# A New Framework for Visual Classification of Multi-Channel Malware Based on Transfer Learning
## 4 Experimental Evaluation
### Experimental Results
#### 4.3.4 Comparison of Image Enhancement for Malware Sample Classification Performance  
Due to the unbalanced distribution of the samples in the malware family, the generated multi-channel images were processed using the CLAHE algorithm, which performs the data enhancement. The original data were compared with the enhanced data, as shown in Table 4. We found that the accuracy of the data enhancement method reached 99.99%, which was 0.10% higher than the original data. At the same time, we observed the macro average and micro average of the F-score before and after using the enhancement method, and the results achieved were significantly better. Therefore, the experimental results showed that data enhancement can reduce the dependence of the model on feature attributes, while reducing the problem of the poor detection effect due to the imbalance of the data samples. 3.5 Comparison of Grayscale and Multi-Channel Images for Classification Performance of Malware Samples  
The bytes in malware binary files were extracted, and three different methods were used to generate the grayscale images (ASCII, hexadecimal, and entropy images). Then, the bilinear interpolation algorithm was used to unify the image size. The three grayscale images were fused to generate multi-channel images. The experiment compared and analyzed the evaluation indicators (precision, recall, and F-score) of the three size-unified grayscale and multi-channel images, as shown in Figures 8-10. The abscissa represents the class label in the malware family, and the ordinate represents the value of the evaluation index. Through observation, the effect of fusion into multi-channel images was obviously due to the grayscale image of a single channel. Even when the number of samples was small, the performance was good. In addition to comparing the evaluation indicators, we used the confusion matrix to conduct a comparative analysis of the grayscale and multi-channel images, as shown in Figure 11. Figure 11a-d correspond to the ASCII, entropy, hexadecimal, and images generated using this paper's method. We found that the image generation method proposed in this paper had a better effect, and the effect in each category was better than the other methods. .3.6 Comparison of Different Classification Models for Classification Performance of Malware Samples  
In this paper, the classification performance of different ResNet networks for malware multi-channel images was also compared and analyzed. The experimental results are shown in Table 5. When the training cycle was set to 10, because the proposed method is based on transfer learning, it achieved a good effect quickly. However, after many experiments, the performance of convolutional neural networks without transfer learning is very poor. Therefore, we set the training period of the convolutional neural network without transfer learning to 30 to compare the classification performance of different classification models for malware samples. By observing Table 5, we find that, basically, all network models reached a high accuracy rate, which was above 96%. ResNext50_32x4d and ResNext101_32x8d are improved versions of ResNet, mainly updating the blocks. However, compared with ResNet50 and ResNet101, the accuracy rate and other indicators did not perform well. At the same time, Table 5 also compares the layers of different ResNet networks. With the increase of the layers, the performance did not show an upward trend. It may be that it is difficult for the complex model structure to play the role of high-level semantic information. The accuracy of the method proposed in this paper was \begin{table}
\begin{tabular}{c c c c} \hline \hline  & **Accuracy** & **Micro Avg** & **Macro Avg** \\ \hline Proposed & 0.9999 & 0.9935 & 0.9935 \\ No-enhanced & 0.9989 & 0.9890 & 0.9898 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Comparison of results before and after using data enhancement methods. the highest, reaching 99.99%. At the same time, comparing different networks' macro and micro averages showed an ideal value.