CHAPTER 5
SYSTEM DESIGN
5.1 Functional Specifications of Malware Image
Classification System
The architecture of the Malware Detection System (MDS) utilizing Deep Learning (DL)
represents a paradigm shift from traditional signature-based and heuristic detection
mechanisms toward a visual-perception-based approach. The system is engineered to
function as an intelligent classification engine that transforms raw executable binaries into
grayscale visual representations, subsequently leveraging the feature-extraction capabilities
of Residual Neural Networks (ResNet) to distinguish between benign software and malicious
entities. This functional design addresses the critical limitations of conventional static
analysis, which struggles with obfuscated code, and dynamic analysis, which is
computationally expensive and susceptible to sandbox evasion techniques.1
The functional core of the system is predicated on the observation that malware families
exhibit distinct visual textures when mapped to a two-dimensional space—a phenomenon
driven by the structural consistency of compiled code, reusable subroutines, and specific
packing algorithms.3 By converting the classification problem from the domain of
cybersecurity into the domain of computer vision, the system exploits the advanced pattern
recognition capabilities of Convolutional Neural Networks (CNNs), specifically the ResNet-50
architecture, to identify malicious patterns that are imperceptible to human analysts or
standard linear scanners.4
5.1.1 System Architecture Overview
The system comprises distinct, loosely coupled modules that orchestrate the lifecycle of a
file from ingestion to final verdict. The architecture is designed to support high-throughput
processing, ensuring that the computationally intensive tasks of image generation and neural
network inference do not bottleneck the ingestion pipeline.
1. Data Ingestion and Binary Acquisition Module
The initial stage involves the secure ingestion of executable files (Portable Executable - PE,
ELF, etc.) from various input vectors, such as network gateways, endpoint agents, or archival
databases like the Malimg or Microsoft BIG 2015 datasets.6 This module is responsible for the
raw binary read operations. Unlike dynamic analysis systems that require complex
virtualization to execute the code, the Acquisition Module operates statically. It reads the file
as a sequence of 8-bit unsigned integers, creating a one-dimensional vector of decimal
values ranging from 0 to 255. This stream represents the fundamental genetic code of the
software, encompassing the text sections (instructions), data sections, and resources.8 The
module includes a validation layer to filter out corrupted files or non-executables before they
consume processing resources, ensuring that only valid binary candidates proceed to the
transformation stage.6
2. Visualization and Preprocessing Transformation Module
This module serves as the bridge between the digital and visual domains. It implements the
"Byteplot" algorithm, a deterministic transformation logic that reshapes the 1D binary vector
into a 2D matrix. The critical functional specification here is the preservation of local spatial
locality; bytes that are adjacent in the binary stream must remain adjacent in the visual
representation to preserve the texture of the code.3 The module applies specific width
constraints based on the file size, a heuristic determined empirically to ensure that structural
patterns (like loops and jump tables) align vertically, creating distinctive visual striations.11
Following the matrix generation, the module performs essential image processing tasks.
Since deep learning models require fixed-dimension inputs, the variable-sized grayscale
matrices are resized—typically to 224x224 or 256x256 pixels—using bilinear or bicubic
interpolation. This step is crucial for normalizing the data for the ResNet architecture,
although it introduces a trade-off between information density and computational
efficiency.13 The module also handles normalization, scaling pixel intensities to a range (e.g.,
0.0 to 1.0) suitable for neural network convergence.15
3. Deep Feature Extraction Module (ResNet-Based)
The intelligence of the system resides in this module, which utilizes a Residual Network
(specifically ResNet-50 or ResNet-152) as a feature extractor. This component leverages
Transfer Learning, utilizing a model pre-trained on a massive dataset of natural images
(ImageNet).4 The functional requirement here is to exploit the pre-learned filters of the
ResNet model—which are already adept at detecting edges, textures, and gradients—and
apply them to the domain of malware byteplots.
