A Weighted Discrete Wavelet Transform-Based Capsule Network for Malware Classification
摘要
The rise of sophisticated malware poses a grave threat to computer security, challenging traditional detection methods. Traditional malware detection techniques, which primarily rely on feature engineering and defining rules to identify malware, are gradually failing to comprehensively and accurately detect emerging malware variants. To address this problem, we proposed an efficient and accurate novel malware classification model based on capsule network with Weighted Discrete Wavelet Transform (WDWTCN). In the field of malware classification, datasets are predominantly composed of grayscale images, which present samples in a single-channel format. To more adeptly capture the key features within malware samples, WDWTCN incorporates the Weighted Discrete Wavelet Transform (WDWT) as a preprocessing step for input data. By converting the single-channel input of grayscale images into a four-channel input, our model becomes significantly more efficient in extracting feature information from malware samples. We used ResNet50 as the feature extraction layer of the capsule network. By integrating global and local features, the model can comprehensively understand and classify malware, thereby enhancing the detection performance of malware. Finally, to validate the performance of the WDWTCN, we conducted an extensive experimental evaluation on three large datasets, i.e., BIG2015, MalImg and BODMAS. The experimental results showed that WDWTCN achieves significant improvements in malware detection accuracy, reaching 98.93%, 99.21% and 96.14% accuracy, respectively.