Slide
Centre Interdisciplinaire
de Recherche et d’Innovation
en Cybersécurité et Société
de Recherche et d’Innovation
en Cybersécurité et Société
1.
Ameyoud, S. Mohamed; Allili, M. Saïd
Multi-modal malware classification with hierarchical consistency and saliency-constrained adversarial training Journal Article
In: Journal of Information Security and Applications, vol. 99, 2026, ISSN: 22142134 (ISSN).
Abstract | Links | BibTeX | Tags: Adversarial training, Capability of detection, Classification (of information), Convolution, convolutional neural network, Convolutional neural networks, Detection system, Hierarchical consistency, Hierarchical systems, Malware, Malware classification, Malware classifications, Malware families, Malwares, Multi-modal, Multi-modal learning, Semantics, Vision transformer, Vision transformers
@article{mohamed_ameyoud_multi-modal_2026,
title = {Multi-modal malware classification with hierarchical consistency and saliency-constrained adversarial training},
author = {S. Mohamed Ameyoud and M. Saïd Allili},
url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-105031186108&doi=10.1016%2Fj.jisa.2026.104429&partnerID=40&md5=2425da4ab40f9043ba4e67d223a1bdd9},
doi = {10.1016/j.jisa.2026.104429},
issn = {22142134 (ISSN)},
year = {2026},
date = {2026-01-01},
journal = {Journal of Information Security and Applications},
volume = {99},
abstract = {The increasing complexity of malware, including polymorphic, obfuscated, and adversarial variants, continues to outpace the capabilities of detection systems. Here, we introduce a robust multi-modal hierarchical framework that jointly leverages visual and code-level semantics to enhance malware family and type classification. Our architecture fuses convolutional and transformer-based encoders to extract complementary representations from raw malware binaries and decompiled control-flow functions, enabling a rich, cross-modal understanding of malicious behavior. The classification pipeline follows a two-stage hierarchical protocol, where the predicted malware type informs the family-level classification. This enforces ontological consistency between type and family prediction levels. To further bolster robustness against adversarial and obfuscated malware, we integrate a novel adversarial training strategy that generates plausible perturbations guided by attention distributions. Evaluation on multiple large-scale benchmarks including BODMAS, Malimg, Microsoft BIG 2015, and a curated set of from MalwareBazaar, demonstrate that our framework consistently outperforms state-of-the-art baselines, including ResNet, Swin Transformer, and MalBERTv2, across both malware type and family prediction tasks. Notably, our model exhibits outstanding generalization to unpacked, obfuscated, and previously unseen samples, with minimal performance degradation. It achieves accuracy gains of +3-6% over leading methods and exhibits superior resilience under adversarial threat models. These results highlight the effectiveness of hierarchical conditioning, adversarial robustness, and multi-modal fusion in tackling the evolving landscape of malware. The proposed framework thus offers a scalable and generalizable approach for next-generation malware classification in real-world cybersecurity environments. © 2026 Elsevier Ltd.},
keywords = {Adversarial training, Capability of detection, Classification (of information), Convolution, convolutional neural network, Convolutional neural networks, Detection system, Hierarchical consistency, Hierarchical systems, Malware, Malware classification, Malware classifications, Malware families, Malwares, Multi-modal, Multi-modal learning, Semantics, Vision transformer, Vision transformers},
pubstate = {published},
tppubtype = {article}
}
The increasing complexity of malware, including polymorphic, obfuscated, and adversarial variants, continues to outpace the capabilities of detection systems. Here, we introduce a robust multi-modal hierarchical framework that jointly leverages visual and code-level semantics to enhance malware family and type classification. Our architecture fuses convolutional and transformer-based encoders to extract complementary representations from raw malware binaries and decompiled control-flow functions, enabling a rich, cross-modal understanding of malicious behavior. The classification pipeline follows a two-stage hierarchical protocol, where the predicted malware type informs the family-level classification. This enforces ontological consistency between type and family prediction levels. To further bolster robustness against adversarial and obfuscated malware, we integrate a novel adversarial training strategy that generates plausible perturbations guided by attention distributions. Evaluation on multiple large-scale benchmarks including BODMAS, Malimg, Microsoft BIG 2015, and a curated set of from MalwareBazaar, demonstrate that our framework consistently outperforms state-of-the-art baselines, including ResNet, Swin Transformer, and MalBERTv2, across both malware type and family prediction tasks. Notably, our model exhibits outstanding generalization to unpacked, obfuscated, and previously unseen samples, with minimal performance degradation. It achieves accuracy gains of +3-6% over leading methods and exhibits superior resilience under adversarial threat models. These results highlight the effectiveness of hierarchical conditioning, adversarial robustness, and multi-modal fusion in tackling the evolving landscape of malware. The proposed framework thus offers a scalable and generalizable approach for next-generation malware classification in real-world cybersecurity environments. © 2026 Elsevier Ltd.
