# A New Framework for Visual Classification of Multi-Channel Malware Based on Transfer Learning
###### Abstract  
With the continuous development and popularization of the Internet, there has been an increasing number of network security problems appearing. Among them, the rapid growth in the number of malware and the emergence of variants have seriously affected the security of the Internet. Traditional malware detection methods require heavy feature engineering, which seriously affects the efficiency of detection. Existing deep-learning-based malware detection methods have problems such as poor generalization ability and long training time. Therefore, we propose a malware classification method based on transfer learning for multi-channel image vision features and ResNet convolutional neural networks. Firstly, the features of malware samples are extracted  
invade or spread. Attackers can take advantage of vulnerabilities in web services, browsers, and operating systems or use social engineering technology to allow end users run malicious code to spread malicious software. In addition, attackers also use some obfuscation technologies, such as code integration, dead-code insertion, subroutine reordering, instruction substitution, and code transposition, to circumvent the detection by traditional defense means (such as firewalls, anti-virus software, and gateways) [1]. Moreover, this affects manual analysis to some extent. Therefore, how to detect and classify malware quickly and accurately is a research hotspot in the field of network security. Malware detection technologies are generally divided into two categories: static [2; 3; 4; 5] and dynamic [6; 7; 8; 9] analysis methods. The static analysis methods do not require actual running of malware samples and focus on code analysis, for example analyzing the structure and syntax of malicious binary files and performing classification detection according to family characteristics. Dynamic analysis methods can reveal the behavior of malware, which is not affected by obfuscation technology and can detect unknown malware samples. However, this is very time-consuming, and the operation steps are very cumbersome. Although the above problems can be solved by using static analysis methods, they rely on efficient anti-virus engines and comprehensive virus databases, resulting in the lower accuracy of sample detection. In order to compensate for the shortcomings of static analysis methods, relevant personnel began to investigate the malware detection and classification methods based on visualization [10; 11] and have achieved good performance. Despite the increasing number and variety of malware, the core of the binary or assembly code of malware in the same family has similarities. After visualization, the essential characteristics of image texture and structure will not be changed, which can effectively combat the problem of malware confusion. Machine-learning-based visualization techniques [12; 13] are simple to operate, short in consumption time, and less dependent on data. However, they are vulnerable to the impact of feature engineering and have difficulty dealing with large volumes of malware. Although significant numbers of malware samples can be identified daily, it is still very difficult to detect and classify malware solely by relying on manual work. In recent years, deep learning [14; 15; 16; 17] has developed rapidly in detecting malware samples, avoiding the complexity of the manually extraction of features in traditional machine learning. At the same time, it reduces the impact on the accuracy of malware detection caused by analysts' lack of experience and ability and can effectively resist malware attacks. Therefore, some researchers began to combine deep learning with visualization technologies [18; 19; 20; 21; 22; 23] to classify and detect malware, providing a new way to detect and classify malware. Currently, most malware visualization methods convert the information in binary files into grayscale images. Then, the similarity between the texture features or other malware features is observed to determine if it is the same family.