Cross-Platform Malware Fingerprint Identification with a Convolutional KAN–Transformer Hybrid Architecture

Malware targets Android, Windows and Linux, yet most detectors rely on platform-specific features and must be rebuilt for each file format. We ask whether one compact architecture, trained on a byte-image input shared by all three platforms, can match much larger image classifiers. Bin2Img packs four consecutive bytes into one RGBA pixel and resizes the result to 96×96, so APK, PE and ELF files enter the same input space. HoloNet (0.70M parameters) combines a convolutional backbone, a convolutional Kolmogorov–Arnold network (KAN) block, primary capsules and a Transformer encoder that forms class capsules from learnable class tokens. Under a unified protocol with five seeds, HoloNet reaches Macro-F1 scores of 0.8755, 0.9356 and 0.9290 on CICMalDroid2020, BODMAS and ELF2020. After Holm correction it is statistically indistinguishable from Res2Net-50, ResNeXt-50 and ResNeXt-50 with a convolutional block attention module (CBAM) (23–26M parameters) on every dataset, outperforms ConvNeXt-T and ViT-S/8 on CICMalDroid2020, and runs 5.1–7.0 times faster than these three convolutional neural networks on a CPU. A split that keeps near-duplicate images together lowers Macro-F1 to 0.758 on BODMAS and 0.718 on ELF2020; on that split, HoloNet matches Res2Net-50 on both and trails it by 0.017 on CICMalDroid2020. In five-seed ablations, the only significant effect is the gain of adaptive capsule routing over mean pooling on CICMalDroid2020, and dynamic routing matches Transformer routing at a quarter of the computation. Hash lists and split definitions are released with the paper.