2.
Cote, S. S. -P.; Paquette, G. R.; Neveu, S. -M.; Chartier, S.; Labbe, D. R.; Renaud, P.
Combining electroencephalography with plethysmography for classification of deviant sexual preferences. Proceedings Article
In: Proceedings - 9th International Workshop on Biometrics and Forensics, IWBF 2021, Institute of Electrical and Electronics Engineers Inc., 2021, ISBN: 978-172819556-8 (ISBN), (Journal Abbreviation: Proc. - Int. Workshop Biom. Forensics, IWBF).
Abstract | Links | BibTeX | Tags: Biometrics, Classification, Classification (of information), Decision trees, Deviant sexual preferences, Dimensionality reduction, Electroencephalography, Electrophysiology, extraction, Extraction method, Machine learning, Plethysmography, Proof of concept, Psychophysiological measures, Standard protocols, Variable selection and extraction
@inproceedings{cote_combining_2021,
title = {Combining electroencephalography with plethysmography for classification of deviant sexual preferences.},
author = {S. S. -P. Cote and G. R. Paquette and S. -M. Neveu and S. Chartier and D. R. Labbe and P. Renaud},
url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85113855965&doi=10.1109%2fIWBF50991.2021.9465078&partnerID=40&md5=b545b2a6d22e32115ac179399188960e},
doi = {10.1109/IWBF50991.2021.9465078},
isbn = {978-172819556-8 (ISBN)},
year = {2021},
date = {2021-01-01},
booktitle = {Proceedings - 9th International Workshop on Biometrics and Forensics, IWBF 2021},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {Evaluating sexual preferences is a difficult task. Past researchrelied mostly on penile plethysmography (PPG). Even though this technique is the standard protocol used in most currentforensic settings, its usage showed mixed results. One way to improve PPG is the addition of other psychophysiological measures such as electroencephalography (EEG). However, EEG generates significant amount of data that hinders classification. Machine learning (ML) is nowadays an excellent tool to identify most discriminating variables and for classification. Therefore, it is proposed to use ML selection and extraction methods for dimensionality reduction and then to classify sexual preferences. Evidence from this proof of concept shows that using EEG and PPG together leads to better classification (85.6%) than using EEG (82.2%) or PPG individually (74.4%). The Random Forest (RF) classifier combined with the Principal Component Analysis (PCA) extraction method achieves a slightly higher general performance rate. This increase in performances opens the door for using more reliable biometric measures in the assessment of deviant sexual preferences. © 2021 IEEE.},
note = {Journal Abbreviation: Proc. - Int. Workshop Biom. Forensics, IWBF},
keywords = {Biometrics, Classification, Classification (of information), Decision trees, Deviant sexual preferences, Dimensionality reduction, Electroencephalography, Electrophysiology, extraction, Extraction method, Machine learning, Plethysmography, Proof of concept, Psychophysiological measures, Standard protocols, Variable selection and extraction},
pubstate = {published},
tppubtype = {inproceedings}
}
Evaluating sexual preferences is a difficult task. Past researchrelied mostly on penile plethysmography (PPG). Even though this technique is the standard protocol used in most currentforensic settings, its usage showed mixed results. One way to improve PPG is the addition of other psychophysiological measures such as electroencephalography (EEG). However, EEG generates significant amount of data that hinders classification. Machine learning (ML) is nowadays an excellent tool to identify most discriminating variables and for classification. Therefore, it is proposed to use ML selection and extraction methods for dimensionality reduction and then to classify sexual preferences. Evidence from this proof of concept shows that using EEG and PPG together leads to better classification (85.6%) than using EEG (82.2%) or PPG individually (74.4%). The Random Forest (RF) classifier combined with the Principal Component Analysis (PCA) extraction method achieves a slightly higher general performance rate. This increase in performances opens the door for using more reliable biometric measures in the assessment of deviant sexual preferences. © 2021 IEEE.
3.
