Deep visualization classification method for malicious code based on Ngram-TFIDF

Abstract

With the continuous increase in the scale and variety of malware, traditional malware analysis methods, which relied on manual feature extraction, become time-consuming and error-prone, rendering them unsuitable. To improve detection efficiency and accuracy, a deep visualization classification method for malicious code based on Ngram-TFIDF was proposed. The malware dataset was processed by combining N-gram and TF-IDF techniques, transforming it into grayscale images. Subsequently, the CBAM was introduced and the number of dense blocks was adjusted to construct the DenseNet88_CBAM network model for grayscale image classification. Experimental results demonstrate that the proposed method achieves superior classification performance, with accuracy improvements of 1.11% and 9.28% in malware family classification and type classification, respectively.

Keywords

• deep learning;data visualization;malicious code detection and classification