A Pyramid Stripe Pooling-Based Convolutional Neural Network for Malware Detection and Classification

Jiang Jiaqi,Zhang Yunchun
DOI: https://doi.org/10.1007/s12652-023-04522-y
IF: 3.662
2023-01-01
Journal of Ambient Intelligence and Humanized Computing
Abstract:As image classification is gaining momentum in many applications, it is a common practice for malware detection to convert each malware sample into a gray-scale image for analysis. While most existing deep learning models take fixed-size images as inputs, malware gray-scale images are often of varied length and width. In this study, we propose a Convolutional Neural Network (CNN) that can take both fixed and varied-size images as inputs by introducing Spatial Pyramid Pooling on the last pooling layer in CNN. Furthermore, we visualized the feature maps by saliency maps and demonstrated that malware images show strong stripe patterns. Based on this observation, we propose Stripe Pooling CNN (SP-CNN) and Pyramid Stripe Pooling CNN (PSP-CNN) to enhance the performance of malware classification. Our experimental results show that PSP-CNN, with $$98.72\%$$ accuracy, $$97.45\%$$ recall, $$100\%$$ precision, $$100\%$$ specificity and $$98.71\%$$ F1 score, tops the other four models for malware classification. SP-CNN follows and achieves $$98.50\%$$ accuracy. All trained models are also applicable for malware detection and PSP-CNN performs the best on all performance metrics with $$99.31\%$$ detection accuracy and $$100\%$$ precision.
What problem does this paper attempt to address?