CAM-Guided Saliency Cutout and Image-Based Malware Classification

2026-08-12

AI Summary

This study investigates the optimization of Cutout data augmentation to enhance the generalization of image classification models, with a specific focus on malware image classification. The authors propose a HiResCAM-guided Cutout approach that masks either high- or low-saliency regions, comparing it against random Cutout and no augmentation. To the best of our knowledge, this is the first application of saliency-guided Cutout to malware imagery. Systematic evaluations are conducted on both RawMal-TF and CIFAR-100 datasets, examining the impact of varying Cutout ratios and numbers. Results reveal that all Cutout variants slightly underperform the baseline on RawMal-TF, whereas low-saliency Cutout yields marginal gains on CIFAR-100, highlighting a strong domain dependency and challenging the assumption that techniques effective for natural images directly transfer to malware image analysis.

Abstract

Dropout regularization is commonly used to reduce overfitting by removing parts of a neural network during training. For Convolutional Neural Networks (CNN), cutouts serve a somewhat analogous purpose. Cutouts can be implemented as data augmentation: the original training image is retained, and additional copies are created with regions removed. In this chapter, we test whether cutout placement can be improved by using High-Resolution Class Activation Mapping (HiResCAM). We compare four controlled training conditions: no cutout, standard random cutout, low-saliency cutout, and high-saliency cutout. We experiment using grayscale malware images from the RawMal-TF dataset (17 families with~1,000 samples per family), and for comparison to natural images, we experiment with the well-known CIFAR-100 dataset. All experiments are based on ResNet18 with~100 training epochs. For the cutout experiments, we test cutout areas of~5\%, 10\%, 20\%, and~30\%, and we consider~$M\in\{4,8}$ augmented copies per original training image. The RawMal-TF results are slightly worse for all three cutout cases (random, high and low saliency) as compared to no cutouts. In contrast, our CIFAR-100 experimental results improve slightly under low-saliency cutout. These results suggest that the value of saliency-guided cutout is domain dependent, and that malware images should not be treated as equivalent to natural images.

Problem

• saliency-guided cutout
• malware image classification
• data augmentation
• domain dependency
• CNN regularization

Innovation

• saliency-guided cutout
• HiResCAM
• malware image classification
• data augmentation
• domain-dependent regularization