# Image-Based Malware Detection Using \(\alpha\)-Cuts and Binary Visualisation
## 4 Results
### Experimental Results  
According to our methodology, we evaluated our images in terms of the successful colour-based pattern construction of ASCII characters, but as described in Section 3.4, we also tested reduced datasets of them, namely for \(\alpha=0.3\) and \(\alpha=0.6\). Additionally, we implemented this image processing technique for the colouring methodology of [17] to achieve a complete comparison between the two methods. Notably, the works of [17; 18] performed limited clustering of the ASCII Table; hence, these images exhibited fewer patterns compared to ours. Moreover, we acknowledge the importance of dataset size in ML procedures and tested the various methods for four different sizes, namely 1250, 2500, 5000, and 10,000 images. Each dataset consisted of 50% malicious and 50% benign images. Overall, we ran a total of 28 experiments in order to include all different combinations of colour class methodologies, \(\alpha\)-cut processing, and dataset size. A comparison of the various methods is presented in Tables 4-10. In Tables 8-10 we show the results of our proposed method. Table 8 describes the evaluation scores of the curated image datasets with the colour classes described in Table 1, while Tables 9 and 10 present the results of the reduced image datasets for \(\alpha=0.3\) and \(\alpha=0.6\), respectively. As is demonstrated, an increased dataset size has a positive effect on the training of ResNet50. More specifically, for the experiments with unprocessed images (without taking an \(\alpha\)-cut), the dataset of 1250 images delivered 86.40% accuracy, 92.59% precision, 79.36% recall, and 85.47% F-score, while the dataset of 10,000 delivered 93.89% accuracy, 96.40% precision, 91.20% recall, and 93.73% F-score. As it can be observed, these improved scores for the largest dataset seem to perform slightly worse than their counterparts for the unprocessed images of the [17] methodology in Table 5, which delivered 94.50% accuracy, 97.23% precision, 91.60% recall, and 94.33% F-score. Evaluation metrics for the model of the reduced dataset for \(\alpha=0.3\) in Table 9 show that it does not perform better than the model for the unprocessed dataset in Table 8. Indeed, its best-performing model delivered 93.40% accuracy, 96.56% precision, 90.00% recall, and 93.16% F-score. The same notion is repeated with the reduced dataset of \(\alpha=0.6\) in Table 10, where the best-performing model delivered 93.60% accuracy, 94.48% precision, 92.60% recall, and 93.53% F-score. We also observed similar results for the reduced datasets of the colouring method of [17] in Tables 6 and 7. According to them, the best performing model of the reduced dataset with \(\alpha=0.3\) delivered 93.89% accuracy, 95.82% precision, 91.80% recall, and 93.76% F-score, while the best performing model of the reduced dataset of \(\alpha=0.6\) delivered 92.80% accuracy, 95.72% precision, 89.60% recall, and 92.56% F-score. From these results, we conclude that reducing images with the help of \(\alpha\)-cuts did not increase the model's accuracy metrics. However, it is worth mentioning that the differences between the scores of each method were numerically insignificant. In any case, the best performing models of both the unprocessed and the reduced datasets for our proposed method and the work of [17] significantly surpassed the best performing model of [18] in Table 4, which reported 89.80% accuracy, 92.70% precision, 86.40% recall, and 89.44% F-score. Despite the seemingly unimproved metrics we acquired when applying the \(\alpha\)-cuts to our dataset, we observed a significant contribution of this method when we plotted the learning curves for each model. For the majority of the best-performing models, the learning curves displayed high fluctuation, which indicated the model's unsuitability for generalisation.