The architecture utilizes "skip connections" (identity mappings) to mitigate the vanishing
gradient problem, allowing the network to be significantly deeper than standard CNNs
without a loss in training efficiency. This depth is functionally required to capture both the
low-level features (such as the specific grain of a packer) and high-level abstractions (such
as the layout of PE sections).5 The module outputs a high-dimensional feature vector that
represents the "visual signature" of the malware.4
4. Classification and Probability Determination Module
Once the features are extracted, they are passed to a custom classifier head. This module
replaces the standard fully connected layers of the original ResNet architecture with a dense
layer sized according to the number of target classes (e.g., specific malware families like
Ramnit, Lollipop, or a binary Benign/Malicious distinction).4 A Softmax activation function
processes the logits to produce a probability distribution across the classes. The system
applies a "Confidence Threshold" logic; if the highest probability score is below a defined
threshold (e.g., 0.85), the classification may be flagged as "Uncertain," triggering a
secondary workflow for manual review or dynamic analysis.19
5. Reporting, Logging, and Alerting Module
The final stage converts the mathematical output of the neural network into actionable
security intelligence. This module interfaces with the system database to log the file hash
(SHA-256), the classification result, the confidence score, and the timestamp. In operational
environments, this module is responsible for triggering alerts—via SIEM integration, email, or
dashboard updates—when high-confidence malware is detected. It also manages the
storage of the generated grayscale image for explainability purposes, allowing analysts to
visually inspect the "texture" of the threat.7
5.1.2 Functional Data Flow
The following table details the sequential transformation of data through the system's
functional modules, highlighting the input/output specifications for each stage.
Stage Input Data Processing Output Data Functional
Object Logic Object Goal
Ingestion Raw Binary Stream 1D Byte Vector Secure
Executable File Reading, (UINT8), File acquisition
(.exe, .dll) Header Metadata and integrity
Validation, verification of
Hash the target
Calculation artifact.
Visualization 1D Byte Vector Width 2D Grayscale Transformatio
Mapping Matrix n of sequential
(Table (Variable Size) code into a
Lookup), texture-based
Matrix visual
Reshaping representation
.
Preprocessin 2D Grayscale Bilinear 3-Channel Standardizatio
g Matrix Interpolation, RGB Tensor n of input
Resizing (or 1-Channel) dimensions to
(224x224), match ResNet
Normalization architecture
requirements.
Feature Image Tensor Forward Feature Vector Extraction of
Extraction Propagation (High- latent patterns
(ResNet-50), Dimensional) and texture
Convolutional signatures
Filtering from the visual
data.
Classification Feature Vector Fully Probability Probabilistic
Connected Distribution, determination
Layer, Softmax Class Label of the file's
Activation lineage
(Benign vs.
Malicious
Family).
Reporting Class Label, Threshold Alert JSON, Dissemination
Confidence Evaluation, Log Entry, of intelligence
Database Dashboard and
Transaction Update persistence of
audit trails.
This modular design ensures that the system is robust and scalable. For instance, the Feature
Extraction module can be upgraded from ResNet-50 to ResNet-152 or a Vision Transformer
(ViT) without altering the Ingestion or Visualization modules, provided the input tensor
dimensions remain consistent.20
5.2 Structural and Dynamic Modeling of System
The structural modeling of the MDS defines the static architecture of the components,
specifically focusing on the rigorous logic used to generate images and the internal
architecture of the neural network. The dynamic modeling captures the behavior of the
system as it processes data, illustrating how the static components interact to perform the
classification task.
5.2.1 Image Generation Logic (Static Modeling)
The conversion of a binary file into an image is not an arbitrary process but a strictly defined
structural transformation. The system treats the binary as a stream of 8-bit integers. Each
byte represents a pixel intensity, where the value 0 corresponds to black and 255
corresponds to white. Values between these extremes represent various shades of gray.3
The critical structural parameter in this transformation is the Image Width. If the width is
chosen arbitrarily, the visual patterns inherent in the code (such as repeating opcode
sequences or padding) may not align vertically, resulting in a "noisy" image that lacks
distinctive texture. To ensure consistency, the system implements a fixed width table derived
from the empirical research of Nataraj et al., which correlates file size ranges to optimal
image widths.11 This ensures that files of similar sizes—which often correspond to similar
complexities of malware—are visualized with a comparable "stride," preserving the spatial
coherence of the code structure.
The following table defines the static configuration for the Image Converter module:
File Size Range Image Width (Pixels) Rationale
< 10 kB 32 Small files require narrow
widths to prevent the
image from becoming a
single flat line, ensuring
sufficient vertical height for
texture formation.
10 kB – 30 kB 64 Incremental width increase
to accommodate larger
code bases without
compressing the vertical
structures.
30 kB – 60 kB 128 Standard width for small
utility-sized malware,
ensuring that loop
structures align
periodically.
60 kB – 100 kB 256 Optimal width for average-
sized executables; aligns
with common byte-
boundary repetitions in
compiled code.
100 kB – 200 kB 384 Intermediate width for
larger binaries, balancing
vertical height and
horizontal detail.
