The 11th National Conference on Cybersecurity Research (JNIC 2026) will take place from May 6 to 8, 2026, in Barcelona, at the North Campus of the Universitat Politècnica de Catalunya (UPC). The event will be held in the Auditorium of the Vèrtex Building, located in the university area of the city, which is well connected to the city centre and easily accessible by public transport.
The Universitat Politècnica de Catalunya (UPC) is a leading institution in Spain in the fields of engineering, architecture, science, and technology, recognised for its research excellence and strong collaboration with industry. The North Campus, which hosts the conference, is home to the ISG-MAK research group (Information Security Group – Mathematics Applied to Cryptography), responsible for the local organisation of this edition.
During the conference, I presented the paper Threat Mutation Identification via Transformer-based Analysis of Malware Assembly on threat mutation identification using Transformer-based semantic representations of assembly code and enriched static binary features. The research addresses the increasing ability of modern malware to use mutation and obfuscation techniques to evade traditional signature- and rule-based detection mechanisms.
As part of this research, I developed a PoC malware analysis application and built a large-scale dataset from more than 30 million malware samples gathered from vx-underground. The binaries were disassembled using Radare2 and classified by malware family, creating a dataset containing the assembly instructions of each binary. These instructions were then tokenized and transformed into embeddings to fine-tune a BERT-based model capable of learning semantic similarities between malware variants.
BERT was selected over larger architectures as a trade-off between classification performance and computational cost, allowing experimentation at this scale without the substantially higher hardware and training requirements of larger models. The resulting system achieved over 97% accuracy in distinguishing malicious from benign samples and over 93% accuracy in malware family classification.
Beyond the research experiments, I implemented the approach as a complete analysis application. The model was exposed through FastAPI endpoints served with Uvicorn, accompanied by a simple drag-and-drop interface for analysing binaries, and the complete application was containerized with Docker for deployment across different environments.
The work also connects with a broader area of my current research: the use of Transformer-based models as security-critical components in adversarial environments. While learned representations can provide powerful mechanisms for identifying similarities across mutated threats, those same representations may themselves become targets for adaptive evasion and manipulation. This makes evaluating their robustness under adversarial conditions an important part of deploying AI-based detection systems in operational cybersecurity environments.