Malware Multi-Class Classification based on Malware Visualization using a Convolutional Neural Network Model

Abstract

Malware classification has already been a prominent concern for decades, and malware attacks have proliferated at an astounding rate, constituting a significant threat to cyberspace. Deep learning (DL) and malware image approaches are becoming more prevalent in the field of malware analysis, with spectacular results. This work focuses on the challenge of classifying malware variants that are represented as images. This study employs visualization and proposes a convolutional neural network (CNN) based DL model to effectively and accurately classify malware. The proposed model is trained and tested on a very challenging and heterogeneous dataset, and it achieves accuracy of 98.179%, precision of 97.39%, a F1-score of 97.70%, and a fast classification speed (3 seconds needed to test 934 unseen malware). This demonstrates the proposed model's incredibly quick, effective and accurate performance. The proposed model outperformed existing traditional DL models in terms of various performance measures and demonstrated its usefulness in classifying malware families through visualization. This study and experimental results reveal that small-scale malware images and a simple CNN architecture alone are capable of accurately classifying malware families with high classification accuracy.

A Deep Learning Model for Malware Multi-Class Classification based on Colored Malware Images

“…Besides, their results do not reflect real accuracy due to the small dataset that they used. As shown in Table 7, employing color malware visualization rather than grayscale malware visualization has an advantageous impact on model performance, with a modest improvement in accuracy gained compared to grayscale malware image processing on the same CNN architecture [37]. The suggested approach is distinctive in that it uses a 4×4 filter/kernel for classification for the first time and builds a lightweight CNN model without using any pre-trained DL models.…”