Laib, L.; Allili, M. S.; Ait-Aoudia, S.
A probabilistic topic model for event-based image classification and multi-label annotation Journal Article
In: Signal Processing: Image Communication, vol. 76, pp. 283–294, 2019, ISSN: 09235965 (ISSN), (Publisher: Elsevier B.V.).
Abstract | Links | BibTeX | Tags: Annotation performance, Classification (of information), Convolution, Convolution neural network, Convolutional neural nets, Event classification, Event recognition, Image annotation, Image Enhancement, Latent Dirichlet allocation, Multi-label annotation, Neural networks, Probabilistic topic models, Semantics, Statistics, Topic Modeling
@article{laib_probabilistic_2019,
title = {A probabilistic topic model for event-based image classification and multi-label annotation},
author = {L. Laib and M. S. Allili and S. Ait-Aoudia},
url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85067936924&doi=10.1016%2fj.image.2019.05.012&partnerID=40&md5=a617885b93f3a931c6b6ce1a165f940b},
doi = {10.1016/j.image.2019.05.012},
issn = {09235965 (ISSN)},
year = {2019},
date = {2019-01-01},
journal = {Signal Processing: Image Communication},
volume = {76},
pages = {283–294},
publisher = {Elsevier B.V.},
abstract = {We propose an enhanced latent topic model based on latent Dirichlet allocation and convolutional neural nets for event classification and annotation in images. Our model builds on the semantic structure relating events, objects and scenes in images. Based on initial labels extracted from convolution neural networks (CNNs), and possibly user-defined tags, we estimate the event category and final annotation of an image through a refinement process based on the expectation–maximization (EM)algorithm. The EM steps allow to progressively ascertain the class category and refine the final annotation of the image. Our model can be thought of as a two-level annotation system, where the first level derives the image event from CNN labels and image tags and the second level derives the final annotation consisting of event-related objects/scenes. Experimental results show that the proposed model yields better classification and annotation performance in the two standard datasets: UIUC-Sports and WIDER. © 2019 Elsevier B.V.},
note = {Publisher: Elsevier B.V.},
keywords = {Annotation performance, Classification (of information), Convolution, Convolution neural network, Convolutional neural nets, Event classification, Event recognition, Image annotation, Image Enhancement, Latent Dirichlet allocation, Multi-label annotation, Neural networks, Probabilistic topic models, Semantics, Statistics, Topic Modeling},
pubstate = {published},
tppubtype = {article}
}
We propose an enhanced latent topic model based on latent Dirichlet allocation and convolutional neural nets for event classification and annotation in images. Our model builds on the semantic structure relating events, objects and scenes in images. Based on initial labels extracted from convolution neural networks (CNNs), and possibly user-defined tags, we estimate the event category and final annotation of an image through a refinement process based on the expectation–maximization (EM)algorithm. The EM steps allow to progressively ascertain the class category and refine the final annotation of the image. Our model can be thought of as a two-level annotation system, where the first level derives the image event from CNN labels and image tags and the second level derives the final annotation consisting of event-related objects/scenes. Experimental results show that the proposed model yields better classification and annotation performance in the two standard datasets: UIUC-Sports and WIDER. © 2019 Elsevier B.V.
4.
Ouyed, O.; Allili, M. S.
Feature relevance for kernel logistic regression and application to action classification Proceedings Article
In: Proceedings - International Conference on Pattern Recognition, pp. 1325–1329, Institute of Electrical and Electronics Engineers Inc., 2014, ISSN: 10514651, (ISSN: 10514651).
