ViG-fuse: efficient cross-attentive fusion of visual and graph representations for multi-view android malware classification

With the rapid proliferation of the Android ecosystem, attacks targeting malicious applications have been increasing, while traditional detection methods based on single-view function call graphs (FCGs) struggle to sufficiently capture the complex and covert behavior patterns. To address this, this paper proposes a multi-view fusion framework for systematically modeling the structural information of FCGs. This method uses graph convolutional networks to capture local topological dependencies in the function call graph, while mapping node centrality into structural images and constructing an improved visual transformer to encode their global patterns. To enhance the visual representation capability, we design a dynamic convolutional feedforward layer within the Transformer architecture, combining multi-scale depthwise separable convolutions with a dynamic weighting mechanism to achieve adaptive modeling of fine-grained local features in the structural images. Moreover, in terms of computational efficiency, this paper employs a linear attention mechanism in the visual encoder and cross-modal fusion module to build a more scalable feature interaction approach, reducing the attention computation complexity from quadratic to linear, effectively alleviating the memory overhead caused by high-dimensional feature modeling. Experimental results show that this method achieves superior detection performance on multiple public datasets, while significantly improving model resource utilization, validating the effectiveness of multi-view structural modeling and efficient attention mechanism design.