Comparative Analysis of DL and Traditional ML Methods for Malware Image Classification
摘要
The increasing sophistication and diversity of malware necessitate efficient and accurate classification methods to enhance cybersecurity measures. This study provides a comparative analysis of deep learning (DL) and traditional machine learning (ML) approaches for malware classification based on grayscale images of malware samples. A dataset of 420 malware samples from seven different families sourced from VirusShare was utilized. The procedure involves converting malware samples into binaries and subsequently transforming them into grayscale images for extraction of feature and classification. The DL models employed convolutional neural networks (CNNs) and long short-term memory (LSTM) networks, while traditional ML approaches utilized support vector machines (SVM) and random forests (RF). Features were extracted using VGG16 for DL models and Histogram of Oriented Gradients (HOG) and Local Binary Patterns (LBP) for ML methods. Performance was evaluated using classification accuracy, precision, recall, and F1-score. The CNN model with VGG16 feature extraction achieved the highest accuracy of 98.25%, surpassing state-of-the-art performance benchmarks. The LSTM model demonstrated 95.00% accuracy, while the SVM with HOG and LBP features achieved a competitive accuracy of 93.78%. The RF classifier attained an accuracy of 89.00%. These results underscore the importance of feature engineering in malware classification and validate the robustness of both DL and traditional ML approaches. The findings provide valuable insights for developing effective, data-driven malware classification systems capable of addressing evolving cybersecurity challenges.