# Malware Variants Detection Model Based on MFF-HDBA
## 3 Methodology
### Feature Extraction and Classification  
CNN is an end-to-end framework, which is able to realize automatic feature extraction and classification. Currently, CNN models have been widely used in malware detection and classification tasks. However, these methods utilize a single-scale convolution kernel in each layer for feature extraction of malware images. Features extracted via single-scale convolution kernels lack of diversity and robustness. Furthermore, the classification performance of models critically depends on feature extraction. Thus, the above methods have a high misclassification rate. In order to solve the above problems, we designed a novel feature extraction and classification structure based on CNN. The core design idea of the structure is to increase feature diversity and enhance the feature extraction capability of the model. It enables our model to use a small number of neural network layers to obtain the feature extraction effect of a deeper neural network, which can decrease the model parameters. In addition, shallow neural network layers have fewer neural network parameters and floating point operations (FLOPs), which can improve the speed of model operations. This means that our \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Method** & **Setting** & **Method** & **Setting** \\ \hline rescale & 1/255 & shear range & 0.0 \\ width shift & 0.0 & zoom range & 0.0 \\ height shift & 0.0 & horizontal flip & false \\ rotation range & 0.0 & fill mode & none \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Parameter settings of data augmentation. Figure 4: Partial malware images after data augmentation. model not only enhances feature extraction ability, but also performs malware classification rapidly. The proposed structure mainly consists of CBR layers, max-pooling layers, multi-scale feature extraction blocks, a dropout layer, a flatten layer, and a fully connected layer. The CBR layers are the basic units of the model, which include a convolution layer, batch normalization (BN) layer, and rectified linear unit (ReLU) activation function. The CBR layer is an improvement of the traditional convolutional layer, and can accelerate convergence of the model. The process of CBR layer operation is as follows: the input features first enter the convolution layer for convolution operation, then feature maps enter the BN layer for batch normalization, and finally the ReLU function is used to activate feature maps to obtain a nonlinear feature output. Multi-scale feature extraction blocks form the core blocks of the model, which includes multi-scale feature fusion and channel attention mechanism, as shown in Figure 5. The core idea of multi-scale feature fusion is to simultaneously extract multi-scale features of input at multi-scale convolutional kernel sizes in order to increase feature diversity. These features are fused to generate a general feature that takes into account both local and global information. In the process of feature extraction, the feature map is obtained by combining the features extracted from each channel; however, not every channel can extract features effectively. Channel attention mechanism can calculate the weights of each channel based on the feature extraction effect of each channel and assign relatively large weights to the channels with good feature extraction effects, while relatively small weights are assigned to the channels with poor feature extraction effects. That enables channel attention mechanism to focus on the main information of the feature maps, which can enhance the core feature representation of malware, and improve the accuracy of malware detection and classification. In the multi-scale feature fusion part, firstly, the input feature \(F\in\mathbb{R}^{C\times H\times W}\) is operated by four branches \(I\), \(II\), \(III\), \(IV\) simultaneously. In order to make the extracted features diverse and representative, convolutional kernels with different RFs are used in each branch for feature extraction.