Journal of Platform Technology

ICT Platform Society (ICT플랫폼학회)
권호 표지
DOI QR코드

DOI QR Code

EfficientNet-based malware type classification method applying Cross-Layer Attention

Cross-Layer Attention 을 적용한 EfficientNet 기반 악성코드 유형 분류 기법

  • Received : 2025.03.26
  • Accepted : 2025.05.30
  • Published : 2025.06.30
Download PDF
⟨ Previous Next ⟩

Abstract

Recently, malware is continuously evolving through various obfuscation and modification techniques, and it is difficult to respond effectively with only the existing signature-based detection methods. To overcome this, machine learning-based detection methods are actively being studied, and in particular, image-based analysis using CNN is attracting attention. However, CNN models tend to focus on learning local features, and as the layer becomes deeper, low-level features learned in the early layers become blurred or modified. This increases the possibility of losing important structural patterns in malware image analysis, and can lead to a decrease in generalization performance for sophisticated obfuscation techniques or advanced variants of malware. In this paper, we propose a malware image classification method using EfficientNet-based CLA (Cross-Layer Attention) to improve these limitations. The proposed CLA method complements the information loss problem of CNN by preserving features learned in the early layers and combining them with later layers, and enhances information utilization across channels and global context understanding. Experimental results show that the EfficientNet-CLA model has the best performance with an accuracy of 98.57% compared to CNN and ViT series models. This means that the proposed method enables more robust feature learning than existing models, and generalization performance is also improved. In addition, Grad-CAM analysis visually verifies that CLA plays a complementary role in CNN's global feature learning.

최근 악성코드는 다양한 난독화 및 변형 기술을 통해 지속적으로 진화하고 있으며, 기존의 서명 기반 탐지 기법만으로는 효과적인 대응이 어렵다. 이를 극복하기 위해 머신러닝 기반 탐지 기법이 활발히 연구되고 있으며, 특히 CNN을 활용한 이미지 기반 분석이 주목받고 있다. 그러나 CNN 모델은 국소적인 특징 학습에 집중하는 경향이 있어, 계층이 깊어질수록 초기 계층에서 학습된 저수준 특징이 희미해지거나 변형되는 문제가 발생한다. 이는 악성코드 이미지 분석에서 중요한 구조적 패턴이 손실될 가능성이 높이고, 정교한 난독화 기법이나 고도화된 변종 악성코드에 대한 일반화 성능 저하로 이어질 수 있다. 본 논문에서는 이러한 한계를 개선하기 위해 EfficientNet을 기반의 CLA(Cross-Layer Attention)를 적용한 악성코드 이미지 분류 기법을 제안한다. 제안하는 CLA 기법은 초기 계층에서 학습된 특징을 보존하고 후반부 계층과 결합함으로써 CNN의 정보 손실 문제를 보완하고, 채널 간 정보 활용과 전역적 문맥 이해를 강화한다. 실험 결과, EfficientNet-CLA 모델은 CNN 및 ViT 계열 모델 대비 Accuracy 98.57%로 가장 우수한 성능을 보였다. 이는 제안하는 기법이 기존 모델보다 더욱 견고한 특징 학습을 가능하게 하며, 일반화 성능 또한 향상되었음을 의미한다. 또한 Grad-CAM 분석을 통해 CLA가 CNN의 전역적 특징 학습을 보완하는 역할을 수행함을 시각적으로 검증하였다

Keywords

Acknowledgement

이 논문은 2021 년 정부(방위사업청)의 재원으로 국방기술진흥연구소의 지원을 받아 수행된 연구임(KRIT-CT-21-037)

