What question did this study set out to answer?

To develop a three-level deep learning framework for malware detection and classification based on grayscale images.

February 21, 2026Scientific Reports1 citationsOpen Access

Hierarchical malware detection, family identification, and variant attribution using CNN-based hybrid models on grayscale executable images

MSMaheep SaxenaWest Bengal National University of Juridical Sciences TDTanurup DasWest Bengal National University of Juridical Sciences

Key Points

To develop a three-level deep learning framework for malware detection and classification based on grayscale images.
Utilized a dataset of benign and malware samples with labels for classification.
Transformed executable files into normalized grayscale images for analysis.
Compared performance of three CNN-based hybrid models including TCN, CapsNet, and BiLSTM.
CNN + TCN achieved 99% binary accuracy, 98% family accuracy, and 94% subfamily accuracy.
CNN + CapsNet reached 100% binary accuracy, 97% family accuracy, and 93% subfamily accuracy.
CNN + BiLSTM obtained 100% binary accuracy, 98% family accuracy, and 94% subfamily accuracy.

Abstract

Malware has become more challenging to trace as attackers use obfuscation, polymorphism, and automated generation of very similar variants. As a result, security software must not only be able to detect malicious files but also detect their larger families and more specific variants to facilitate effective analysis and correlation. In this paper, we present a three-level deep learning architecture for malware and benign file detection, malware family classification, and subfamily assignment based solely on grayscale images extracted from Windows PE executable files. Each file is statically and dynamically analyzed and then represented as a normalized 224 × 224 grayscale image. The labelled dataset consists of benign samples, the five most prevalent malware families, and 33 subfamilies. We compare the performance of three CNN-based hybrid models under a common multi-output framework: CNN with a Temporal Convolutional Network (TCN) head, CNN with a Capsule Network (CapsNet) block, and CNN with a Bidirectional LSTM (BiLSTM) layer. A single forward pass yields predictions for all levels of the classification hierarchy. Experimental outcomes indicate that CNN + TCN reaches 99% binary accuracy, 98% family accuracy, and 94% subfamily accuracy, while CNN+CapsNet reaches 100%, 97%, and 93%, and CNN+BiLSTM reaches 100%, 98%, and 94%, respectively.

اسأل الذكاء الاصطناعي

Bookmark

View Full Paper