A Comparison of Malware Image Transformations Using Grad-CAM and Hybrid Learning Models

2026-08-12

AI Summary

This study addresses the significant performance disparities among existing binary-to-image conversion methods in malware detection and the lack of systematic evaluation of model interpretability. It presents the first comprehensive comparison of eight image representation techniques, revealing an inconsistency between classification accuracy and explanation fidelity. To bridge this gap, the authors propose a hybrid model combining MobileNetV2 with Random Forest, enhanced by integrating Grad-CAM and HiResCAM to leverage interpretable features for improved prediction. Furthermore, they introduce quantitative metrics to assess the faithfulness and stability of explanations. Evaluated on a 17-class malware dataset, the proposed approach achieves a test accuracy of 0.777, surpassing the previous state-of-the-art baseline of 0.750, thereby offering both empirical grounding and methodological innovation for interpretable malware detection.

Abstract

Recent studies have shown that binary-to-image representations can enable effective machine learning-based results for malware detection and classification. However, performance can vary significantly, depending on the technique used to convert binaries to images. Furthermore, the explainability and interpretability of image-based models is largely unexplored within the malware domain. In this research, we employ Gradient-weighted Class Activation Maps (Grad-CAM) as an eXplainable AI (XAI) tool, which we use to analyze eight distinct image types derived from malware samples. We provide quantitative faithfulness and stability metrics for Grad-CAM heatmaps and we compare these heatmaps to High-Resolution Class Activation Mappings (HiResCAM). We also show that Grad-CAM heatmaps can provide useful information for malware classification. Specifically, we show that a Random Forest model trained on features extracted from Grad-CAM images via a MobileNetV2 Convolutional Neural Network (CNN) model achieves a test accuracy of 0.777 across 17 malware families, exceeding a previous benchmark of 0.750 for this same dataset. A key finding of this research is that for the malware image transformations considered, accuracy and explanation faithfulness do not coincide, e.g., image transformation techniques that produce the most faithful explanations yield only mid-tier accuracy.

Problem

• malware detection
• image transformation
• explainable AI
• model interpretability
• binary-to-image

Innovation

• Grad-CAM
• malware image transformation
• explainable AI
• hybrid learning model
• faithfulness metrics