# Malware Variants Detection Model Based on MFF-HDBA
## 2 Related Research
### Vision-Based Malware Recognition Using Deep Learning  
Compared with machine learning, deep learning is an end-to-end framework which can implement automatic feature extraction and classification, thus avoiding the influence of man-made factors. Many researchers combined deep learning techniques and vision-based malware detection and achieved good results. [PERSON] [22] proposed a weighted loss function to optimize CNN for malware classification. The method controlled the weighting loss by introducing a parameter. Compared with the model without weighted loss function, their method obtained better results. [PERSON] et al. [23; 29] reviewed many malware detection approaches based on deep learning for a systematic analysis. In addition, they also developed a novel malware detection model by combining graph attention networks (GAN) and Node2 Vec in order to improve the performance of malware detection methods, and achieved better classification accuracy. [PERSON] et al. [24] analyzed the characteristics and shortcomings of manual feature extraction, and designed a deep neural network structure for extracting texture features of malware images. The method achieved good classification performance on several malware data sets, with good generalization ability. However, the structure of the network was shallow, and it was difficult to capture deep feature information of malware. Thus, it was less effective in identifying challenge malware variants that were encrypted by packing or obfuscation. [PERSON] et al. [25] proposed a hybrid deep learning framework for malware detection. They used CNN with cost sensitivity to extract texture features of malware images, and bidirectional gated recurrent unit (BiGRU) to capture byte sequence information, which increased feature diversity and greatly improved detection accuracy. Some literature [30; 31; 32] noted that attention mechanism enhances the feature extraction ability of deep neural networks. Thus, many scholars tried to utilize attention mechanism to improve malware detection. [PERSON] et al. [33] developed a depthwise efficient attention module (DEAM), which was an improvement of convolutional block attention module(CBAM), in order to enhance feature representation and improve the model's performance. They combined DEAM and Densenet [34] to identify malware samples, and obtained a higher classification accuracy. However, the model structure was complex while the time cost and computational resource consumption were high. [PERSON] et al. [35] implemented self-attention operation on the malware images before they were input to the first convolution layer. In addition, they applied spatial pyramid pooling layer before the full connected layer to adapt to different sizes of malware input. Experimental results indicated that a combination of self-attention and spatial pyramid pooling can effectively improve malware detection accuracy. Additionally, many researchers found that imbalanced data sets negatively impact the performance of malware detection, and searched for solutions. [PERSON] et al. [26; 36] used swarm intelligence algorithm to deal with the issue of imbalanced data sets. They regarded the CNN accuracy as objective function, and utilized swarm intelligence algorithm to dynamically resample the batch size of input malware samples. After ensuring the best batch size of input, they trained the CNN using the best batch size. Compared with before batch size resampling, the method achieved a significant improvement in performance. [PERSON] et al. [37] designed a customized loss function to counteract malware data set imbalance. They applied the reweighted class-balanced loss function in the final layer of Densenet to improve classification performance. Experiments showed that their method can solve the issue of imbalanced data sets effectively to obtain high classification accuracy. Recently, transfer learning technique [38; 39] has been applied for malware classification to reduce the misclassification rate.