Image-based Malware and Benign Software Classification

Abstract

The growing volume and diversity of malware challenge the scalability of manual analysis and the effectiveness of signature-based detection. An alternative approach is image-based learning, which has been the subject of numerous studies, but tend to focus on the classification of malware families instead of malicious-benign discrimination, and are based on large models where little attention is paid to the degree of data leakage and how it impacts on performance variability. This paper presents a simple convolutional approach to binary classification of executable-file images, without disassembly or dynamic execution – I-Base+. With only 18,881 trainable parameters, it is a simple framework which processes resized grayscale images with two convolutional blocks, global average pooling, and a binary output layer. Evaluation is based on 3,000 Microsoft-signed benign images and 8,444 pre-existing MalImg images from 25 malware families from which 895 images were removed that were exact duplicates. The evaluation protocol consists of training/validation and test partitions that are stratified, five random seeds, controlled ablations and a family-disjoint evaluation in which selected families of malware are not included in the training set. While providing a mean accuracy of 98.72% and a recall rate of 99.51% with a false-positive rate of 3.51%, the number of parameters required for I-Base+ is significantly fewer than the evaluated transfer-learning baselines, and CPU inference speed is significantly faster than the evaluated transfer-learning baselines. Withheld families' recall is 81.64%, indicating that generalization to unseen malware is still a major challenge. The results show a practical accuracy–efficiency trade-off for image-based malware classification, and indicate that it is necessary to consider beyond random sample splits.