FusionNet: A feature transformation framework for multi-label malware detection

Mobile malware exhibits diverse and evolving malicious behaviors, which naturally form a multi-label classification problem in mobile systems. Existing approaches rely on sparse feature representations and show unstable performance across classifiers, where feature overlap and data imbalance further limit discriminative capability. This study proposes FusionNet, a multi-label classification framework that focuses on feature transformation. API call sequences are converted into TF-IDF vectors and refined through a neural feature fusion network to produce compact representations for classification. We conduct extensive experiments on a dataset with 5456 samples across six behavior categories to evaluate feature transformation and classifier stability. Results show consistent improvements across classifiers, with most models achieving F1-scores above 0.97, AdaBoost gaining +0.0611, and the F1-score of the minority blackmail category increasing from 0.3571 to 0.9091. • FusionNet transforms sparse TF-IDF features into compact representations for multi-label malware classification. • Transformed features ensure consistent performance across diverse classifiers without requiring model-specific adjustments. • Feature transformation significantly improves minority class detection, with blackmail F1-score increasing from 0.3571 to 0.9091.