# Detection of Exceptional Malware Variants Using Deep Boosted Feature Spaces and Machine Learning
## 3 Methodology
### Classification Schemes
#### 3.2.1 Implementation of Customized CNN  
We customized different standard deep CNN models according to the compatibility of our proposed malware challenge. These customized architectures are DenseNet-201, GoogleNet, InceptionV3, Xception, Resnet-18, ResNet-50, AlexNet, VGG16 and VGG19 [11; 24; 25; 26; 27] The details of the CNN layers are given in Table 2. Initial and final layers of networks are customized according to the compatibility of the input data set and the target multi-class (25-classes). We implemented the customized existing CNNs in two different ways, softmax probability-based classification and deep feature learning for ML-based classification (DFS-MC). The Softmax probabilistic activation function in CNNs decides the class of the input data. The activation function accepts the input vectors in the form of real numbers and normalizes the inputs to a probability distribution. The output is proportional to the exponentials of its input numbers.  
The customized existing CNNs are trained from scratch and TL-based fine-tuned. Training the CNN model is the only way for adjusting the weights and biases of the model [28]. These architectures are optimized for malware images by training them from scratch on malware datasets by randomly initializing weights from a uniform distribution. Weights are adjusted with the help of optimization algorithms and backpropagation using the training dataset.  
Transfer Learning  
The CNN models are eager to find a large amount of labelled data for the best training. In case the labelled data in the target domain is limited, the concept TL is useful. TL incorporates the concept of initializing the weights of the models with the parameters  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Augmentation** & **Parameters** \\ \hline Rotate & \([0,360]\) degrees \\ Scale & \([0.5,1]\) \\ Reflection-X & \(\pm 1\) \\ Reflection-Y & \(\pm 1\) \\ Shear & \(\pm 0.05\) \\ \hline \hline \end{tabular}
\end{table}
Table 1: Dataset augmentation details.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Models** & **Depth (Convolutional + Fully Connected Layers)** \\ \hline DesNet-201 & 203 (201 + 2) \\ ResNet-18 & 22 (20 + 2) \\ Google Net & 59 (57 + 2) \\ Inception-V3 & 96 (94 + 2) \\ Xception & 75 (74 + 2) \\ ResNet50 & 55 (53 + 2) \\ AlexNet & 8 (5 + 3) \\ VGG-16 & 16 (13 + 3) \\ VGG-19 & 19 (16 + 3) \\ \hline \hline \end{tabular}
\end{table}
Table 2: Details of deep CNN models.  
of already trained models. TL gives a good initial estimation of the parameters and reduces the overfitting. This training scheme has shown enhanced performance in the field of malware classification challenges. Pre-trained CNN models of the source domain (Image Classification, ImageNet) are adopted for the target domain (Malware Classification, MalImg) with the help of fine-tuning. This fine-tuning is carried out with the help of additional layers or dissecting the existing layers accordingly. This concept is known as domain adaption [27]. We have introduced the concept of TL in the customized existing deep CNN models and fine-tuned on malware dataset. TL uses the knowledge of the existing domain for a new target domain.