TRANSFER LEARNING AND SMOTE ALGORITHM FOR IMAGE-BASED MALWARE CLASSIFICATION

Abstract

In recent years, the volume and type of malware is growing, which increases the need of improving a detection and classification malware systems. Nowadays, deep convolutional neural networks (CNNs) have recently proven to be very successful for malware classification due to their performance on images classification. However, their effectiveness is degraded with the unbalanced malware families. In this paper, we propose a malware classification framework using CNN-based deep learning architecture, including a SMOTE technique "Synthetic Minority Oversampling Technique" to balance the dataset (malwares families). Our proposed method consists to converting the binary files into gray scale images and balancing them by the SMOTE method, and then we use them to train the CNN architecture to detect and identify malware families. We use the Transfer Learning technique based on an existing Deep Learning model VGG16 that has previously trained with the ImageNet dataset (≥ 10 million). For evaluations, an extensive experiment was conducted using Microsoft Malware dataset. The Results show that our approach is efficient with an average accuracy of 98%.