🤖 AI Summary
This study addresses the growing threat of malware by proposing HilEnT, a novel binary-to-image conversion method that maps malware binaries into three-channel color images through Hilbert curve mapping integrated with local entropy features. By combining deep learning with few-shot learning strategies, the approach significantly enhances malware detection and classification performance across four public datasets. Experimental results demonstrate that HilEnT achieves high accuracy and robustness in both binary and multi-class classification tasks, particularly excelling in low-data regimes. The method effectively supports few-shot malware recognition, offering a promising solution for identifying malicious software under data-scarce conditions.
📝 Abstract
With the increasing threat of malware across various software related domains, malware detection and classification is critical to determine the response actions. Different strategies have been adopted to address the challenge of malware detection. With the advent of deep learning techniques, malware detection using image processing has garnered research attention. In this work, we proposed a novel malware binary to image transformation technique HilEnT based on a combination of Hilbert curve-based transformation of malware binary and the entropy feature comparison of malware file with benign and malware classes. Three grayscale images produced during this process are combined to form a three-channel colored image which is then used for malware detection using machine learning techniques. We performed supervised binary and multiclass classification to evaluate the effectiveness of our proposed HilEnT. We also evaluated a few-shot learning technique to assess the robustness of our proposed HilEnT in a practical setting where the number of available class samples is limited. Furthermore, we investigated the benefits of combination of Histogram of Oriented Gradients and Principal Component Analysis for time performance improvements through feature reduction techniques. We evaluated our proposed methodology on four datasets: Dike, Michael Lester Dataset, Microsoft BIG 2015 and a self-collected dataset, and achieved the state-of-the-art results.