A Log-to-Image Transformation Framework for Behavior-Aware Malware and Anomaly Detection

Cyber threats are increasingly difficult to detect, motivating behavior-based cybersecurity analytics for malware and anomaly detection. We propose Log-to-Vision (L2V), a cybersecurity-oriented framework designed to transform runtime logs or structured cybersecurity feature representations into two-dimensional images for convolutional learning. The framework can incorporate temporal ordering and process relationships when these are available in the source representation. The experiments reported in this study evaluate the structured feature branch of L2V using process-level, static-feature, and window-level representations; direct end-to-end evaluation of the complete event-level spatio-temporal path is outside the scope of the present experiments. L2V is evaluated against LSTM-FC, TCN, and CNN–BiLSTM on three public cybersecurity benchmarks covering binary malware detection, multi-class malware-family classification, and log-anomaly detection. L2V achieves Macro-F1 scores of 0.9298 on Linux Malware, 0.7727 on MOTIF, and 0.7621 on BGL, obtaining the highest mean Macro-F1 among the evaluated methods on each benchmark. A separate ablation study on the 10,000-sample Android DefenseDroid dataset shows that changing image resolution is associated with the largest observed performance difference among the tested configurations, while the L2V-encoded configuration achieves a modestly higher Macro-F1 when using the same ResNet-50 backbone, increasing Macro-F1 from 0.9191 to 0.9222 with lower fold-to-fold variability. Overall, the results support the applicability of domain-informed visual representations across the evaluated cybersecurity tasks.