The increasing sophistication and diversity of malware necessitate efficient and accurate classification methods to enhance cybersecurity measures. This study provides a comparative analysis of deep learning (DL) and traditional machine learning (ML) approaches for malware classification based on grayscale images of malware samples. A dataset of 420 malware samples from seven different families sourced from VirusShare was utilized. The procedure involves converting malware samples into binaries and subsequently transforming them into grayscale images for extraction of feature and classification. The DL models employed convolutional neural networks (CNNs) and long short-term memory (LSTM) networks, while traditional ML approaches utilized support vector machines (SVM) and random forests (RF). Features were extracted using VGG16 for DL models and Histogram of Oriented Gradients (HOG) and Local Binary Patterns (LBP) for ML methods. Performance was evaluated using classification accuracy, precision, recall, and F1-score. The CNN model with VGG16 feature extraction achieved the highest accuracy of 98.25%, surpassing state-of-the-art performance benchmarks. The LSTM model demonstrated 95.00% accuracy, while the SVM with HOG and LBP features achieved a competitive accuracy of 93.78%. The RF classifier attained an accuracy of 89.00%. These results underscore the importance of feature engineering in malware classification and validate the robustness of both DL and traditional ML approaches. The findings provide valuable insights for developing effective, data-driven malware classification systems capable of addressing evolving cybersecurity challenges.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Comparative Analysis of DL and Traditional ML Methods for Malware Image Classification

  • Desalegn Aweke Wako,
  • Peter Shaojui Wang

摘要

The increasing sophistication and diversity of malware necessitate efficient and accurate classification methods to enhance cybersecurity measures. This study provides a comparative analysis of deep learning (DL) and traditional machine learning (ML) approaches for malware classification based on grayscale images of malware samples. A dataset of 420 malware samples from seven different families sourced from VirusShare was utilized. The procedure involves converting malware samples into binaries and subsequently transforming them into grayscale images for extraction of feature and classification. The DL models employed convolutional neural networks (CNNs) and long short-term memory (LSTM) networks, while traditional ML approaches utilized support vector machines (SVM) and random forests (RF). Features were extracted using VGG16 for DL models and Histogram of Oriented Gradients (HOG) and Local Binary Patterns (LBP) for ML methods. Performance was evaluated using classification accuracy, precision, recall, and F1-score. The CNN model with VGG16 feature extraction achieved the highest accuracy of 98.25%, surpassing state-of-the-art performance benchmarks. The LSTM model demonstrated 95.00% accuracy, while the SVM with HOG and LBP features achieved a competitive accuracy of 93.78%. The RF classifier attained an accuracy of 89.00%. These results underscore the importance of feature engineering in malware classification and validate the robustness of both DL and traditional ML approaches. The findings provide valuable insights for developing effective, data-driven malware classification systems capable of addressing evolving cybersecurity challenges.