References

  1. Aslan, Ö mer Aslan, and Refik Samet. "A comprehensive review on malware detection approaches." *IEEE access* 8 (2020): 6249-6271. https://doi.org/10.1109/ACCESS.2019.2963724
  2. Liu, Wenjie, and Liming Wang. "A Novel Malware Classification Method Based on Memory Image Representation." *2023 IEEE Symposium on Computers and Communications (ISCC)*. IEEE, 2023.
  3. Gopinath, M.; Sethuraman, S.C. A comprehensive survey on deep learning based malware detection techniques. Comput. Sci. Rev. 2023, 47, 100529.
  4. Bensaoud, A.; Kalita, J.; Bensaoud, M. A survey of malware detection using deep learning. Mach. Learn. Appl. 2024, 16, 100546.
  5. Lu, T.; Du, Y.; Ouyang, L.; Chen, Q.; Wang, X. Android malware detection based on a hybrid deep learning model. Secur. Commun. Netw. 2020, 2020, 8863617.
  6. Han, Sicheng, Heeheon Yun, and Yongsu Park. "Deep Learning for Cybersecurity Classification: Utilizing Depth-Wise CNN and Attention Mechanism on VM-Obfuscated Data." *Electronics* 13.17 (2024): 3393. https://doi.org/10.3390/electronics13173393
  7. Gibert, Daniel, et al., "Using convolutional neural networks for classification of malware represented as images," Journal of Computer Virology and Hacking Techniques, vol. 15, pp. 15-28, 2019. https://doi.org/10.1007/s11416-018-0323-0
  8. Vasan, Danish, et al., "IMCFN: Image-based malware classification using fine-tuned convolutional neural network architecture," Computer Networks, vol. 171, 107138, https://doi.org/10.1016/j.comnet.2020.107138, 2020
  9. Lad, Sumit S., and Amol C. Adamuthe, "Malware classification with improved convolutional neural network model," Int. J. Comput. Netw. Inf. Secur , vol. 12, no. 6, pp. 30-43, 2020. https://doi.org/10.5815/ijcnis.2020.06.03
  10. Khan, Asifullah, et al. "A survey of the recent architectures of deep convolutional neural networks." *Artificial intelligence review* 53 (2020): 5455-5516. https://doi.org/10.1007/s10462-020-09825-6
  11. Zeiler, Matthew D., and Rob Fergus. "Visualizing and understanding convolutional networks." Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part I 13. Springer International Publishing, 2014.
  12. He, Kaiming, et al. "Deep residual learning for image recognition." *Proceedings of the IEEE conference on computer vision and pattern recognition*. 2016.
  13. Huang, Gao, et al. "Densely connected convolutional networks." *Proceedings of the IEEE conference on computer vision and pattern recognition*. 2017.
  14. Simonyan, Karen, and Andrew Zisserman. "Very deep convolutional networks for large-scale image recognition." arXiv preprint arXiv:1409.1556 (2014).
  15. Tan, Mingxing, and Quoc Le. "Efficientnet: Rethinking model scaling for convolutional neural networks." *International conference on machine learning*. PMLR, 2019.
  16. Dosovitskiy, Alexey. "An image is worth 16x16 words: Transformers for image recognition at scale." *arXiv preprint arXiv:2010.11929* (2020).
  17. Ni, Sang, Quan Qian, and Rui Zhang. "Malware identification using visualization images and deep learning." *Computers & Security* 77 (2018): 871-885. https://doi.org/10.1016/j.cose.2018.04.005
  18. Chaganti, Rajasekhar, Vinayakumar Ravi, and Tuan D. Pham. "Image-based malware representation approach with EfficientNet convolutional neural networks for effective malware classification." *Journal of Information Security and Applications* 69 (2022): 103306. https://doi.org/10.1016/j.jisa.2022.103306
  19. Johny, Jahez Abraham, et al. "Deep learning fusion for effective malware detection: leveraging visual features." *Cluster Computing* 28.2 (2025): 135. https://doi.org/10.1007/s10586-024-04723-w
  20. Battaglia, Peter W., et al. "Relational inductive biases, deep learning, and graph networks." * *arXiv preprint arXiv:1806.01261* (2018).
  21. Khan, Asifullah, et al. "A survey of the recent architectures of deep convolutional neural networks." *Artificial intelligence review* 53 (2020): 5455-5516. https://doi.org/10.1007/s10462-020-09825-6
  22. Tammina, Srikanth. "Transfer learning using vgg-16 with deep convolutional neural network for classifying images." *International Journal of Scientific and Research Publications (IJSRP)* 9.10 (2019): 143-150. https://doi.org/10.29322/IJSRP.9.10.2019.p9420
  23. Vasan, Danish, et al. "Image-Based malware classification using ensemble of CNN architectures (IMCEC)." *Computers & Security* 92 (2020): 101748. https://doi.org/10.1016/j.cose.2020.101748
  24. Han, Sicheng, Heeheon Yun, and Yongsu Park. "Deep Learning for Cybersecurity Classification: Utilizing Depth-Wise CNN and Attention Mechanism on VM-Obfuscated Data." *Electronics* 13.17 (2024): 3393. https://doi.org/10.3390/electronics13173393
  25. In-Woong Jeong, Han-Jin Lee, Jae-Hwan Jeong, & Seok-Hwan Choi (2024). A Study on Malware Family Classification Method based on Separable Vision Transformer Using Sharpness-Aware Minimization. Journal of Korean Institute of Intelligent Systems, 34(4), 329-338 https://doi.org/10.5391/JKIIS.2024.34.4.329
  26. Sandler, Mark, et al. "Mobilenetv2: Inverted residuals and linear bottlenecks." *Proceedings of the IEEE conference on computer vision and pattern recognition*. 2018.
  27. Nataraj, Lakshmanan, et al. "Malware images: visualization and automatic classification." *Proceedings of the 8th international symposium on visualization for cyber security*. 2011.
  28. Ö zten, Ceren Umay, and Adem Tekerek. "Efficientnet-Based Deep Learning for Malware Classification: A Dynamic Distribution Adaptation Approach." *Politeknik Dergisi*: 1-1.
  29. Ronen, Royi, et al. "Microsoft malware classification challenge." *arXiv preprint arXiv:1802.10135** (2018).