Abstract | Links | BibTeX | Tags: Action classifications, Action recognition, Classification (of information), Classification methods, Classification performance, Feature relevance, Kernel logistic regression, Logistic regression, Multinomial kernels, Pattern Recognition, Supervised classification, Support vector machines
@inproceedings{ouyed_feature_2014,
title = {Feature relevance for kernel logistic regression and application to action classification},
author = {O. Ouyed and M. S. Allili},
url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84919884283&doi=10.1109%2fICPR.2014.237&partnerID=40&md5=616038cd7924614fd633061dfed32903},
doi = {10.1109/ICPR.2014.237},
issn = {10514651},
year = {2014},
date = {2014-01-01},
booktitle = {Proceedings - International Conference on Pattern Recognition},
pages = {1325–1329},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {An approach is proposed for incorporating feature relevance in mutinomial kernel logistic regression (MKLR) for classification. MKLR is a supervised classification method designed for separating classes with non-linear boundaries. However, it assumes all features are equally important, which may decrease classification performance when dealing with high-dimensional or noisy data. We propose a feature weighting algorithm for MKLR which automatically tunes features contribution according to their relevance for classification and reduces data over-fitting. The proposed algorithm produces more interpretable models and is more generalizable than MKLR, Kernel-SVM and LASSO methods. Application to simulated data and video action classification has provided very promising results compared to the aforementioned classification methods. © 2014 IEEE.},
note = {ISSN: 10514651},
keywords = {Action classifications, Action recognition, Classification (of information), Classification methods, Classification performance, Feature relevance, Kernel logistic regression, Logistic regression, Multinomial kernels, Pattern Recognition, Supervised classification, Support vector machines},
pubstate = {published},
tppubtype = {inproceedings}
}
An approach is proposed for incorporating feature relevance in mutinomial kernel logistic regression (MKLR) for classification. MKLR is a supervised classification method designed for separating classes with non-linear boundaries. However, it assumes all features are equally important, which may decrease classification performance when dealing with high-dimensional or noisy data. We propose a feature weighting algorithm for MKLR which automatically tunes features contribution according to their relevance for classification and reduces data over-fitting. The proposed algorithm produces more interpretable models and is more generalizable than MKLR, Kernel-SVM and LASSO methods. Application to simulated data and video action classification has provided very promising results compared to the aforementioned classification methods. © 2014 IEEE.
5.
Gagnon, S.; Messaoudi, S.; Charbonneau, A.
In: CORIA 2011: COnference en Recherche d'Information et Applications - Conference on Information Retrieval and Applications, pp. 151–158, Avignon, 2011, ISBN: 978-2-35768-024-1.
Abstract | Links | BibTeX | Tags: Administrative data processing, Automation, Classification (of information), Domain-specific ontologies, Extensible Business Reporting Language (XBRL), F measure, Financial news, Information retrieval, Ontology, Reuters, Text classification, Text processing
@inproceedings{gagnon_automated_2011,
title = {Automated Text Classification based on an ontology standard: Application of the Extensible Business Reporting Language (XBRL) to Reuters Corpus Volume 1 (RCV1) [Classification automatique de textes basée sur une ontologie normée: Application du Extensible Business Reporting Language (XBRL) au Reuters Corpus Volume 1 (RCV1)]},
author = {S. Gagnon and S. Messaoudi and A. Charbonneau},
url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84869423599&partnerID=40&md5=1d12a436b5acb9f715fd6f1669e37be4},
isbn = {978-2-35768-024-1},
year = {2011},
date = {2011-01-01},
booktitle = {CORIA 2011: COnference en Recherche d'Information et Applications - Conference on Information Retrieval and Applications},
pages = {151–158},
address = {Avignon},
abstract = {We demonstrate that applying a domain-specific ontology standard significantly improves Automated Text Classification (ATC). We use the Extensible Business Reporting Language (XBRL) to define a standard ontology and compare the performance of an ACT engine (IBM Classification Module v.8.6) against 2 other list of concepts, namely simple and hierarchical. Our sample of financial news is extracted from the Reuters Corpus Volume 1 (RCV1), where 2 experts in finance help us code 1000 of the 45000 news dealing with mergers and acquisitions. We report recall, precision, the F measure, and in addition a hierarchical measure adjusted for classification relevance in parent classes, as well as a more detailed measure evaluating the classification improvements at the level of each text.},
keywords = {Administrative data processing, Automation, Classification (of information), Domain-specific ontologies, Extensible Business Reporting Language (XBRL), F measure, Financial news, Information retrieval, Ontology, Reuters, Text classification, Text processing},
pubstate = {published},
tppubtype = {inproceedings}
}
We demonstrate that applying a domain-specific ontology standard significantly improves Automated Text Classification (ATC). We use the Extensible Business Reporting Language (XBRL) to define a standard ontology and compare the performance of an ACT engine (IBM Classification Module v.8.6) against 2 other list of concepts, namely simple and hierarchical. Our sample of financial news is extracted from the Reuters Corpus Volume 1 (RCV1), where 2 experts in finance help us code 1000 of the 45000 news dealing with mergers and acquisitions. We report recall, precision, the F measure, and in addition a hierarchical measure adjusted for classification relevance in parent classes, as well as a more detailed measure evaluating the classification improvements at the level of each text.