Wavelet-Based and MAML-Driven Framework for Enhanced Few-Shot Malware Classification

Traditional malware classification approaches primarily address fixed sets of well-studied malware types and therefore struggle to accommodate the continual emergence of novel or previously unseen malware strains. While visualization-based strategies have shown promise in few-shot malware classification, existing methods often produce representations with limited semantic richness. In parallel, few-shot learning models frequently converge with suboptimal solutions, limiting their ability to generalize effectively to new classes. To address these challenges, we propose MetaWave, a unified framework that jointly optimizes both data representation and model learning for few-shot malware classification. Rather than treating feature representation and learning strategy as largely independent stages, MetaWave is formulated as an explicit representation–adaptation integration framework that combines multi-view malware encoding with meta-learning-based optimization. At the data level, we propose a Wavelet Transform-based Malware Representation method that leverages multi-scale frequency analysis and complementary views to generate semantically enriched representations. At the model level, we adopt Model-Agnostic Meta-Learning (MAML) to optimize model initialization for rapid adaptation to unseen tasks under limited data conditions. Extensive experiments are conducted on two benchmark datasets, EMBER and Malicia, under a 5-way 5-shot protocol with disjoint class splits to ensure evaluation on previously unseen malware families. The proposed framework achieves superior performance, reaching 97.8% accuracy on EMBER and 96.2% on Malicia, consistently outperforming state-of-the-art methods. These results indicate that jointly enhancing representation quality and model adaptability can improve classification accuracy and unseen-family performance under the evaluated 5-way 5-shot protocol. Overall, MetaWave provides an effective framework for few-shot malware classification and offers a promising basis for detecting emerging malware under limited-data conditions, while robustness to adversarial perturbation, obfuscation, and polymorphism remains to be validated through dedicated future evaluation.