Malware Detection via CNN Visual Fingerprinting
Published Oct 1, 2024
⋅
Updated Nov 20, 2024
⋅
1 minutes read
Project Overview
This project implements a Deep Learning pipeline that treats malware binary files as visual patterns. By transforming raw executable bytes into uniform grayscale image matrices, a Convolutional Neural Network (CNN) can extract structural spatial features to classify malware into their respective families—even when the underlying source code employs polymorphism or subtle obfuscation layers.
- Dataset: Malimg dataset (9,339 samples across 25 malware families)
- Core Performance: 94.84% Overall Accuracy and 0.9394 Cohen's Kappa score on unseen test metrics.
Pipeline & Architecture Architecture Logic
Raw unformatted executable binaries flow dynamically through structural parsing nodes inside KNIME to form normalized image matrices before hitting the convolutional layers:
[Raw Executable Binary]
│
▼
[Streaming Byte Extraction] ➔ [Scale & Normalize Pixel Values to (0, 1)]
│
▼
[Tensor Transformation] ➔ [Reshape Matrix to Uniform 150 × 150 × 1 Dims]
│
▼
┌─────────────────────────────────────────────────────────────────┐
│ DEEP CNN ARCHITECTURE BLOCK │
├─────────────────────────────────────────────────────────────────┤
│ 1. Conv2D Layer Block A ➔ 32 filters, 3×3 kernel, ReLU │
│ 2. Max Pooling 2D ➔ 2×2 window size (50% scale reduction)│
│ 3. Conv2D Layer Block B ➔ 64 filters, 3×3 kernel, ReLU │
│ 4. Max Pooling 2D ➔ Secondary dimensionality drop │
│ 5. Dropout Layer (0.5) ➔ Active regularization check │
│ 6. Flatten & Dense ➔ 25 Output Nodes running Softmax │
└─────────────────────────────────────────────────────────────────┘
│
▼
[Categorical Multi-Class Output Probability Prediction]