A New Framework for Visual Classification of Multi-Channel Malware Based on Transfer Learning

Abstract

With the continuous development and popularization of the Internet, there has been an increasing number of network security problems appearing. Among them, the rapid growth in the number of malware and the emergence of variants have seriously affected the security of the Internet. Traditional malware detection methods require heavy feature engineering, which seriously affects the efficiency of detection. Existing deep-learning-based malware detection methods have problems such as poor generalization ability and long training time. Therefore, we propose a malware classification method based on transfer learning for multi-channel image vision features and ResNet convolutional neural networks. Firstly, the features of malware samples are extracted and converted into grayscale images of three different types. Then, the grayscale image sizes are processed using the bilinear interpolation algorithm to make them uniform in size. Finally, the three grayscale images are synthesized into three-dimensional RGB images, and the RGB images processed using data enhancement are used for training and classification. For the classification model, we used the previous ImageNet dataset (>10 million) and trained all the parameters of ResNet after loading the weights. For the evaluations, an experiment was conducted using the Microsoft BIG benchmark dataset. The experimental results showed that the accuracy on the Microsoft dataset reached 99.99%. We found that our proposed method can better extract the texture features of malware, effectively improve the accuracy and detection efficiency, and outperform the compared models on all performance metrics.