CNN vs transformer variants: malware classification using binary malware images

Abstract

Malware classification is essential because their varieties can be characterized and labeled to provide information about their risks, how they enter our systems in the first place, and the precautions that need to be taken to prevent them. Numerous highly successful studies have been carried out on binary malware picture datasets utilizing models based on Convolutional Neural Networks in order to address this grave security-related problem. Common examples of such well-known models include ResNet-50, Inception-V3, VGG-16, DenseNet-201, etc. However, these models have very high parameters, giving them long run times. In order to address this issue and introduce novelty, we provide our own CNN-based approach that exhibits a noteworthy reduction in parameters, as low as 2.1 million while maintaining an excellent accuracy rate of 99.44% on the Malimg dataset. Furthermore, we include a range of Transformer models in our analysis due to the limited availability of literature on their application regarding binary malware image datasets. These highly developed models used for comparison on the binary malware image dataset called Malimg include Vision Transformer (ViT), Compact Convolutional Transformer (CCT), and External Attention Network (EANet). Finally, we use an explainable AI method called LIME to illustrate our suggested model's sample selection and classification process to better understand the prediction process of our model.