Literature Survey:
The field of malware detection has been widely studied, with researchers
exploring both traditional machine learning and more advanced deep learning
techniques. One established approach, cited in [1], involves employing
algorithms like decision trees and random forests. In this method, the model
with the best accuracy is chosen to maximize detection, and its performance is
validated by analyzing false positive and false negative rates via a confusion
matrix. In contrast, newer research [2] focuses on a deep-learning-based
solution. This work introduces a novel hybrid architecture designed to classify
malware variants by integrating two pre-formed network models in an
optimized way. The development of this architecture follows a structured
process that includes data acquisition, designing the neural network, and
building the final model.
Malware is widely recognized as a significant security risk within the digital
landscape. To determine if a program is malicious, a common practice among
researchers is to extract its essential features to discern its operational purpose.
Central to this analysis is examining the sequence of system calls made by the
program. Although a program's behavioural characteristics are often indicated
by its system calls, this data is inherently low-level and not easily understood,
which makes it challenging to readily determine the program's true behavioural
intent.
To address this limitation, the work in [3] introduces a framework of 15 defined
behaviour types to better characterize a program's patterns. By constructing a
feature vector from both the program's operational sequence and these high-
level behavior types, the complexity of the feature vector is reduced, allowing
for a more precise understanding of the program's operational intentions.
[Link] ALGORITHMS ACCURACY(%) RESEARCH GAP
A classification approach can be additionally
implemented for the malware detection system
1 Decision Tree 99.04 presented which will involve the correct
identification of the type of malware that has
attacked the file.
A classification approach can be additionally
implemented for the malware detection system
2 RandomForest 99.47 presented which will involve the correct
identification of the type of malware that has
attacked the file.
A classification approach can be additionally
implemented for the malware detection system
3 AdaBoost 98.58 presented which will involve the correct
identification of the type of malware that has
attacked the file.
A classification approach can be additionally
implemented for the malware detection system
4 GradientBoosting 98.76 presented which will involve the correct
identification of the type of malware that has
attacked the file.
A classification approach can be additionally
implemented for the malware detection system
5 Naive Bayes 70.24 presented which will involve the correct
identification of the type of malware that has
attacked the file.
Does not apply any recurrent neural networks for
6 Logistic regression 67.4 malware detection due to which accuracy is not at
mark.
Does not apply any recurrent neural networks for
K-nearest
7 81.5 malware detection due to which accuracy is not at
neighbor
mark.
Does not apply any recurrent neural networks for
Support vector
8 74.5 malware detection due to which accuracy is not at
Machine
mark.
This approach is insufficient because it uses
existing malware binaries. The analyzed semantic
9 DNN 91
features were relatively low-level and difficult to
understand.
This approach is insufficient because it uses
existing malware binaries. The analyzed semantic
10 CNN 93.6
features were relatively low-level and difficult to
understand.
11 LSTM 96.14 This approach is insufficient because it uses
existing malware binaries. The analyzed semantic
features were relatively low-level and difficult to
understand.
Depends on single program execution of a malware
12 XGBoost 98.72
binary. It doesn't work well on unstructured data.
The main purpose is to design a malware detector with a higher F1-score for
machine learning technique. A novel framework that classifies malware using
the features named opcode and application programming interface calls is
presented. The combination of n-gram and feature selection techniques is
created for API and opcode- based datasets. The final label of the malicious
samples is decided by the maximum probability of the detection made by API
and opcode-based detectors. According to [4] multiple machine learning
algorithms: Decision Tree (DT), Random Forest (RF), Naïve Bayes (NB),
Logistic Regression (LR) as well as Neural Network (NN)-based classifiers on a
selected number of features for ransomware classification. Experiments on one
ransomware dataset are performed to evaluate the proposed framework. The
results come to the conclusion that Random Forest classifiers have the best
accuracy as compared to the other machine learning methods in terms of F-beta
and precision scores.
