中图分类号：TP3095文献标志码：ADOI:10.19358/j.issn.2097-1788.2026.04.006
中文引用格式：刘帅，王小英，戚盼盼，等. 融合多尺度CNN与Transformer的恶意软件行为检测方法［J］.网络安全与数据治理，2026，45（4）：45-50.
英文引用格式：Liu Shuai，Wang Xiaoying，Qi Panpan，et al. A malware behavior detection method based on the fusion of multiscale CNN and Transformer
［J］.Cyber Security and Data Governance，2026，45（4）：45-50.

A malware behavior detection method based on the fusion of multi-scale CNN and Transformer

Abstract： To address the severe threats posed by stealthy malware behavioral trajectories and the difficulty in modeling longsequence dependencies, this paper proposes a detection method that fuses multiscale Convolutional Neural Networks (CNN) with the Transformer architecture. First, the approach utilizes Speakeasy simulation logs denoising and composite event tokenization techniques to convert redundant logs into standardized semantic sequences. Next, it employs a multilayer CNN structure to extract local attack behavior features. Subsequently, these extracted features are fed into a Transformer encoder to model global temporal dependencies via a multihead selfattention mechanism.The experimental results show that the hybrid model has achieved an accuracy of 9229% and an F1Score of 9248% on the Speakeasy dataset. This approach significantly reduces the false positive rate in sequence detection, providing a new technical pathway for malware detection in complex network environments.

Key words : malware detection; Convolutional Neural Network (CNN); Transformer; multi-scale feature extraction; dynamic behavior analysis