It is indicated that integrating static and dynamic features at the representation level can improve robustness and classification performance in image-based malware detection, particularly under variations in feature availability.
Abstract
Image-based malware detection has emerged as an alternative to high-dimensional handcrafted feature representations; however, most existing approaches rely primarily on static features or encode multiple features from a single analysis domain, which may limit robustness under code obfuscation and incomplete feature extraction. This paper proposes Hybrid Feature Image Mapping (HFIM), a multi-channel malware visualization technique that integrates structural (binary content), semantic (opcode transitions), and behavioral (API activity) information into a unified RGB representation. HFIM is designed as a representation-level approach that encodes complementary static and dynamic characteristics within a single image, allowing convolutional neural networks (CNNs) to exploit complementary cross-domain patterns while maintaining classification performance when certain feature streams are partially unavailable. HFIM is evaluated against three representative malware imaging methods, HIT4Mal, MC-ISA, and MTV, using seven CNN architectures under identical training conditions to ensure fair comparison and isolate the impact of feature representation. Experimental results based on 10-fold cross-validation demonstrate consistent improvements across multiple evaluation metrics, including accuracy, precision, recall, and F1-score. Additional analyses, including ablation and family-aware evaluation, further indicate that multi-domain integration provides a more discriminative and stable representation than single-domain approaches, particularly under variations in feature availability. These results indicate that integrating static and dynamic features at the representation level can improve robustness and classification performance in image-based malware detection.
Recent studies have shown that binary-to-image representations can enable effective machine learning-based results for malware detection and classification. However, performance can vary significantly, depending on the technique used to convert binaries to images. Furthermore, the explainability and interpretability of image-based models is largely unexplored within the malware domain. In this research, we employ Gradient-weighted Class Activation Maps (Grad-CAM) as an eXplainable AI (XAI) tool, which we use to analyze eight distinct image types derived from malware samples. We provide quantitative faithfulness and stability metrics for Grad-CAM heatmaps and we compare these heatmaps to High-Resolution Class Activation Mappings (HiResCAM). We also show that Grad-CAM heatmaps can provide useful information for malware classification. Specifically, we show that a Random Forest model trained on features extracted from Grad-CAM images via a MobileNetV2 Convolutional Neural Network (CNN) model achieves a test accuracy of 0.777 across 17 malware families, exceeding a previous benchmark of 0.750 for this same dataset. A key finding of this research is that for the malware image transformations considered, accuracy and explanation faithfulness do not coincide, e.g., image transformation techniques that produce the most faithful explanations yield only mid-tier accuracy.
This paper introduces a compact convolutional neural network (CNN) architecture integrated with a multi-head attention mechanism to enhance feature discrimination in malware family classification. The novelty lies in combining attention-based refinement within a lightweight framework that achieves comparable accuracy to larger model while maintaining computational efficiency. The integrated multi-head attention module emphasizes small yet highly discriminative regions, which often correspond to obfuscated or subtly modified code segments that traditional models overlook. In contrast to reverse engineering or handcrafted feature methods, the framework is fully automated and computationally efficient, requiring only 2.03 M parameters approximately one-fifth of the baseline CNN while reducing training time by 42% and inference latency by 37% on the same hardware configuration. Experiments were conducted on the widely used Malimg dataset, which comprises 9,342 grayscale images across 25 malware families, under multiple train–test splits (50/50 to 90/10). The results consistently demonstrate superior performance relative to the baseline CNN, the model achieving an average accuracy of 98.7 ± 0.3% across five randomized train–test splits, with a peak performance of 99% on the 80/20 partition. Data partitions were strictly disjoint to prevent leakage between training and test sets. Furthermore, the proposed model attains high weighted Precision, Recall, and F1 scores (≈0.99) and enhanced macro-averaged performance (up to 0.97), particularly enhancing classification for minority families that the baseline misclassified or failed to detect. Confusion matrix analysis further highlights that residual misclassifications occur primarily in families with limited samples or high morphological similarity. Comparative evaluation against recent studies confirms the superiority of the proposed approach in terms of both accuracy and computational efficiency. Despite these strengths, limitations remain, including dependence on labeled datasets, restricted interpretability, and the need for validation on more diverse, real-world malware corpora.
Mohammed Kasem Al-Bayati· Zanco Journal of Pure and Ap...· 0 citations
A novel hybrid CNN-Hopfield Neural Network (CNN-HNN) framework that replaces traditional dense classification heads with continuous Modern Hopfield associative memory layers is proposed, achieving top-tier accuracy and reducing classification-head parameter counts while reducing floating-point operations (FLOPs) and accelerating inference latency to under 2 ms per sample.
Uma Kannan, Rajendran Swamidurai· International journal of res...· 0 citations
The study introduces an innovative approach of deep learning-based hybrid system to classify malware based on its real-time detection using a novel architecture called “Gated Convolutional Embedded Convolutional Network - Bidirectional Long Short-Term Memory (GCE-CNN-BiLSTM)” that integrates both static and dynamic sequences of malware (malware)..This system combines two data types for use with malware detection: the first is static characteristics (opcode) and n-grams of the static data (extracted from Portable Executable - PE - files) while the second is log data dynamically created in an environment where the malware was run (i.e., using the Cuckoo Sandbox). The log files contain information on dynamic activities performed by an executable file during execution (such as API calls, changing the registry, performing file system activity) and the static characteristics of the executable binary itself. The proposed system uses a one-dimensional (1D) CNN for localized, binary opcodes to create input sequences containing embedded opcode sequences which will be used by the LSTM to perform binary classification of malware execution; furthermore, a Bidirectional LSTM will be used to capture long-term (temporal) dependencies associated with executable files executed in the malware (opcode) execution flow and execution behaviour. The output from both channels (CNN and Bidirectional LSTM) will be combined and fused together for robustness purposes against obfuscated executables, packed executables, and polymorphic executables. The performance metrics were evaluated using a total of 10,000 labelled malware data samples from the Malimg datasets and 7,500 labelled executable behaviours generated by Cuckoo Sandbox. The accuracy for GCE-CNN-BiLSTM using these datasets was found to be at 98.3% accuracy, 97.8% precision, and 98.1% recall, demonstrating the efficacy of using a hybrid approach for advanced malware detection.
Nishok Kumar S, L. Sheela· Adolescência e Saúde· 0 citations
The findings indicate that combining deep representation learning with ensemble classification can improve dynamic malware detection and reduce dependence on static signatures.
Karthick Ganapathy· Journal of Computer and Fore...· 0 citations
