# A New Framework for Visual Classification of Multi-Channel Malware Based on Transfer Learning
## 3 Methodology
### Convolution Neural Network Classification  
Theoretically, the deeper the layers of the neural network are, the more complex the model structure is, the more comprehensive the features extracted will be, and the better the effect will be. However, the effect is not good in practical applications. At the same time, the problem of gradient disappearance or gradient explosion becomes more serious when the convolutional neural network is stacked to a certain depth. Therefore, we used the ResNet convolutional neural network to classify malware images to prevent the above problems and obtain better classification and detection results. ResNet was first proposed by Microsoft Lab and was the champion of the ImageNet competition in 2015. The network proposes a residual network structure and builds an ultra-deep network structure (over 1000 layers). At the same time, it uses batch normalization to speed up the training (discard the dropout). Compared with other convolutional neural networks, ResNet can greatly improve the system's robustness and significantly improve the effect of classification detection. Figure 5 shows the proposed convolutional neural network architecture.  
We took a multi-channel RGB image of size 256 \(\times\) 256 as the input and the improved ResNet34 convolution neural network model was used for classification detection. First, input the image into a 7 \(\times\) 7 convolutional layer with the size of the convolutional kernel, then through four convolution groups, including 16 residual network structures (3 dotted line residual network structures and 13 solid line residual network structures). Then, the downsampling of the first convolution group is realized by a maximum pooling layer with a 3 \(\times\) 3 convolution core size. The remaining convolution group's downsampling is realized by the residual blocks adjacent to the previous convolution group. Finally, we output through the average pooling layer and the fully connected layer and used the softmax function to convert our output into a probability distribution. In the training phase,  
Figure 5: Proposed neural network architecture.  
the convolutional neural network model was trained using the cross-entropy loss function, and the model parameters were learned using the ADAM optimizer. The formula of the cross-entropy loss function is as follows:  
\[CrossEntropyLoss=-\sum_{i-1}^{N}p(x_{i})\log p(x_{i})+(1-p(x_{i}))\log(1-p(x_{i})) \tag{9}\]  
where \(N\) is the number of categories, \(p(x_{i})\) represents the true distribution of the samples, and \(q(x_{i})\) denotes the distribution predicted by the model.  
Compared with the ResNet34 convolutional neural network model, we set the steps of the first and second convolutional layers of the dashed residual network structure to 1 and 2, respectively. The GELU activation function was used, and the model parameters trained on ImageNet were used for the transfer training. Therefore, this can accelerate the training speed and enhance the model's generalization ability. At the same time, the classification speed was significantly improved, and the accuracy would be better.