## 4 The Proposed Method  
Figure 5 depicts the fundamental steps of the proposed malware classification method. There are five steps in total: (1) Dataset preparation, (2) Visualized Malware Pre-processing, (3) Feature extraction, and (4) Classification. These steps' specifics are as follows:  
Figure 4: GoogLeNet design [29]. Figure 5: Proposed method flowchart. Step 1: **Dataset Preparing. **  
Malware binaries are used to construct eight-bit vectors. A grayscale image, as seen in Figure 6, is created from the resultant 8-bit vectors. This procedure is known as visualization. The ability to clearly distinguish between the various parts of a binary is the greatest advantage of malware visualization. Visualization-based malware classification is both substantially faster and more accurate than conventional analysis techniques. Figure 7 displays the bytes file, which represents the malware's binary data in its raw hexadecimal format provided by Microsoft. As evident from the figure, the first eight characters of each line are used as a reference to identify the line number. The final line demonstrates how certain hex content is inaccessible and is represented by \"??\". Step 2: **Visualized Malware Pre-processing. **  
The malware binary files are transformed into 2D malware images, as was mentioned in the first phase, and these images' sizes vary between the 25 families that have been put to the test. The malware images must be resized as part of the pre-processing step for malware information to make the malware images collected from the first step fit with the input size of the used CNN model. The primary benefit of the resizing method is shrinking the size of the input images, which is very helpful in hastening training and lowering the computing burden on the utilized CNN model. Additionally, during the re-dimensionalization procedure, the malware images' primary textural characteristics are maintained. Step 3: **Feature Extraction. **  
In the approaches used to classify malware, the feature extraction step is essential. Both hand-engineering and deep learning techniques are used to extract the features in this  
Figure 6: Malware binary to grayscale image conversion procedure. Figure 7: One byte file screenshot. case. As described in the next subsections, the objective is to extract valuable features from different applications. Step 3.1: **Tamura Features Extraction. **  
The malware can be easily identified by its texture-based feature from visualized malware. Tamura Texture features, including coarseness, contrast, and directionality, are extracted using hand-engineering techniques, as demonstrated in Algorithm 1. The obtained Tamura feature vector has a dimension of 1 \(\times\) 3. ```
Input: Malware that has been visualized. Output: Texture features vector. 1 Load malware that can be seen. 2 Calculate the texture features to Tamura coarseness, contrast, and directionality according to the Equations (5) and (6). 3 Three features vector are gained. ```  
**Algorithm 1**Compute Tamura's textures features. Step 3.2: **GoogLeNet Features Extraction. **  
The deep features were extracted using the GoogLeNet pretrained CNN model, as demonstrated in Algorithm 2. The features were extracted using the activations function on the \"pool5-drop 7 \(\times\) 7 s1\" global average pooling layer. The feature vectors' dimensions are 1 \(\times\) 1024. ```
Input: Malware that has been visualized. Output: Deep features vector. 1 Load malware that can be seen. 2 The malware images must be resized into 224 \(\times\) 224 to fit with the input size of the used GoogLeNet CNN model. 3 Apply GoogLeNet CNN Model. 4 Using the activations function on the global average pooling layer \"pool5-drop_7 \(\times\) 7_s1\", features were extracted. 5 \(1\times\) 1024 feature vectors are gained. ```  
**Algorithm 2**Compute GoogLeNet features. Step 4: **Classification. **  
The remarkable features allow for the creation of an efficient classification model. The primary function of the classification step is to categorize data into classes.