# A Neural Network Approach to a Grayscale Image-Based Multi-File Type Malware Detection System
## 2 Microservices and Grayscale-Based Image Transform Features
### Grayscale-Based Transform Features  
Recent researchers have made use of visual representations of malicious samples in building malware classifiers based on extracting image-based features from colored or grayscale images. The science of texture was used to determine malware families in which it was noticed that samples that show blocks of similar texture or patterns can belong to the same malware family [9]. Additionally, grayscale images can be fed directly to neural networks for feature learning and classification rather than going through feature engineering processes that are difficult and time-consuming [2]. Additionally, static analysis based on grayscale images has the advantage of analyzing the samples without the need to unpack them [24]. This means that the static image-based approach might give us an advantage in detecting obfuscated malware over other static analysis techniques. The difference in texture that is visualized in the grayscale image represents the different structure of the file's header and contains valuable information about its contents. Researchers made use of the file's binary by converting it into other formats to make use of other processing techniques in classifying the file. Figure 2 shows the representation of a PE header section in a grayscale image representation of malicious samples. The author of [9] converted the executable binary into eight-bit vectors and then converted them into a 2D array to be visualized as a grayscale image with a pixel value range of [1-255]. The \"Gist\" image feature, which relies on the texture of the image, was applied to the resulted grayscale image to extract the features' vector and use it in classifying malicious samples into their respective malware families based on their similarities. Using \"gist\" features with a KNN classifier gave an accuracy of 99.2%. [PERSON] et al. [23] also used grayscale image representation of malware images generated from eight-bit vectors to detect twenty-five different malware kinds using six different deep learning models. Their experiment showed that the Inception-V3 model gives an overall higher accuracy in correctly classifying samples according to their type. The authors of [25] used a binary representation of a PE file at byte level and argued that this 2D representation of sequential code, although it showed a high accuracy of 94.5% using FractalNet DLNN, is subject to a fixed width, which impacts the structure of the machine code by breaking it into different rows; hence, the width should be selected in a way that ensures that the sequence of the code is preserved during the conversion process. [PERSON] and [PERSON] [30] followed a different approach to generating grayscale images by using an intermediate NetPBM text format and PGM to convert a raw PE section header saved in CSV format into raw ASCII images and using the ImageMagick tool to convert it into a viewable image in JPG format. A CNN classifier showed an overall accuracy of 80% in a multi-level classification of samples  
Figure 2: Representation of PE file sections in grayscale image of malicious samples [2]. into seven different classes (one benign and six different malware types) with a train-test ratio of 85:15 [30]. Raw binary bits of executable files were grouped together to represent a corresponding color from a grayscale spectrum and were used with a CNN classifier, showing an accuracy of 96% in binary malware classification and 92.3% in multi-level malware family classification [24]. [PERSON] [31] developed a vision-based framework where samples were converted into grayscale images and used the Adaboost algorithm to achieve 79% accuracy. [PERSON] et al. [32] made use of the fact that grayscale images tend to produce highly accurate classifiers when used with CNN to build a novel approach that relies on dynamic features.