the best $\alpha$ shifts slightly toward one domain. Together, Table 6 and Figure 9 show that symmetric equal-weight fusion is a stable and competitive operating point for DDPA.

Figure 9. Fusion-weight sensitivity across shot budgets.

These findings support retaining the symmetric equal-weight rule as the main DDPA decision rule because it matches the downstream design principle of treating the two prototype spaces as parallel evidence sources. The result also strengthens the central argument of this paper. Although the visual-domain and malware-domain representations are asymmetric in how they are obtained, their downstream prototype evidence can be combined symmetrically to improve few-shot malware family classification.

5. Conclusions

The experimental results show that the DDPA framework proposed in this paper can effectively use dual-domain prototypes for few-shot image-based malware classification, especially under strict low-shot settings, by connecting asymmetric data sources with a structurally symmetric downstream decision rule. Unlike methods [16,17,18,21,22,23] that mainly use visual representations either as a single feature source or for pretrained initialization, DDPA preserves the ImageNet-derived representation as an independent frozen prototype space and pairs it with a malware-domain prototype space learned from unlabeled malware images. It also extends recent self-supervised malware representation learning [18,20,27]: rather than using the self-supervised encoder only for downstream classifier training or single-domain prediction, DDPA examines how it can provide complementary evidence under a symmetric dual-domain prototype rule. The class-level and sample-level analyses further support this interpretation, showing that the two prototype spaces do not simply duplicate each other but provide different advantages and limitations across malware families, as well as complementary evidence in disagreement cases.

Although these results demonstrate the effectiveness of DDPA under the current evaluation protocol, several limitations remain. First, equal-weight score fusion is used to keep the decision process transparent and training-free, but this fixed fusion rule may not be optimal for all tasks or malware families. Second, because the present study uses released static image-based representations, the evaluation does not incorporate dynamic behavior, API sequences, or other multimodal malware evidence. Third, the released image-based datasets do not provide paired original and obfuscated binary samples, so the current evaluation does not assess how packing, section encryption, or polymorphic rewriting may alter byte-level layouts and visual structures. Fourth, although the evaluation verifies DDPA’s few-shot dual-domain prototype adaptation ability, it does not model temporal deployment drift because the released Malimg split does not provide temporal metadata, family-emergence order, or newer-variant annotations for a controlled temporal-drift evaluation.

Taken together, these limitations suggest several directions for future work. Future studies can validate DDPA under broader and more realistic dataset settings, including timestamped or family-emergence-aware malware-image benchmarks and cross-dataset low-shot protocols. Firstly, lightweight support-driven calibration strategies can also be developed while preserving low-cost adaptation. Secondly, the obfuscation-aware stability of both the ImageNet-derived visual space and the self-supervised malware-domain space can be examined. Lastly, the same symmetric prototype principle can be extended to multimodal malware representation learning.