diff --git a/deepfence_server/model/scans.go b/deepfence_server/model/scans.go
index d40f948f87..1c9c0a2384 100644
--- a/deepfence_server/model/scans.go
+++ b/deepfence_server/model/scans.go
@@ -453,6 +453,7 @@ type Malware struct {
 	Filetype         string        `json:"filetype"`
 	Info             string        `json:"info"`
 	Version          string        `json:"version"`
+	Reference        string        `json:"reference"`
 	SeverityScore    int           `json:"severity_score"`
 	StringsToMatch   []interface{} `json:"strings_to_match"`
 	Summary          string        `json:"summary"`
@@ -485,7 +486,6 @@ type MalwareRule struct {
 	Filetype     string `json:"filetype"`
 	Info         string `json:"info"`
 	Version      string `json:"version"`
-	Reference    string `json:"reference"`
 	FileSeverity string `json:"file_severity"`
 	Masked       bool   `json:"masked" required:"true"`
 	Payload      string `json:"payload" required:"true"`
diff --git a/deepfence_worker/ingesters/malware.go b/deepfence_worker/ingesters/malware.go
index 051b936058..8978f5a424 100644
--- a/deepfence_worker/ingesters/malware.go
+++ b/deepfence_worker/ingesters/malware.go
@@ -81,6 +81,7 @@ func malwareToMaps(data []ingestersUtil.Malware) ([]map[string]map[string]interf
 
 		malware["node_id"] = generateHashFromString(fmt.Sprintf("%v:%v",
 			i.MetaRules.RuleID, i.CompleteFilename))
+		malware["reference"] = i.MetaRules.Reference
 
 		malwares = append(malwares, map[string]map[string]interface{}{
 			"Rule":    utils.ToMap(i.MetaRules),