200 kB – 500 kB 512 Suitable for larger payloads
or packed executables,
ensuring the packer's
entropy visualization is
discernible.
500 kB – 1000 kB 768 Width expanded to prevent
extremely tall, thin images
which can distort resizing
operations.
> 1000 kB 1024 Maximum width for large
files (e.g., installers or
complex Trojans) to
maintain aspect ratio
integrity.
The height ($H$) of the image is a dependent variable calculated dynamically: $H = \lceil \
text{File Size} / \text{Image Width} \rceil$. Any remaining pixels in the final row that are not
filled by the binary data are padded with zeros (black), ensuring a complete rectangular
matrix.9
5.2.2 Neural Network Architecture (ResNet Modeling)
The structural design of the classification engine is based on the Residual Network (ResNet)
architecture. Traditional deep networks suffer from degradation where accuracy saturates
and then degrades as depth increases. ResNet addresses this via Residual Blocks, which
introduce a structural "shortcut" connection that bypasses one or more layers.4
The system typically employs ResNet-50, which consists of 50 layers arranged in five stages.
The structural composition is as follows:
1. Input Stem: A 7x7 convolution followed by max pooling, which reduces the spatial
dimension of the 224x224 input image.
2. Residual Stages: Four stages containing sequences of "Bottleneck" blocks. Each block
comprises three convolutional layers (1x1, 3x3, 1x1). The shortcut connection performs an
identity mapping ($x \rightarrow x$), adding the input features to the output features
($F(x) + x$) before the ReLU activation. This allows the network to learn "residuals"—the
nuanced differences in texture between benign and malicious code—rather than
relearning the entire feature map at every layer.5
3. Classification Head: The original ResNet ends with a Global Average Pooling layer and
a 1000-unit fully connected layer (for ImageNet). In this system design, the 1000-unit
layer is structurally removed and replaced with a layer of size $N$, where $N$ is the
number of malware classes (e.g., 25 for Malimg). This layer utilizes a Softmax activation
function to output probabilities.10
5.2.3 Use Case Diagram: SYSTEM USER
The Use Case Diagram models the functional requirements from the perspective of the
system actors. It defines the boundaries of the system and the interactions required to
achieve the goal of malware detection.
Actors:
● Security Analyst: The primary human user responsible for interpreting results,
managing the system configuration, and investigating alerts.
● System Administrator: Responsible for maintenance tasks such as model retraining,
dataset management, and performance monitoring.
Primary Use Cases:
1. Ingest Suspect File: The Endpoint Agent or Security Analyst uploads a binary file. The
system must accept the file stream, validate its integrity, and queue it for processing.
2. Analyze Malware (Include Preprocessing & Classification): This is the core system
function. It is an "Include" relationship where the "Analyze" case automatically triggers
"Generate Image," "Extract Features," and "Classify." The user does not interact with
these sub-processes directly, but they are essential to the use case.8
3. View Analysis Report: The Security Analyst accesses the dashboard to view the results.
This includes the classification verdict (e.g., "Malicious: Ramnit"), the confidence score
(e.g., "99.2%"), and the visualization of the malware (the grayscale image).
4. Receive Alert: The system pushes a notification to the Security Analyst when a high-
probability threat is detected. This use case is triggered by the "Analyze Malware"
process.19
5. Manage Training Dataset: The System Administrator uploads new verified malware
samples to the database. This is critical for "Concept Drift" mitigation, ensuring the
model remains effective against new variants.22
6. Retrain Model: The Administrator initiates a retraining cycle (Transfer Learning) to
update the ResNet weights with the new samples added in the "Manage Training
Dataset" use case.17
Use Case Relationships:
● Upload File $\rightarrow$ triggers $\rightarrow$ Analyze Malware.
● Analyze Malware $\rightarrow$ includes $\rightarrow$ Generate Image.
● Analyze Malware $\rightarrow$ includes $\rightarrow$ Classify.
● Classify $\rightarrow$ extends (if Malicious) $\rightarrow$ Generate Alert.
● Security Analyst $\rightarrow$ associates with $\rightarrow$ View Report.
● Administrator $\rightarrow$ associates with $\rightarrow$ Retrain Model.
5.3 Class Diagram
The Class Diagram provides the object-oriented blueprint for the system, defining the
specific classes, their attributes, and operations. This static view ensures that the logical
components discussed in the functional specifications are mapped to concrete software
structures.
5.3.1 Class Descriptions
The system is composed of several key classes that encapsulate the logic for binary
processing, image conversion, neural network inference, and result management.
