Alshomrani Mohammed, Albeshri Aiiad, Alsulami Abdulaziz A, Alturki Badraddin
Department of Computer Science, Faculty of Computing and Information Technology, King Abdulaziz University, Jeddah 21589, Saudi Arabia.
Department of Information Systems, Faculty of Computing and Information Technology, King Abdulaziz University, Jeddah 21589, Saudi Arabia.
Sensors (Basel). 2025 Jul 24;25(15):4581. doi: 10.3390/s25154581.
Malware continues to develop, posing significant challenges for traditional signature-based detection systems. Visual malware classification, which transforms malware binaries into grayscale images, has emerged as a promising alternative for recognizing patterns in malicious code. This study presents a hybrid deep learning architecture that combines the local feature extraction capabilities of ConvNeXt-Tiny (a CNN-based model) with the global context modeling of the Swin Transformer. The proposed model is evaluated using three benchmark datasets-Malimg, MaleVis, VirusMNIST-encompassing 61 malware classes. Experimental results show that the hybrid model achieved a validation accuracy of 94.04%, outperforming both the ConvNeXt-Tiny-only model (92.45%) and the Swin Transformer-only model (90.44%). Additionally, we extended our validation dataset to two more datasets-Maldeb and Dumpware-10-to strengthen the empirical foundation of our work. The proposed hybrid model achieved competitive accuracy on both, with 98% on Maldeb and 97% on Dumpware-10. To enhance model interpretability, we employed Gradient-weighted Class Activation Mapping (Grad-CAM), which visualizes the learned representations and reveals the complementary nature of CNN and Transformer modules. The hybrid architecture, combined with explainable AI, offers an effective and interpretable approach for malware classification, facilitating better understanding and trust in automated detection systems. In addition, a real-time deployment scenario is demonstrated to validate the model's practical applicability in dynamic environments.
恶意软件持续发展，给传统的基于特征码的检测系统带来了重大挑战。可视化恶意软件分类将恶意软件二进制文件转换为灰度图像，已成为识别恶意代码模式的一种有前途的替代方法。本研究提出了一种混合深度学习架构，该架构将ConvNeXt-Tiny（一种基于卷积神经网络的模型）的局部特征提取能力与Swin Transformer的全局上下文建模相结合。使用包含61个恶意软件类别的三个基准数据集——Malimg、MaleVis、VirusMNIST对所提出的模型进行评估。实验结果表明，混合模型的验证准确率达到了94.04%，优于仅使用ConvNeXt-Tiny的模型（92.45%）和仅使用Swin Transformer的模型（90.44%）。此外，我们将验证数据集扩展到另外两个数据集——Maldeb和Dumpware-10，以加强我们工作的实证基础。所提出的混合模型在这两个数据集上都取得了具有竞争力的准确率，在Maldeb上为98%，在Dumpware-10上为97%。为了提高模型的可解释性，我们采用了梯度加权类激活映射（Grad-CAM），它可视化了学习到的表示，并揭示了卷积神经网络和Transformer模块的互补性质。这种混合架构与可解释人工智能相结合，为恶意软件分类提供了一种有效且可解释的方法，有助于更好地理解和信任自动检测系统。此外，还展示了一个实时部署场景，以验证该模型在动态环境中的实际适用性。
