A pyramid stripe pooling-based convolutional neural network for malware detection and classification

As image classification is gaining momentum in many applications, it is a common practice for malware detection to convert each malware sample into a gray-scale image for analysis. While most existing deep learning models take fixed-size images as inputs, malware gray-scale images are often of varied length and width. In this study, we propose a Convolutional Neural Network (CNN) that can take both fixed and varied-size images as inputs by introducing Spatial Pyramid Pooling on the last pooling layer in CNN. Furthermore, we visualized the feature maps by saliency maps and demonstrated that malware images show strong stripe patterns. Based on this observation, we propose Stripe Pooling CNN (SP-CNN) and Pyramid Stripe Pooling CNN (PSP-CNN) to enhance the performance of malware classification. Our experimental results show that PSP-CNN, with 98.72 % accuracy, 97.45 % recall, 100 % precision, 100 % specificity and 98.71 % F1 score, tops the other four models for malware classification. SP-CNN follows and achieves 98.50 % accuracy. All trained models are also applicable for malware detection and PSP-CNN performs the best on all performance metrics with 99.31 % detection accuracy and 100 % precision. © 2023, The Author(s), under exclusive licence to Springer-Verlag GmbH Germany, part of Springer Nature.