Rapid and accurate identification of unknown malware and its variants is the premise and basis for the effective prevention of malicious attacks. However, with the rapid increase of malware variants, the efficiency of manual updating of the sample database is getting worse and worse. It is difficult for the traditional identification method to effectively capture the sample feature information operated by the confusion method only based on the delayed database information. To address the above problems, this paper proposes a deep learning model based on grayscale image processing, MalMKNet (Multi-scale Kernel Network for Malware), a convolutional neural network (CNN) architecture using multi-scale convolution kernel mixing action to improve malware detection capabilities. The mixed kernels (MK) module combining deep large kernel convolution and standard small kernel convolution with shortcut structure is proposed to improve the model accuracy, and then we proposed multi-scale kernel fusion (MKF) to reduce the number of parameters. The feature shuffle (FS) is proposed to improve the classification accuracy without increasing the number of parameters. Experimental results show that MalMKNet outperforms the state-of-the-art methods in terms of malware family classification accuracy which achieves 99.35%. © 2023 Chinese Institute of Electronics. All rights reserved.
