CVTF : CNN-Vision Transformer Fusion for adaptive steganographic malware detection in social media images


Abstract

The exponential growth of social media platforms has heightened the risk of image-based malware, where malicious code is covertly embedded within otherwise benign images using steganographic techniques. Traditional detection systems struggle to identify these threats due to their static nature and inability to recognize adaptive concealment methods. To address these challenges, we propose CVTF (CNN-Vision Transformer Fusion), a hybrid framework that integrates Convolutional Neural Networks (CNNs) with Vision Transformers (ViTs) to exploit both local pixel patterns and global contextual cues through a novel attention-weighted feature fusion mechanism. Coupled with a Dynamic Threshold Calibration Mechanism (DTCM), the CVTF framework adaptively adjusts classification boundaries in real time to reduce false positives while maintaining high sensitivity. Additionally, the Adaptive Threat Profiling Module (ATPM) incrementally updates the model to respond effectively to newly emerging malware variants, thereby mitigating zero-day threats. Extensive experiments on real-world social media image datasets, comprising both benign and steganographically modified malware samples, demonstrate the robustness and scalability of CVTF. The system achieves 95.2% detection accuracy, 2.3 ms average inference time, and a 3.5% accuracy improvement through continuous learning from 1,000 new malicious samples. These results validate the efficacy of CVTF in detecting stealthy malware payloads while maintaining low-latency, real-time performance. CVTF can be seamlessly integrated into existing security infrastructures, enhancing the detection of steganographic threats and promoting secure social media ecosystems
Ask to review this manuscript

Notes for potential reviewers

  • Volunteering is not a guarantee that you will be asked to review. There are many reasons: reviewers must be qualified, there should be no conflicts of interest, a minimum of two reviewers have already accepted an invitation, etc.
  • This is NOT OPEN peer review. The review is single-blind, and all recommendations are sent privately to the Academic Editor handling the manuscript. All reviews are published and reviewers can choose to sign their reviews.
  • What happens after volunteering? It may be a few days before you receive an invitation to review with further instructions. You will need to accept the invitation to then become an official referee for the manuscript. If you do not receive an invitation it is for one of many possible reasons as noted above.

  • PeerJ Computer Science does not judge submissions based on subjective measures such as novelty, impact or degree of advance. Effectively, reviewers are asked to comment on whether or not the submission is scientifically and technically sound and therefore deserves to join the scientific literature. Our Peer Review criteria can be found on the "Editorial Criteria" page - reviewers are specifically asked to comment on 3 broad areas: "Basic Reporting", "Experimental Design" and "Validity of the Findings".
  • Reviewers are expected to comment in a timely, professional, and constructive manner.
  • Until the article is published, reviewers must regard all information relating to the submission as strictly confidential.
  • When submitting a review, reviewers are given the option to "sign" their review (i.e. to associate their name with their comments). Otherwise, all review comments remain anonymous.
  • All reviews of published articles are published. This includes manuscript files, peer review comments, author rebuttals and revised materials.
  • Each time a decision is made by the Academic Editor, each reviewer will receive a copy of the Decision Letter (which will include the comments of all reviewers).

If you have any questions about submitting your review, please email us at [email protected].