According to [5] , Machine learning algorithms are evaluated on the basis of
their accuracy, by conducting various experiments . In [5] performance
measures of 10 machine learning algorithms are evaluated on a data set that
contains 15036 malwares and benigns applications.
The first part of the survey provides an overview of traditional machine learning
and deep learning approaches for malware detection, highlighting methods like
decision trees and random forests, as well as a novel hybrid deep learning
architecture. It also discusses the challenge of analyzing low-level system calls
and the use of high-level behavior types to improve feature vectors. While these
methods are effective, the field continues to evolve with a strong focus on
image-based approaches. The second part expands on this, delving into the
specific area of deep learning for image-based malware classification. It details
how researchers are converting malware into images and applying various
convolutional neural network (CNN) architectures to identify malicious
programs. This shift demonstrates a progression from analyzing code behavior
to recognizing visual patterns, a frontier that has led to significant advancements
in detection accuracy.
In [6] the authors propose a system named D-WARE, which exemplifies an
early hybrid approach to this problem.1 The methodology begins with the
collection of malware samples from the Malimg dataset, which are then
converted into binary image representations. The framework first uses Principal
Component Analysis (PCA) for feature extraction from the bit images, followed
by Particle Swarm Optimization (PSO) for feature selection and dimensionality
reduction. Only after this feature engineering process are the selected features
passed to a custom CNN for classification. In a comparative analysis against
established architectures like VGG16, VGG19, Densenet, and Alexnet, the
proposed D-WARE system achieved a superior accuracy of 96%. This result
validated the image-based approach while also demonstrating the potential of
combining traditional feature engineering with deep learning classifiers. 1
Similarly, the study [7] focuses on refining the application of custom CNNs.1
This work builds upon a pre-existing visualization technique, Vismal, which
enhances malware images using a contrast-limited adaptive histogram
equalization (CLAHE) algorithm. The purpose of this enhancement is to
amplify the visual similarity of malware within the same family, making their
characteristic patterns more discernible. The primary contribution of this
research lies in the meticulous parameter tuning of a custom 11-layer CNN
model. The authors systematically experimented with different epochs,
optimizers, and learning rates to identify the optimal configuration for the
Malimg dataset. This rigorous optimization process, a crucial step in maturing
the application of deep learning, resulted in a model that achieved a final
accuracy of 98.85%. This performance represented a significant improvement of
nearly 2% over the baseline Vismal approach, underscoring the importance of
careful model tuning in achieving high-fidelity classification. 1
The [8] provides a focused and methodical comparative analysis of various
architectures within the Residual Network (ResNet) family.1 The researchers
converted malware and benign executables into 256x256 grayscale images and
then trained and evaluated five different ResNet models of increasing depth:
ResNet-18, ResNet-34, ResNet-50, ResNet-101, and ResNet-152. Their
findings established a direct and clear correlation between network depth and
classification performance. The deepest model, ResNet-152, achieved the
highest accuracy of 93.5% and the best F1-score of 94.1%. This result strongly
suggested that deeper networks are better equipped to capture the complex and
subtle visual features that differentiate malware families. However, the study
also highlighted a critical trade-off: performance gains came at the cost of
increased computational time, with ResNet-152 exhibiting the longest run-time
among the tested models, a key consideration for practical, real-time detection
systems.1
In a broader investigation, the study [9] conducted a comprehensive
comparative analysis across a diverse set of popular off-the-shelf CNN
architectures.1 The authors evaluated a custom-designed CNN against
established models including AlexNet, VGG-16, ResNet-50, and InceptionV3.
The results unequivocally demonstrated the superiority of the pre-trained
models over their custom-built counterpart. Among the tested architectures, the
InceptionV3 model emerged as the top performer, achieving a remarkable test
accuracy of 98.90% on the Malimg dataset.
