## 4 Task-Aware Meta Learning-Based Siamese Neural Network
### Task-Aware Meta-Learner  
Our task-aware meta-learner provides two important functionalities: one is generating optimized task-specific weights, using the entropy values extracted from a pre-trained deep learning model (e.g., VGG-16); the other function is to work with the image network, to compute the new weights, based on the shared weights and the task-specific weights, so that the embedding loss is accurately calculated, in order to capture the relative distance across inter-class variance (e.g., the features of the image). These functions are necessary, because some malware samples (e.g., zero-day attack samples) are usually much smaller than the number of images required for training an SNN model.  
Using the entropy values, our meta-learner recognizes a specific malware signature present in the entropy, so that later it uses this knowledge to find whether some malware samples are derived from the same malware family or not (e.g., obfuscated malware). The entropy values are extracted from the VGG-16 when entropy graphs are inputted.  
We use entropy graphs to recognize a unique malware signature belonging to each malware family. To illustrate the use of an entropy graph as a task specification, four samples of malware images are shown in Figure 7. Figure 6(a),b are two obfuscated malware samples from the same Wroba.wm family. Similarly, Figure 6(c),d of the name Agent.ad are from the same Agent family. One can see that the entropy graphs within the same family share a similar pattern, while there are visible differences in the entropy graphs between two different malware families.  
Our task-aware meta-learner utilizes the entropy values extracted from the entropy graph, to train our proposed model to recognize if an image pair is similar or dissimilar (i.e., belong to the same malware family or not)--see Algorithm 2. To obtain an entropy graph, a malware binary file is read as a stream of bytes, and is separated into a few segments.  
Figure 7: Examples of entropy graphs of two malware families.  
The frequency of unique byte value is counted, and computes the entropy, using [PERSON]'s formula, as follows:  
\[Ent=-\sum_{i}\sum_{j}M(i,j)logM(i,j), \tag{4}\]  
where \(M\) is the probability of an occurrence of a byte value. The entropy obtains the minimum value of 0 when all the byte values in a binary file are the same, while the maximum entropy value of 8 is obtained when all the byte values are different. The entropy values are then represented as a stream of values that can be reshaped as an entropy graph. The entropy graph is then converted as a feature vector inputted through the convolutional extractor of a pre-trained network (e.g., VGG-16 [46]). The summary of the steps involved in the entropy graph is described in Algorithm 2:  
```
Input :\(f\): malware binary file; \(l\): segment length; \(n\): the number of files Output :entropy graph matrix \(m\) whilenot reach to \(n\)do  1. read \(l\) bytes from \(f\), and defined as segment \(s\);  2. for\(i=0\) to 255 do  3. compute the probability \(p_{i}\) of \(i\) appearing in \(s\);  4. compute the Shannon entropy  Generate entropy graph \(m\)
```  
**Algorithm 2**Pseudo-code of entropy graph