1. MalwareDetectionSystem (Main Controller)
● Role: The central orchestrator that initializes the subsystems and manages the workflow
from file upload to result generation.
● Attributes:
○ classifier: ResNetClassifier
○ preprocessor: ImagePreprocessor
○ dbManager: DatabaseManager
○ config: SystemConfig
● Methods:
○ analyzeFile(filePath: String): AnalysisResult - The primary entry point for the analysis
workflow.
○ initialize() - Loads the model weights and establishes database connections.
2. BinaryLoader
● Role: Responsible for secure file I/O operations. It handles the raw reading of the
executable and performs initial validation checks.
● Attributes:
○ fileContent: Byte
○ fileHash: String (SHA-256)
○ fileSize: Long
● Methods:
○ loadFile(path: String): Boolean - Reads the file into memory.
○ validateHeader(): Boolean - Checks for PE/ELF magic numbers to ensure the file is a
valid executable.12
○ getByteVector(): Integer - Converts the raw byte array into the 0-255 decimal vector
format required for image generation.8
3. ImagePreprocessor
● Role: Encapsulates the logic for converting the binary vector into a format suitable for
the ResNet model. This includes the implementation of the Nataraj width tables and
resizing algorithms.
● Attributes:
○ widthTable: Map<Range, Integer> - Stores the file-size-to-width mapping rules.11
○ targetResolution: Size (224, 224) - The input tensor size for ResNet.
● Methods:
○ determineWidth(size: Long): Integer - Selects the correct image width based on the
file size.
○ generateMatrix(vector: Integer, width: Integer): Matrix - Reshapes the 1D vector into
a 2D grayscale matrix.
○ applyBilinearInterpolation(matrix: Matrix): Image - Resizes the variable-sized matrix
to the fixed target resolution.13
○ normalizePixels(image: Image): Tensor - Scales pixel values (e.g., /255.0) for the
neural network.
4. ResNetClassifier
● Role: A wrapper for the deep learning model. It abstracts the complexity of the neural
network (e.g., TensorFlow or PyTorch implementation) and provides a simple interface
for inference.
● Attributes:
○ model: CNNModel (The loaded ResNet-50 architecture).
○ classLabels: List - An ordered list of malware families (e.g.,).
○ weightsPath: String - Path to the .h5 or .pth model weights file.
● Methods:
○ loadWeights(): Void - Loads the pre-trained ImageNet weights and the fine-tuned
malware classification layers.4
○ predict(inputTensor: Tensor): PredictionVector - Performs the forward pass through
the network layers.
○ decodePrediction(vector: PredictionVector): ClassificationResult - Maps the output
logits to class labels and confidence scores using Softmax.10
5. ClassificationResult
● Role: A Data Transfer Object (DTO) that holds the outcome of an analysis.
● Attributes:
○ predictedClass: String
○ confidenceScore: Float
○ timestamp: DateTime
○ isMalicious: Boolean
○ featureVector: Float (Optional, for manifold visualization).
6. DatabaseManager
● Role: Manages persistence of analysis logs and samples.
● Methods:
○ logAnalysis(hash: String, result: ClassificationResult): Void
○ checkHash(hash: String): ClassificationResult - Checks if the file has already been
analyzed (Caching mechanism).
5.3.2 Class Diagram Summary Table
The following table summarizes the structural relationships and access modifications for the
primary system classes.
Class Visibility Relationshi Target Multiplicit Descriptio
p Class y n
MalwareDet Public Compositio BinaryLoad 1:1 The system
ectionSyste n er creates a
m loader for
each
analysis
session.
MalwareDet Public Association ImagePrepr 1:1 The system
ectionSyste ocessor uses a
m preprocess
or to
transform
data.
MalwareDet Public Association ResNetClas 1:1 The system
ectionSyste sifier uses a
m classifier
for
inference.
ResNetClas Private Dependenc Classificati 1:N The
sifier y onResult classifier
produces
result
objects.
ImagePrepr Private Dependenc BinaryLoad 1:1 The
ocessor y er preprocess
or
consumes
data from
the loader.
MalwareDet Public Association DatabaseM 1:1 The system
ectionSyste anager persists
m results to
the
database.
5.4 FLOWCHART
The flowchart provides a comprehensive visual representation of the sequential logic
governing the malware detection process. It delineates the operational workflow, mapping
the precise decision paths and algorithmic operations from system initialization to the final
generation of threat alerts.