The paper [10]. is a prime example of this innovative direction.1 The authors
propose a novel method to visualize malware by transforming its binary
structure into the frequency domain. Their results were compelling: an ensemble
model that combined features extracted from both their novel "bigram-dct"
images and traditional byte-plot images achieved a high binary classification
accuracy of 96%. This demonstrated that the two visualization methods were
complementary, each capturing unique aspects of the malware's structure. 1
An even more sophisticated hybrid architecture is presented in [11]. This work
introduces a two-stage framework that decouples feature extraction from
classification. In the first stage, a powerful pre-trained model, EfficientNetB0, is
used not for classification but purely as a high-level feature extractor. The rich
feature vectors generated by EfficientNetB0 are then passed to a second stage,
which consists of a stacking classifier. This ensemble method combines the
predictions of two base-level models—a Linear Support Vector Machine (SVM)
and a Random Forest—using a Logistic Regression model as a meta-classifier
to produce the final output. This advanced architecture achieved perfect (100%)
accuracy in binary (malware vs. benign) classification and an impressive 92.9%
accuracy on a more challenging 5-class malware variant classification task. This
study explicitly demonstrated that replacing a CNN's standard, simple softmax
classification layer with a more complex and powerful classifier
[12]is a landmark study in this regard. The authors' core contribution is the
direct integration of a multi-headed attention layer into a CNN architecture
specifically for malware family classification. The stated purpose of this
architectural innovation is to enable the model to automatically locate and
prioritize the tiny, infected regions within the overall malware image. The
experimental results powerfully validate this approach. On an 80/20 training-
testing split of the Malimg dataset, the attention-based CNN achieved an
accuracy of 99%, a substantial improvement over its non-attention counterpart,
which scored only 93% on the identical task.
The paper [13] exemplifies this pragmatic approach.1 The authors introduce the
VBDN (Visualization, Balanced adoption, Data augmentation, and Neural
network) framework, with a primary design goal of creating an algorithm that is
both efficient and generalizable across multiple, diverse malware datasets
(Malimg, Big2015, Malevis, and Blended). To achieve this, they designed a
custom, relatively simple CNN architecture, referred to as ConvNet. A key
contribution of their work is the rigorous benchmarking of this model's
processing time against larger, more complex, state-of-the-art architectures. The
results demonstrated that their ConvNet could achieve strong, generalizable
accuracy (over 90% on all four datasets) while offering a dramatic reduction in
processing time.
Comparative Analysis of Methodologies
The diverse approaches discussed in this report can be effectively summarized
and compared to highlight their unique contributions and performance
characteristics. The following table provides a consolidated overview of the key
methodologies, their innovations, and their reported results.
Core Dataset(s) Key Innovation/Contribution Reported Top
Methodology Employed Accuracy
Custom CNN Malimg Hybrid feature engineering (PCA/PSO) 96%
with PCA/PSO before CNN classification
Parameter-Tuned Malimg Image enhancement (CLAHE) and 98.85%
Custom CNN meticulous hyperparameter tuning
Transfer Learning Custom (3k Systematic comparison of ResNet 93.5% (ResNet-
(ResNet) benign, 3k models, linking depth to performance 152)
malware)
Transfer Learning Malimg Broad benchmark of pre-trained 98.90%
(Multiple) models; identified InceptionV3 as top (InceptionV3)
performer
CNN with Novel MaleX, Malimg Frequency-domain (DCT) image 96% (Ensemble)
Visualization representation; introduced MaleX
dataset
Hybrid 1D-CNN Custom Android Hybridization of traditional CV features 98.96%
(Drebin, (SIFT/SURF) with a 1D-CNN
Malgenom)
Two-Stage Custom Android Decoupled feature extraction 100% (Binary)
Stacking (MALNET) (EfficientNetB0) and classification
Classifier (Stacking)
Attention-Based Malimg Integration of multi-headed attention 99%
CNN mechanism for focused analysis
Efficient & Malimg, Big2015, VBDN framework focused on >90% (on all
Generalized CNN Malevis, Bled efficiency and data imbalance datasets)
(Balanced Sample