# Image-Based Malware Detection Using \(\alpha\)-Cuts and Binary Visualisation
## 3 Materials and Methods
### Deep Learning for Image Recognition  
Convolutional Neural Networks  
CNNs are a class of deep neural networks that were developed in the 1980s and drew their inspiration from research on the visual cortex of the brain [76; 77; 78; 79; 80; 81; 82]. Ever since, they have been employed in image recognition, and in 1998, they had their major breakthrough when a series of publications by [83; 84; 85; 86; 87] led to the recognition of handwritten digits. As  
Figure 6: A malicious image in (**a**) and reduced images of it, for \(\alpha=[0.1,\ldots,0.9]\) in (**b**–**j**), respectively.  
Figure 7: A natural image in (**a**) and reduced images of it, for \(\alpha=[0.1,\ldots,0.9]\) in (**b**–**j**), respectively.  
traditional artificial neural networks would fail in image pattern recognition (given their fully connected layers and a large number of pixels per image), CNNs provide a solution by deploying partially connected layers and weight sharing. This cost-effective strategy is achieved by introducing two novel building blocks: the convolutional layer and the pooling layer [88]. Typically, CNNs are trained using supervised learning techniques and tested on a testing dataset they have never seen before. Currently, there are multiple sophisticated CNN architectures (with many variants) that can successfully classify millions of images into several thousands of classes [89]. In this paper, to successfully detect patterns of malicious code in file-based images, we deploy the ResNet50 architecture.  
The ResNet50 is a variant of the Residual Network or ResNet architecture. ResNet was introduced by [90], when he won the ILSVRC challenge in 2015, with the original model composed of 152 layers. Other variants include ResNet18, ResNet24, and ResNet101. The ResNet architecture relies on a stack of residual units, where smaller neural networks with skip connections pass the signal to the whole network. The residual connections allow for the network to learn a more efficient representation of the data. This helps to reduce the vanishing gradient problem that occurs in deeper networks, making it easier to train deep models. Its depth allows the network to learn complex features and patterns in the data, leading to better classification performance. However, despite its deep architecture, ResNet50's functionality speeds up training significantly and results in a total of 23 million trainable parameters. From previous work on binary visualisation images in [91], ResNet50 was shown to generalise well to new and unseen images, making it a reliable choice for classification tasks of synthetic images. In general, it offers several advantages over other models, including improved training, better performance, and generalisation. It has a total of 48 Convolutional layers, 1 Max Pooling layer, and 1 Average Pooling layer.  
It is important to note that each ResNet50 model of our experiment was implemented from scratch without any use of transfer learning. Our models were hyperparameterised for batch size, optimiser, and learning rate. We also employed early stopping, and since we are dealing with binary classification, our activation function of choice was the sigmoid function. Finally, for each dataset, we used 80% of the images as the training dataset, 10% as the validation dataset, and 10% as the testing dataset.