## 3 Proposed Visualized Malware Multi-Classification Framework
### Transfer Learning (TL) Phase  
TL refers to transferring the CNN parameters of a specified detection task with a specific image database to a new classification challenge with a different detection task for another image database. Almost all deep CNN models trained and learned on natural digital images have a common phenomenon: they understand and discover the general features of the input images through their first CNN layers, where these features are not specific to a particular task or dataset. However, they can be applied to many classification tasks and different image datasets. Therefore, the benefit of TL can be a formidable solution when the target database is considerably smaller than the original database; this is to avoid the overfitting occurrence, especially in the case of imbalanced datasets. Consequently, the malware classification task can be considered to be an image classification task, especially when the malware binary samples are converted into visual malware images. Thus, the standard CNN models used for natural image classification can be exploited to classify the visualized malware images. In this regard, the TL-based CNN models trained on the benchmark ImageNet database [41] can be efficiently adapted to detect malware families. This database is updated through an annual competition called the \"ImageNet Large-Scale Visual Recognition Challenge (ILSVRC)\" which is created for visual object detection challenges. Many CNN models were already trained on natural images such as VGG16 [42], AlexNet [43], DarkNet-53 [44], DenseNet-201 [45], Inception-V3 [46], Places365-GoogleNet [47], ResNet-50 [48], and MobileNet-V2 [49]. In this paper, to obtain and extract the main features of the malware images, we used these eight pre-trained CNN models on the ImageNet database to identify general objects. Therefore, these models can be retrained and tested quickly using malware images to extract the main features from the input malware images; this is the great benefit of the TL concept. Thus, TL-based CNN architectures have started \begin{table}
\begin{tabular}{c c c} \hline \hline
**No.** & **Tested CNN Model** & **Input Image Size** \\ \hline
1 & VGG16 & 224 \(\times\) 224 \(\times\) 3 \\
2 & AlexNet & 227 \(\times\) 227 \(\times\) 3 \\
3 & DarkNet-53 & 256 \(\times\) 256 \(\times\) 3 \\
4 & DenseNet-201 & 224 \(\times\) 224 \(\times\) 3 \\
5 & Inception-V3 & 299 \(\times\) 299 \(\times\) 3 \\
6 & Places365-GoogleNet & 224 \(\times\) 224 \(\times\) 3 \\
7 & ResNet-50 & 224 \(\times\) 224 \(\times\) 3 \\
8 & MobileNet-V2 & 224 \(\times\) 224 \(\times\) 3 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: The tested fine-tuned CNN models and their input size. recently to be employed for intrusion detection and malware classification research. This is because TL can offer effective and promising detection solutions through knowledge transfer from standard image detection tasks to malware image detection tasks. Among all TL-based CNN models examined in this paper, the fine-tuned VGG16 model accomplishes the best superior and promising results for visual malware multi-classification compared to other models. Therefore, we provide deep insights into its architecture, behavior, parameters, and simulation results. Thus, the proposed multi-classification framework has implemented the fine-tuned version of the pre-trained VGG16 CNN architecture model shown in Figure 2; to classify visualized malware images. The TL-based VGG16 model is already trained on more than 14 million digital images of the ImageNet dataset. It is primarily introduced to resolve various identification challenges such as plant image, plankton, lung nodules classifications [42]. As observed in Figure 2, the DL VGG16 architecture comprises different connected CNN layers (16 layers) that are (1) five max-pooling (MP) layers, (2) five groups of convolutional (Conv.) layers, (3) three fully connected (FC) layers, and (4) a SoftMax output layer.