The process commences at the Start node, where the system enters a critical initialization
phase. During this stage, the backend loads the ResNet-50 model architecture and its pre-
trained weights into the GPU memory. This is a one-time computational cost designed to
ensure low latency during subsequent scan sessions. Following initialization, the system
transitions to File Input. Upon receiving a target file, an optimization routine is triggered: the
system generates a hash of the file and checks it against a local database. If the hash
matches a previously analyzed sample, the system bypasses the computation-heavy
processing stages and immediately retrieves the cached result, significantly enhancing
efficiency. If the hash is novel, the process moves to Binary Processing, where the file is read
into a byte array. A validation check ensures the file is a legitimate executable; if the format is
invalid, the system logs an error and terminates to prevent processing corruption.
For valid executables, the workflow advances to Grayscale Image Generation, a pivotal step
in this methodology. The system first determines the file size to select the appropriate matrix
width ($W$) based on the empirical Width. The binary vector is then mapped into a two-
dimensional matrix where every byte corresponds to a pixel intensity. Since deep learning
models require fixed input dimensions, this matrix typically undergoes resizing to a standard
resolution of 224x224 pixels using bilinear interpolation. This transformation converts the raw
binary data into a standardized visual format suitable for convolution.
The pre-processed image tensor is then fed into the Feature Extraction phase. Here, the
ResNet-50 model processes the input through a series of convolutional layers, which extract
low-level features such as edges, and Residual Blocks, which capture complex, high-level
code patterns while mitigating the vanishing gradient problem. The data flows through Global
Average Pooling before reaching the Classification stage. The final fully connected layer uses
a Softmax function to output a probability distribution across the malware classes. A critical
decision node evaluates confidence: if the maximum probability score is below a strict
threshold, the sample is flagged as "Uncertain" or "Suspicious" rather than definitively
malicious, a safeguard designed to minimize false positives.
If the probability exceeds the threshold, the system assigns the specific malware family label.
The process concludes with Result Evaluation. If the identified class is malicious, the system
triggers the "Generate Alert" routine and updates the local threat intelligence database.
Conversely, if the class is benign, the access is logged for audit purposes. Finally, a JSON-
formatted report containing the classification results and confidence scores is returned to
the user, and the workflow terminates at the Stop node.
Fig 5.4.1 Flowchart
5.5 ACTIVITY DIAGRAM
The provided activity diagram illustrates the end-to-end workflow of the proposed malware
detection system. It details the sequential logic and data transformation steps required to
convert a raw binary file into a classified output using a Deep Learning approach. The
process is linear but contains critical decision points that determine whether the file is
processed further, discarded, or flagged as a security threat.
The process initiates at the Start Node when a target file is introduced to the system ("Input
Malware File"). The system does not treat the file as a high-level software application but
rather as a raw sequence of data. In the "Read Binary Bytes" step, the system reads the
hexadecimal representation of the file’s binary code.
This raw binary data is then passed to the visualization module. The "Convert to Grayscale
Image" activity is the core preprocessing technique of this project. It maps the byte values
(ranging from 0 to 255) to pixel intensity values, effectively transforming the code into a
visual representation. To ensure compatibility with the neural network's input layer, the image
is then normalized during the "Resize Image 64x64" step. This standardization ensures that
all inputs, regardless of the original file size, serve as a consistent $64 \times 64$ matrix for
the model.
Before computational resources are spent on analysis, the system performs a validation
check at the decision diamond "Is Image Valid?". This step safeguards the model against
corrupted data or files that failed the conversion process.
No: If the image generation failed or the file is empty, the flow transitions to "Discard
File," terminating the process immediately to prevent runtime errors.
Yes: If the image is successfully generated and resized, the workflow proceeds to the
deep learning inference stage.
Valid images are passed to the core classifier in the "Feed to ResNet Model" activity. The
system utilizes a Residual Network (ResNet), a Convolutional Neural Network (CNN)
architecture known for its ability to train deep networks without vanishing gradient problems.
Inside the model, the "Feature Extraction" activity occurs. Here, the hidden layers of the
ResNet architecture analyze the "texture" of the binary image, identifying complex patterns
and distinct visual signatures associated with malicious payloads versus benign code.
Once features are extracted, the model makes a probabilistic determination at the "Is Benign"
decision node.
Path A (Benign): If the model classifies the patterns as safe, the flow moves to "Flag
Benign." The file is marked as safe, and the process terminates successfully.
Path B (Malware): If the model detects malicious features, the system follows the
"No" branch to "Generate Alert." This is a critical security step where the system
notifies the user or administrator of the detected threat before terminating the
session.