DLMC_Net: Adaptive Self Attention Module and Customized Convolutional Neural Network with Borderline SMOTE for Classification of Malwares using Byte Code Images

Technical Summary: DLMC_Net for Malware Classification

Problem Statement
The rapid proliferation of sophisticated and automatically generated malware variants has rendered traditional signature-based detection systems increasingly ineffective. While machine learning (ML) and deep learning (DL) have been adopted to automate detection, traditional ML methods often rely on handcrafted features that are knowledge-intensive and struggle with obfuscated or anti-analysis malware. Furthermore, existing deep learning approaches often face two critical challenges: the loss of semantic information during binary-to-image conversion (due to truncation or padding) and severe class imbalance in benchmark datasets like Malimg, where certain malware families vastly outnumber others, leading to biased model training.

Methodology
The authors propose DLMC_Net, a novel deep learning framework designed for the multi-class classification of 25 malware families using Byte Code Images (BCI). The methodology integrates three core components:

1. Customized CNN Backbone: The model employs a tailored Convolutional Neural Network to extract local spatial features from 150×150 grayscale BCI inputs. This backbone consists of two convolutional blocks, each containing a convolutional layer, Batch Normalization (to stabilize training and prevent internal covariate shift), ReLU activation, and Max Pooling (to downsample and reduce computational cost).
2. Adaptive Self-Attention Module: To address the limitation of CNNs in capturing global context, the extracted spatial features are passed through an adaptive self-attention mechanism. This module dynamically learns the importance of different spatial regions by computing Query (Q), Key (K), and Value (V) matrices. It calculates attention scores to weigh local features based on their relevance, thereby capturing long-range dependencies and highlighting discriminative malware regions while suppressing redundant information.
3. Borderline SMOTE (BLS) for Class Imbalance: Recognizing the inherent class imbalance in the Malimg dataset, the authors utilize the Borderline SMOTE technique. Unlike standard SMOTE, BLS focuses on generating synthetic samples for minority classes specifically near the decision boundaries (where misclassification is most likely). This up-sampling strategy ensures a balanced distribution of training data, preventing the model from being biased toward majority classes.

The workflow involves converting malware binaries to BCI, resizing them, normalizing the data, applying BLS for balancing, and then training the DLMC_Net architecture. The final classification is performed via fully connected layers and a Softmax activation function.

Key Contributions
The paper outlines five primary contributions:

1. Novel Architecture: The design of a customized CNN structure specifically optimized for robust multi-class malware classification using BCI.
2. Attention Integration: The embedding of an adaptive self-attention module within the CNN to enhance feature representation by capturing both local patterns and global dependencies.
3. Model Simplification: A reduction in the total number of trainable parameters compared to complex pre-trained models, making the architecture more efficient.
4. Imbalance Handling: The application of Borderline SMOTE to the Malimg dataset to reinforce minority class representation and improve classification robustness.
5. Comprehensive Evaluation: An in-depth comparative analysis against state-of-the-art (SOTA) baseline models, demonstrating superior performance metrics.

Experimental Results
The model was evaluated on the Malimg benchmark dataset (9,366 images across 25 classes) and compared against four baseline deep learning models: VGG-16, InceptionResNet-V2, EfficientNet-B2, and DenseNet-201.

• Performance with BLS: The proposed DLMC_Net, when combined with BLS, achieved exceptional performance metrics:
  • Accuracy: 99.92%
  • Precision: 99.92%
  • Recall: 99.92%
  • F1-Score: 99.91%
  • AUC: 99.96%
• Comparison: These results significantly outperformed all baseline models, which achieved accuracies ranging between 91.42% and 92.24%.
• Ablation Study: The study confirmed the necessity of each component. A version of the model without BLS or the attention module dropped to 82.95% accuracy. Adding BLS improved this to 87.23%, and the full integration of the attention module resulted in the final 99.92% accuracy. This demonstrates that the synergy between balanced data and the attention mechanism is critical for high-performance classification.

Significance and Claims
The authors claim that DLMC_Net provides a highly effective and reliable solution for large-scale malware classification. The significance of the work lies in its ability to overcome the limitations of both traditional signature-based detection and standard deep learning approaches by:

• Effectively handling the class imbalance problem that typically plagues malware datasets.
• Capturing both local structural patterns and global contextual dependencies through the hybrid CNN-Attention architecture.
• Achieving near-perfect classification accuracy (99.92%) on a standard benchmark, suggesting it can efficiently assist security experts in identifying diverse malware families.

The paper concludes that the proposed framework is a scalable approach for real-world applications and suggests future work involving the integration of Quantum Machine Learning (QML) to further enhance representation power and computational efficiency.